# Add a backend to SvelteKit with one command

> Give a SvelteKit app Postgres, auth, storage and realtime with `npx scribase init`: it writes VITE_ variables and puts the client in src/lib as $lib/supabase.

Source: https://scribase.com/frameworks/sveltekit

SvelteKit runs on Vite, so init uses the Vite conventions, and they fit: VITE_ variables work in both server and browser code, and src/lib/supabase.ts is exactly where $lib points.

## `npx scribase init` output

```
$ npx scribase init
Backend ready: https://acme-my-app-production-c2b0ea0a.scribase.com
  framework   vite
  project     acme/my-app (production)
  env file    .env.local (VITE_SUPABASE_URL, VITE_SUPABASE_ANON_KEY, SCRIBASE_API_URL, SCRIBASE_ORG, SCRIBASE_PROJECT, SCRIBASE_ENV)
  client      src/lib/supabase.ts

Next:
  - import { supabase } from './src/lib/supabase' and query: await supabase.from('todos').select()
  - create tables with SQL migrations (supabase/migrations/*.sql) and `scribase db push`, or the MCP server
```

## Environment file: .env.local

- VITE_SUPABASE_URL
- VITE_SUPABASE_ANON_KEY

## Run init

Run it in the project root. If you are not signed in, it prints a link and a code: approve it in the browser (sign up takes one click plus the $1 card check, credited back), and init carries on. No key is ever pasted. It creates the project, writes the env file, adds the env file to .gitignore, installs @supabase/supabase-js and writes a small client module.

```bash
npx scribase init
```

## What it wrote

Only public values are written. If you later need the service role key for a server-only task, add it yourself without the VITE_ prefix and read it through $env/static/private.

_.env.local_
```bash
# Scribase (written by `npx scribase init`)
VITE_SUPABASE_URL=https://acme-my-app-production-c2b0ea0a.scribase.com
VITE_SUPABASE_ANON_KEY=<publishable key>
SCRIBASE_API_URL=https://api.scribase.com
SCRIBASE_ORG=acme
SCRIBASE_PROJECT=my-app
SCRIBASE_ENV=production
```

## Create your first table

Open your project in the console, go to Editor, then SQL, and run this. Or ask your coding agent: with the Scribase MCP server connected it applies the same SQL as a migration. Row-level security is on, so the public key can only read what the policy allows.

```sql
create table public.todos (
  id bigint generated always as identity primary key,
  title text not null,
  done boolean not null default false,
  created_at timestamptz not null default now()
);

alter table public.todos enable row level security;

create policy "todos are readable" on public.todos
  for select to anon, authenticated using (true);

insert into public.todos (title) values ('Ship the backend'), ('Tell a friend');
```

## Load it in a page

A universal load function runs on the server for the first request and in the browser after that; the same client works in both.

_src/routes/+page.ts_
```ts
import { supabase } from '$lib/supabase';

export async function load() {
  const { data: todos, error } = await supabase.from('todos').select('id, title');
  if (error) throw error;
  return { todos };
}
```

## Render it

Restart the dev server once so Vite picks up .env.local.

_src/routes/+page.svelte_
```svelte
<script lang="ts">
  let { data } = $props();
</script>

<ul>
  {#each data.todos as todo (todo.id)}
    <li>{todo.title}</li>
  {/each}
</ul>
```

## Agent prompt

```
Add a Scribase backend to this SvelteKit app.
1. Run `npx scribase init --yes --json` in the project root. If it returns authorization_pending, show me the link and code, wait for me to approve, then run it again.
2. Create a `todos` table (id, title, done, created_at) with row-level security on and a policy that lets anyone read it; use the Scribase MCP server or a SQL migration, not the service-role key in app code.
3. Load the todos in src/routes/+page.ts with $lib/supabase and render them in +page.svelte.
4. Never print, log or commit the env file; it is already in .gitignore.
```

## FAQ

**Why VITE_ and not PUBLIC_?**

init uses the Vite conventions because SvelteKit is built on Vite, and import.meta.env.VITE_ values work everywhere in a SvelteKit app. Renaming them to PUBLIC_ and using $env/static/public works too.

**Does it work with Svelte 4?**

Yes. Only the page component syntax differs (export let data instead of $props).