Supabase Setup

Sign in to Supabase, create a new project, and choose a region close to your Vercel deployment. Note your project URL and anon key from the API settings page.

LifeOS uses 9 versioned SQL migrations. Run them in order in the Supabase SQL Editor:

001_initial_schema
002_google_calendar_sync
003_meeting_link
004_google_oauth_tokens
005_timeline_google_event
006_apple_reminder_id
007_rls_lockdown
008_recurring_todos
009_pomodoro_sessions

Each migration file is located in the `supabase/migrations/` directory of the repository. Copy the SQL content and execute it in the SQL Editor in order.

Migration 007_rls_lockdown enables RLS on all tables and creates policies that restrict access to the authenticated user. Verify RLS is enabled on every table in the Supabase dashboard under Authentication > Policies. The google_oauth_tokens table should have zero policies for the anon key.

From the Supabase project settings, copy NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_ANON_KEY, and SUPABASE_SERVICE_ROLE_KEY. The service role key is used server-side for calendar sync operations that bypass RLS.