createUser: user not allowed

[phillipmohr]

Hi, when trying to register a new user, while logged in, I get the erorr User not allowed

Inside the logs I found
[2022-07-16 21:14:23] POST /admin/users 403 this token needs role 'supabase_admin' or 'service_role'

But where do I add this role to an existing user?

[GaryAustin1]

createUser is designed to be run server side with the service_role key used for init of the client code. It needs a jwt with one of the two roles listed and normal users done thru auth will not have that ability.

[phillipmohr]

how do I make a JWT with one of the listed roles? Is there an example?

[miguelgargallo]

So, shouldn't this be solved before the first release in beta? Cause, I clicked on the work, seems to be in complaint.

[GaryAustin1]

This touches on it a bit https://supabase.com/docs/learn/auth-deep-dive/auth-deep-dive-jwts
But even if you create your own jwt with service_role (like the service_role key), you will need to protect it from being exposed in general client side code.

[mohsenGhalem]

Could someone Explain more about how to create a super admin user in supabase
I have created a normal user by giving him is_super_admin true
but i still get 403 Error code
with the message "his token needs role 'supabase_admin' or 'service_role'"

[mohsenGhalem]

So bassically how i can create a super-admin user ?
in my situation I have admins who can create other users.

[GaryAustin1]

There is only service_role. You should not grant that to an API user.
You probably need to handle this all in server code where you check the user has permission (from a table, or jwt claim) to run the server code that uses service_role.

[mohsenGhalem]

Okay thank you for the reply

Solution that helped me : https://github.com/Chensokheng/next-supabase-dashboard/blob/demo/app/dashboard/members/actions/index.ts

[GaryAustin1]

At a quick glance... NO!!!!
user metadata is not secure. The user can change it at anytime.
https://github.com/supabase-community/supabase-custom-claims
Shows ways using app metadata.

[mohsenGhalem]

Yes, I understand I already have an admins table so the verification will on that table before moving to create the user.