Call Supabase From Make With a Code Step (PostgREST, Upserts, RPC)

What does Make's Supabase app cover, and where does it stop?

Make's Supabase app (module list checked on apps.make.com, October 2026) offers Watch Events, Create a Row, Upsert a Record, Delete Rows, Search Rows, Get Rows Count, Upload a File, bucket modules, and a generic Make an API Call. Every row module works on one record per operation. Make an API Call sends any PostgREST request, but you assemble the body and query string by hand and get the raw response back.

How do I upsert an array of orders into Supabase from one Make module?

Put Make's Transform to JSON module in front of the code step so the array arrives as a JSON string, or parse defensively as the script does. The table has a unique constraint on order_id; on_conflict=order_id tells PostgREST which column decides whether a row is new or updated.

Input

{
  "url": "https://abcdefghijklmnop.supabase.co",
  "key": "sb_secret_REPLACE_WITH_MAKE_VARIABLE",
  "orders": [
    { "order_id": "SO-10421", "customer_email": "[email protected]",
      "total": 189.5, "status": "paid" },
    { "order_id": "SO-10422", "customer_email": "[email protected]",
      "total": 42, "status": "pending" },
    { "order_id": "SO-10398", "customer_email": "[email protected]",
      "total": 310, "status": "refunded" }
  ]
}

JavaScript Code (Return Type: Object)

const data = typeof input === "string" ? JSON.parse(input) : input;
const { url, key, orders } = data;

if (!Array.isArray(orders) || orders.length === 0) {
  return { count: 0, ids: [], rows: [] };
}

const res = await fetch(`${url}/rest/v1/orders?on_conflict=order_id`, {
  method: "POST",
  headers: {
    apikey: key,
    Authorization: `Bearer ${key}`,
    "Content-Type": "application/json",
    Prefer: "resolution=merge-duplicates,return=representation",
  },
  body: JSON.stringify(orders),
});

if (!res.ok) {
  throw new Error(`Supabase ${res.status}: ${await res.text()}`);
}

const rows = await res.json();
return { count: rows.length, ids: rows.map((r) => r.order_id), rows };

Output

{
  "count": 3,
  "ids": ["SO-10421", "SO-10422", "SO-10398"],
  "rows": [
    { "id": 88, "order_id": "SO-10421", "customer_email": "[email protected]",
      "total": 189.5, "status": "paid", "updated_at": "2026-11-12T09:14:03.512Z" },
    { "id": 89, "order_id": "SO-10422", "customer_email": "[email protected]",
      "total": 42, "status": "pending", "updated_at": "2026-11-12T09:14:03.512Z" },
    { "id": 71, "order_id": "SO-10398", "customer_email": "[email protected]",
      "total": 310, "status": "refunded", "updated_at": "2026-11-12T09:14:03.512Z" }
  ]
}

resolution=merge-duplicates updates existing rows; swap in resolution=ignore-duplicates to keep existing rows untouched. return=representation makes Supabase send the written rows back, so the next Make module can map count, ids or any column directly. The median CustomJS inline script finishes in 121 ms; this one adds a single round trip to Supabase, so expect a few hundred milliseconds, billed as one Make credit and one CustomJS request.

How do I call a Postgres function or filter rows with PostgREST operators?

Both use the same headers as the upsert. A function call is a POST to /rest/v1/rpc/<function> with the named parameters as a JSON object (PostgREST docs, checked October 2026). Filters are query-string pairs of column=operator.value; ilike uses * as the wildcard.

const headers = {
  apikey: key,
  Authorization: `Bearer ${key}`,
  "Content-Type": "application/json",
};

// 1. Call a Postgres function: select close_month(2026, 10)
const rpc = await fetch(`${url}/rest/v1/rpc/close_month`, {
  method: "POST",
  headers,
  body: JSON.stringify({ year: 2026, month: 10 }),
});
const summary = await rpc.json();

// 2. Filter: paid orders for a list of IDs, email containing "northwind"
const ids = ["SO-10421", "SO-10398"].map((id) => `"${id}"`).join(",");
const query = new URLSearchParams({
  select: "order_id,total",
  status: "eq.paid",
  order_id: `in.(${ids})`,
  customer_email: "ilike.*northwind*",
});
const list = await fetch(`${url}/rest/v1/orders?${query}`, { headers });
const paid = await list.json();

return { summary, paid };

Building the in.() list from an array of IDs is the part Make's mapping panel makes awkward; in code it is one join(","). If the IDs are text, wrap each in double quotes inside the parentheses so commas in values do not break the list.

Which Supabase key should the code step use?

Supabase has two key classes (docs checked October 2026): publishable keys (sb_publishable_…, formerly the anon JWT) that respect Row Level Security, and secret keys (sb_secret_…, formerly service_role) that bypass every RLS policy. Supabase asks that the new keys be sent on the apikey header; legacy JWT keys also accept the Bearer header, which is why the example sends both.

• Use the publishable key plus an RLS policy that allows the exact insert or update the scenario performs. A leaked publishable key can then do no more than the policy permits.
• If the write needs the secret key, store it in a Make scenario variable or data store and map it into the Input field. Never paste it into the code.
• Turn on Keep data confidential in the scenario settings so Make does not retain bundle payloads (including the key) in execution history. Do not console.log the input.
• Rotate the key in the Supabase dashboard if it ever appears in a log or a shared blueprint.

When Make's built-in is enough

Do not add a code step when:

• The scenario writes one row per run. Create a Row or Upsert a Record costs one operation either way and gives you the column mapping UI.
• You need a trigger. Watch Events is the only way to start a scenario from Supabase changes; a code step cannot replace it.
• You read with simple equality filters. Search Rows covers eq-style lookups without any code.
• You upload files to Storage. The Upload a File module handles the multipart request for you.
• You need one custom request and no post-processing. Make an API Call sends it; the code step only pays off when you build the body from data or reshape the response.

The CustomJS free tier covers 600 requests per month (20 per day) with no credit card; paid plans start at $9 per month for 100 requests per day (pricing). If several scenarios write to the same tables, move the script into a stored function with table, conflictColumn and rows as parameters. For calling any other REST API from Make, see custom API calls in Make.

Get a free CustomJS API key