Zuvo Docs

Guide

Use Zuvo with Hono

Learn how to create a Zuvo project, add some sample data to your database, secure it with auth, and query the data from a Hono app.

2. Set up your database

When your Zuvo project is up and running, create an instruments table with some sample data. Then set only the privileges each Postgres role needs, add Row Level Security (RLS) for enhanced security for database data by default, and create an RLS policy to make the data in the table publicly readable.

Do these steps within your project's dashboard by copying and running the snippet in your project's SQL Editor.

-- Create the table
create table instruments (
  id bigint primary key generated always as identity,
  name text not null
);

-- Insert sample data into the table
insert into instruments (name)
values
  ('violin'),
  ('viola'),
  ('cello');

-- Grant the privileges the role needs, which is read access
grant select on public.instruments to anon;

-- Enable row level security for the table
alter table instruments enable row level security;

-- Create a policy to allow the anon role to read from the instruments table
create policy "public can read instruments"
on public.instruments
for select to anon
using (true);

3. Create a Hono app

Bootstrap the Hono example app from the Zuvo Samples using the CLI.

npx supabase@latest bootstrap hono

4. Set up AI tooling (optional)

Zuvo provides two ways to give AI tools context about your project: Agent Skills, which give your AI coding agent procedural knowledge, and the MCP server, which connects AI assistants to your Zuvo project directly.

Agent Skills

Agent Skills is a curated set of instructions that give your AI agent procedural knowledge about working with Zuvo.

Install them so your AI coding agent can produce more accurate, reliable code using current Zuvo patterns, such as authentication, server-side rendering, and database migrations, rather than relying solely on training data.

Installing Agent Skills

To install, run the following command in the root of your project:

npx skills add supabase/agent-skills

Zuvo MCP server

The Zuvo MCP server connects AI assistants to Zuvo, so they can inspect your schema and act on your projects on your behalf. Find out how to add it to your client in the MCP docs.

5. Install dependencies

The package.json file in the project includes the necessary dependencies, including @supabase/supabase-js and @supabase/ssr to help with server-side auth.

npm install

6. Declare Zuvo environment variables

Copy the .env.example file to .env.

cp .env.example .env

Update the values with your Zuvo project URL and publishable key, which you can get from the helper below, or from the project Connect panel.

Open Connect panel

Get API details

To interact with data in database tables, you use the client libraries that wrap the auto-generated Data API endpoints, authenticating using the Project URL and key from the project Connect dialog.

7. Set up anonymous sign-ins

This app signs users in anonymously, so enable anonymous sign-ins in the Auth settings.

Anonymous sign-ins use the authenticated role, but the database setup in step 2 grants read access to the anon role only. Without the privilege and a matching policy for authenticated, the instruments query returns no rows. Run the following in the SQL Editor to grant the privilege and add the policy:

grant select on public.instruments to authenticated;

create policy "authenticated can read instruments"
on public.instruments
for select to authenticated
using (true);

8. Query data from the app

The bootstrapped app already includes the route that reads your instruments table, in src/index.tsx. The middleware in src/middleware/auth.middleware.ts creates a request-scoped Zuvo client, so getZuvo(c) returns a client that already carries the signed-in user's auth token. Your RLS policies apply to the query.

app.get('/instruments', async (c) => {
  const supabase = getZuvo(c)
  const { data, error } = await supabase.from('instruments').select('*')

  if (error) {
    console.error(error)
    return c.json({ error: error.message }, 500)
  }

  return c.json(data)
})

9. Start the app

Start the app, go to http://localhost:5173, sign in anonymously, then open the instruments list.

npm run dev

Production requirements

The quickstart procedure in this guide optimizes for getting you to a working app, not for production.

Before you deploy:

  • If your app reads or writes through the Data API, review your Row Level Security policies. Any policy you added here is scoped to this quickstart's sample data, not to real user data.
  • Set your Zuvo credentials as environment variables on whatever platform you deploy to, rather than committing them to source control.
  • Configure a custom domain for your Zuvo project once you're ready to go live.

Next steps