Mobile app backend: ready to use from day one

1<?php2// Project ID and key: in the dashboard under "Overview"3$apiUrl    = 'https://alex.ctahosting.com'; // the same address for every project4$projectId = getenv('PROJECT_ID');    // e.g. prj_8fK2mQ… (sent as the x-project header)5$anonKey   = getenv('ANON_KEY');    // public key (not a secret)6 7// Shared request helper: sends JSON, returns JSON8function request(string $method, string $url, array $body = [], ?string $token = null): array9{10    global $anonKey, $projectId;11    $ch = curl_init($url);12    curl_setopt_array($ch, [13        CURLOPT_CUSTOMREQUEST  => $method,14        CURLOPT_RETURNTRANSFER => true,15        CURLOPT_HTTPHEADER     => array_filter([16            'apikey: ' . $anonKey,17            'x-project: ' . $projectId,18            'Content-Type: application/json',19            $token ? 'Authorization: Bearer ' . $token : null,20        ]),21        CURLOPT_POSTFIELDS     => $body ? json_encode($body) : null,22    ]);23    $response = json_decode(curl_exec($ch), true);24    curl_close($ch);25    return $response ?? [];26}27 28// 1) Sign up: the verification email is sent automatically29request('POST', "$apiUrl/auth/v1/signup", [30    'email'    => 'jane@example.com',31    'password' => 'Strong-Pass-123',32]);33 34// 2) Log in: returns an access token (access_token)35$session = request('POST', "$apiUrl/auth/v1/token?grant_type=password", [36    'email'    => 'jane@example.com',37    'password' => 'Strong-Pass-123',38]);39$token = $session['access_token']; // send as Bearer on later requests

1<?php2// Uses request() and $token from auth.php3require __DIR__ . '/auth.php';4 5// 1) Read: the latest 20 products in Istanbul, newest first6//    select   → columns to return7//    city=eq. → equals filter (gt, lt, like, in … also work)8//    order    → sorting, limit → page size9$products = request('GET', "$apiUrl/rest/v1/products"10    . '?select=id,name,price,city'11    . '&city=eq.Istanbul'12    . '&order=created_at.desc&limit=20', [], $token);13 14foreach ($products as $u) {15    echo $u['name'] . ' — ' . $u['price'] . " USD\n";16}17 18// 2) Write: POST to the same endpoint; inserted if RLS allows it19request('POST', "$apiUrl/rest/v1/products", [20    'name'  => 'Coffee mug',21    'price' => 12,22    'city'  => 'Istanbul',23], $token);

1-- ------------------------------------------------------------2-- Row-level security (RLS): the policy is written once, in the database.3-- Every API request is filtered by it, whatever language it comes from.4-- ------------------------------------------------------------5 6-- 1) Enable RLS on the orders table (once enabled, nobody sees anything by default)7alter table orders enable row level security;8 9-- 2) Read: users only see their own orders10--    auth.uid() = the ID of the user making the request (from the token)11create policy "own orders" on orders12  for select using (user_id = auth.uid());13 14-- 3) Insert: users can only add orders for themselves15create policy "insert own" on orders16  for insert with check (user_id = auth.uid());17 18-- 4) Update: only their own order, and only while it's 'pending'19create policy "update while pending" on orders20  for update using (user_id = auth.uid() and status = 'pending');

1<?php2// PHP usually doesn't listen, it BROADCASTS: when an order status changes,3// every app listening on that channel gets a message instantly.4require __DIR__ . '/auth.php';5 6// Broadcasts use the service_role key: SECRET, keep it on the server only (never in the app)7$serviceKey = getenv('SERVICE_ROLE_KEY');8$orderId = 1042;9 10// Channel: "order-1042" → everyone who has this order's screen open11request('POST', "$apiUrl/realtime/v1/api/broadcast", [12    'messages' => [[13        'topic'   => "order-$orderId",14        'event'   => 'status',15        'payload' => ['status' => 'shipped', 'carrier' => 'DHL'],16    ]],17], $serviceKey);18 19// Note: writing to the table works too. Every INSERT reaches apps20// listening on the messages table on its own (see the other languages).

1<?php2require __DIR__ . '/auth.php';3 4// File from the form (input name="avatar")5$file = $_FILES['avatar']['tmp_name'];6$userId = 'u_8f2c';7 8// Path: <bucket>/<file name>  → avatars/u_8f2c.jpg9$ch = curl_init("$apiUrl/storage/v1/object/avatars/$userId.jpg");10curl_setopt_array($ch, [11    CURLOPT_POST           => true,12    CURLOPT_RETURNTRANSFER => true,13    CURLOPT_HTTPHEADER     => [14        'apikey: ' . $anonKey,15        'x-project: ' . $projectId,16        'Authorization: Bearer ' . $token,17        'Content-Type: image/jpeg',18        'x-upsert: true',            // overwrite if it exists19    ],20    CURLOPT_POSTFIELDS     => file_get_contents($file),21]);22curl_exec($ch);23curl_close($ch);24 25// Direct link in a public bucket:26echo "$apiUrl/storage/v1/object/public/$projectId/avatars/$userId.jpg";

1<?php2// The function runs in your project; PHP only calls it.3// (You write the function itself in the dashboard under "Edge Functions".)4require __DIR__ . '/auth.php';5 6// POST /functions/v1/<function name>7$result = request('POST', "$apiUrl/functions/v1/welcome", [8    'email' => 'jane@example.com',9    'name'  => 'Jane',10], $token);11 12// JSON returned by the function13if (!empty($result['ok'])) {14    echo 'Welcome email sent';15}