Supabase: check your site when content or code changes

What the integration does

• Content-driven sites often read pages straight from Supabase tables, so a single row can change what visitors see. The integration starts a MyKavo check when that happens, instead of waiting for the next scheduled scan.
• The check compares every monitored page with its approved baseline: status codes, titles, meta descriptions, canonicals, robots tags, visible content, screenshots, scripts and the buttons and forms you marked as conversion elements.
• The verdict goes to your alert channels: "Deploy verified" when nothing important changed, or the list of changes with before-and-after evidence.

1. 1

   Copy your deploy hook URL

   In MyKavo open the website, go to Deploy checks and press Enable deploy checks. Copy the deploy hook URL. It is a secret: anyone with it can start checks for this website.

2. 2

   Create a Database Webhook in Supabase

   In the Supabase dashboard open Database Webhooks and create a new webhook. Choose the table that holds your published content and the events that matter, usually Insert and Update.

3. 3

   Point it at MyKavo

   Set the type to HTTP Request, the method to POST and the URL to your deploy hook URL. Keep the Content-Type header as application/json. MyKavo ignores the row data Supabase sends.

4. 4

   Publish something

   Publish or update a row. The website's scan history in MyKavo shows a new deploy check within seconds, and the verdict arrives when it finishes.

Only on publish: a trigger with pg_net

A Database Webhook fires on every matching event. To check only when a post goes live, call the hook from a trigger with the pg_net extension, and keep the URL in Supabase Vault rather than in your SQL. The example assumes a posts table with a boolean published column; adjust the names to your schema.

-- Once: enable pg_net and store the hook URL as a Vault secret.
create extension if not exists pg_net;
select vault.create_secret('https://mykavo.app/api/hooks/deploy/YOUR_TOKEN', 'mykavo_deploy_hook');

create or replace function public.mykavo_check_on_publish()
returns trigger
language plpgsql
security definer
set search_path = ''
as $$
declare
  hook_url text;
begin
  select decrypted_secret into hook_url
  from vault.decrypted_secrets
  where name = 'mykavo_deploy_hook';

  if hook_url is not null then
    perform net.http_post(
      url := hook_url,
      body := jsonb_build_object('note', 'Content published in Supabase'),
      headers := '{"Content-Type": "application/json"}'::jsonb
    );
  end if;
  return new;
end;
$$;

create trigger mykavo_check_on_publish
after insert or update of published on public.posts
for each row
when (new.published is true)
execute function public.mykavo_check_on_publish();

The optional note (up to 140 characters) appears in the scan history and in the verdict, so you can tell which change started the check. pg_net sends the request asynchronously, so publishing is never slowed down or blocked by MyKavo.

After you deploy code

Front ends on Supabase are usually deployed from CI or a host such as Vercel or Netlify. Add one step after the deploy that sends a POST to the same deploy hook URL, for example with curl and a JSON body like {"note":"v1.4.0"}. The same check runs, labelled with your release.

What to monitor on a Supabase app

• Public pages rendered from your tables: the home page, listings and detail pages that bring in search traffic.
• Sign-up and log-in pages, with the form and its submit button added as conversion elements, so a broken auth screen is a critical alert.
• Pricing and checkout pages, and any page that loads analytics or payment scripts.

MyKavo loads pages the way a signed-out visitor does. It does not sign in, so it cannot check pages behind authentication, and it never connects to your database: the only link is the webhook you create.

Security

• The deploy hook URL works for one website and can only start a check. It cannot read data or change settings.
• If the URL leaks, regenerate it under Deploy checks. The old URL stops working immediately; update the Vault secret or webhook with the new one.
• Repeated calls are rate limited, and a call that arrives while a check is already running does not start a second one.

Frequently asked questions

More in plans, security and data

• Plans and limits
• The WordPress plugin: install, connect and Safe Updates
• How MyKavo crawls, and how it protects your network
• Your data, and what deletion actually deletes
• All documentation