How do I install the Create Supabase Middleware skill?

Run npx skillmds@latest add supabase/create-supabase-middleware in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Create Supabase Middleware safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Create Supabase Middleware?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Create Supabase Middleware free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Create Supabase Middleware?

supabase (@supabase) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Create Supabase Middleware by supabase

Name: Create Supabase Middleware
Author: supabase

Create Supabase Middleware

Use when creating a new middleware for `@supabase/middleware` — either a built-in inside the middleware repo itself, or a standalone package that anyone can publish. Trigger when the user asks to write, scaffold, or add a middleware; describes a per-request cross-cutting concern they want to reuse ("I want to rate limit", "add request logging", "check an API key on every request"); calls `defineMiddleware`; or adds a new directory under `src/middleware/`. Also trigger when a plan proposes a new middleware, before any file is written.

supabase f35446c 2.3 KB Updated Sep 17, 2026

File contents

Creating a middleware

Before scaffolding anything, check the concern is actually middleware-shaped:

Response-only — headers, envelopes, error formatting — belongs in the handler, which owns the response. Not a middleware.
Used once, in one handler — inline it. A middleware earns its keep by being composed across handlers.

Then pick the target by reading the nearest package.json:

`name` is	You are writing	Follow
`@supabase/middleware`	a built-in	`src/middleware/README.md` — layout, then the three subpath-wiring files
anything else	a standalone package	`docs/authoring-guide.md` — the full path, from `defineMiddleware` through publishing

Both paths use the same defineMiddleware primitive; the difference is only whose package it lives in and whether a subpath export has to be wired up.

Read the guide before writing code, and follow its ## Rules section — eight MUST/NEVER items covering one-key-per-middleware, getEnv over process.env/Deno.env, declaring prerequisites in In, yielding at most once, and returning a Response to short-circuit rather than throwing. Its code blocks labeled with a path are complete files: write them to disk as given rather than adapting them from memory. Unlabeled blocks are fragments that elide with { ... }. Never write those verbatim.

Paths are repo-relative. When @supabase/middleware is installed as a dependency, prefix them with node_modules/@supabase/middleware/.

---name: create-supabase-middlewaredescription: Use when creating a new middleware for `@supabase/middleware` — either a built-in inside the middleware repo itself, or a standalone package that anyone can publish. Trigger when the user asks to write, scaffold, or add a middleware; describes a per-request cross-cutting concern they want to reuse ("I want to rate limit", "add request logging", "check an API key on every request"); calls `defineMiddleware`; or adds a new directory under `src/middleware/`. Also trigger when a plan proposes a new middleware, before any file is written.---# Creating a middlewareBefore scaffolding anything, check the concern is actually middleware-shaped:- **Response-only** — headers, envelopes, error formatting — belongs in the handler, which owns the response. Not a middleware.- **Used once, in one handler** — inline it. A middleware earns its keep by being composed across handlers.Then pick the target by reading the nearest `package.json`:| `name` is | You are writing | Follow || ---------------------- | -------------------- | ------------------------------------------------------------------------------------- || `@supabase/middleware` | a built-in | `src/middleware/README.md` — layout, then the three subpath-wiring files || anything else | a standalone package | `docs/authoring-guide.md` — the full path, from `defineMiddleware` through publishing |Both paths use the same `defineMiddleware` primitive; the difference is only whose package it lives in and whether a subpath export has to be wired up.**Read the guide before writing code, and follow its `## Rules` section** — eight MUST/NEVER items covering one-key-per-middleware, `getEnv` over `process.env`/`Deno.env`, declaring prerequisites in `In`, `yield`ing at most once, and returning a `Response` to short-circuit rather than throwing. Its code blocks labeled with a path are complete files: write them to disk as given rather than adapting them from memory. Unlabeled blocks are fragments that elide with `{ ... }`. Never write those verbatim.Paths are repo-relative. When `@supabase/middleware` is installed as a dependency, prefix them with `node_modules/@supabase/middleware/`.

Frequently asked questions