Every site and game shares the same Supabase project, so the same wallet and balance follow a member everywhere. Two things plug into that shared wallet: payments (a user spending coin on your site) and rewards (your site paying coin out, e.g. for a game win).
A user pays by calling the same transfer_coins function used on the
Send page, sending to a username that represents your site's own house account.
Create one wallet per site (just another user account) to act as the till.
const { error } = await supabase.rpc('transfer_coins', {
receiver_username: 'my-game-till',
amount: 25,
note: 'Unlocked chapter 2'
});
Rewards should never be granted from a player's own browser — that would let
anyone hand themselves free coin. Grant them from your game's server instead,
using a Supabase Edge Function that holds the project's service role key and
calls grant_coins after it has verified the win server-side.
// inside a Supabase Edge Function, never in client code
await supabaseAdmin.rpc('grant_coins', {
target_user: winnerId,
amount: 50,
reward_type: 'game_reward',
note: 'Level 4 cleared',
site: 'my-game'
});Point any site or game at the same Supabase project so wallets stay unified:
SUPABASE_URL = "https://vynoogxcpbxcydimuqht.supabase.co"
SUPABASE_ANON_KEY = "sb_publishable_GVuCLX0MgJ2pFPkZ0F3dDA_xINZD3Fg"
The anon key is safe in client code — it can only read data and call
transfer_coins, both governed by row-level security. Reward payouts
require the project's service role key, which must stay on a server and never
ship inside a game client or webpage.