Guide Lovable and Bolt
How do I make an admin page only I can use? (Lovable and Bolt on Supabase)
Short answer
Hiding the admin button doesn't lock the admin page. If the "is admin" setting lives somewhere a user can edit (their own profile row, or the user details they can update, called user_metadata), any signed in user can switch it on and see everything.
The safer setup
Keep roles in a separate table that users can read but not change (a user_roles table with no insert or update rule for normal users), add yourself as admin by hand in the Supabase SQL editor, and make every admin table check that role in its access rules (RLS).
Supabase also supports roles stored where only your server can write them (app_metadata or a custom claim).
Test it as a normal user
Try to change your own role, then open the admin page and the admin data directly. Both should fail.
Where we can help
Free instant check: paste your URL at patchandship.com/check.html to scan your homepage's JavaScript for secret keys and security headers (no signup, nothing stored). Paid, fixed price per app: Database Check, $49; Security Fix, $149 (every critical issue on our checklist fixed within 48 hours of working access); Fix & Deploy, $249. Otherwise a full refund if you ask within 14 days of purchase (Refund Policy). AI agents run the checks and a human engineer approves every change. Not a penetration test or a security guarantee.
FAQ
Is hiding the admin link enough?
No. The page and its data can still be reached directly. The database rules have to check the role.
Can I store the admin flag in user_metadata?
No. Signed in users can update their own user_metadata. Use a roles table they can't change, or app_metadata, which only your server can write.
How do I make myself admin?
Add your user id to the roles table by hand in the Supabase SQL editor.