Locking a Dashboard to a Single Admin Account with Supabase

Most of my projects need exactly one admin account — me. Here's the setup I use across projects like this portfolio. First, disable public sign-up entirely. Instead of building a registration flow, create the one user directly in the Supabase dashboard under Authentication → Users, with "Auto Confirm User" enabled so no email verification step is needed. Second, protect routes with middleware rather than component-level checks. Using @supabase/ssr, a Next.js middleware function checks for a valid session on every request to /admin/*, redirecting to the login page if none exists. This runs before any page code executes, so there's no flash of protected content before the redirect. Third, and most important: row-level security policies do the real enforcement. Even if someone bypassed the middleware, the database itself only allows authenticated users to insert, update, or delete rows — anonymous requests are read-only. The middleware is a good user experience; RLS is the actual security boundary. This pattern scales down perfectly for solo-admin projects — no need for role tables or permission systems when there's only ever going to be one user with write access.