Supabase Custom Claims Not Updating? Fix and RBAC Guide
Supabase custom claims not updating is usually a JWT refresh problem, not a bug. Fix the refresh issue, then build complete role-based access control with the custom access token hook, RLS policies, and Flutter role gating.
Most Supabase RBAC tutorials hand you the same advice: stick the user's role in user_metadata and check it in your app. That advice is a security hole you can drive a truck through — user_metadata is editable by the user, so anyone can crown themselves admin with a single API call. Do it properly with custom claims and you hit trap number two: your Supabase custom claims not updating after a role change, with no error and no explanation. The claims are fine; the mental model is broken. This guide builds RBAC the way it survives production: roles in app_metadata , injected into every JWT by the custom access token hook, enforced by RLS policies, and reflected in your Flutter UI. *Last updated: 2026-10-10* What you'll build A role system where only your server can assign roles — no self-promotion possible A custom access token hook that injects the role into every JWT automatically RLS policies that read the role from auth.jwt() with zero extra table lookups A Flutter UI that gates admin screens by role and reacts when roles change The exact fix for claims that "don't update" after a role change If you're new to the stack, start with the complete Flutter and Supabase setup guide — this article assumes a working project with Auth enabled. The lie every tutorial tells: roles in user_metadata Supabase gives every user two metadata buckets, and the difference between them is the entire security model: app_metadata — writable only with the service role key (your server, the dashboard, Auth Hooks). The user cannot touch it. user_metadata — writable by the user themselves through the normal client API. Watch how fast the "roles in user_metadata" approach collapses: // Any logged-in user can run this from their own app copy. // Do NOT store authorization data…