Upstream docs

This page is the canonical jumping-off point for verifying V1 configuration against current upstream behavior. The docs in this repo describe our contract; upstream defaults move and the linked pages are the source of truth for current platform behavior.

Rule: before changing any Supabase or Cloudflare configuration, re-read the linked upstream page. If upstream guidance contradicts a page in this repo, fix the repo page in the same change.

Supabase

Authoritative docs at supabase.com/docs.

Topic	V1 surface	Upstream link
Auth overview	Auth & sessions	https://supabase.com/docs/guides/auth
PKCE flow	Auth & sessions	https://supabase.com/docs/guides/auth/sessions/pkce-flow
supabase-js client init	Auth & sessions	https://supabase.com/docs/reference/javascript/initializing
MFA (TOTP)	Auth & sessions	https://supabase.com/docs/guides/auth/auth-mfa
Site URL & redirect allowlist	Auth & sessions	https://supabase.com/docs/guides/auth/redirect-urls
Row Level Security	Supabase SQL plan	https://supabase.com/docs/guides/database/postgres/row-level-security
RLS performance ((select auth.uid()))	Supabase SQL plan	https://supabase.com/docs/guides/database/postgres/row-level-security#call-functions-with-select
Storage access control	Media & delivery	https://supabase.com/docs/guides/storage/security/access-control
Storage signed URLs	Media & delivery	https://supabase.com/docs/guides/storage/serving/downloads#signed-urls
Realtime authorization	Realtime operations	https://supabase.com/docs/guides/realtime/authorization
Realtime Postgres changes	Realtime operations	https://supabase.com/docs/guides/realtime/postgres-changes
Edge Functions	Platform architecture	https://supabase.com/docs/guides/functions
Edge Function secrets	Secrets & environments	https://supabase.com/docs/guides/functions/secrets
Local dev & migrations (CLI)	Secrets & environments	https://supabase.com/docs/guides/local-development
Database migrations	Secrets & environments	https://supabase.com/docs/guides/deployment/database-migrations
Point-in-time recovery	Platform architecture	https://supabase.com/docs/guides/platform/backups

Cloudflare

Authoritative docs at developers.cloudflare.com.

Topic	V1 surface	Upstream link
Cloudflare Images overview	Media & delivery	https://developers.cloudflare.com/images/
Serve private images (signed URLs)	Media & delivery	https://developers.cloudflare.com/images/manage-images/serve-images/serve-private-images/
Image variants	Media & delivery	https://developers.cloudflare.com/images/transform-images/transform-via-url/
Stream overview	Media & delivery	https://developers.cloudflare.com/stream/
Direct creator uploads	Media ingest	https://developers.cloudflare.com/stream/uploading-videos/direct-creator-uploads/
Stream webhooks	Realtime operations	https://developers.cloudflare.com/stream/manage-video-library/using-webhooks/
Stream signed playback	Media & delivery	https://developers.cloudflare.com/stream/viewing-videos/securing-your-stream/
Pages build configuration	Setup & operations (README)	https://developers.cloudflare.com/pages/configuration/build-configuration/
Pages headers (_headers)	Secrets & environments	https://developers.cloudflare.com/pages/configuration/headers/
Pages redirects (_redirects)	File & route conventions	https://developers.cloudflare.com/pages/configuration/redirects/
Pages environment variables & secrets	Secrets & environments	https://developers.cloudflare.com/pages/configuration/build-configuration/#environment-variables
Custom domains on Pages	Secrets & environments	https://developers.cloudflare.com/pages/configuration/custom-domains/
Turnstile (bot protection on login)	Auth & sessions	https://developers.cloudflare.com/turnstile/

End-to-end wiring

When you’re ready to actually connect Supabase + Cloudflare, walk Wiring Supabase & Cloudflare top to bottom. That page is the single ordered checklist; every step there cites the relevant upstream link from the tables above.

How to use this page

• Agents: when a config field name in this repo and the linked upstream page disagree, the upstream page wins. Open an issue against the repo page and link the upstream URL you read.
• Humans: during a V1 audit, walk this table top-to-bottom and confirm each cross-linked V1 page still matches the upstream contract. Bump last_synced_with on each verified page.