# How to delete a file from Supabase storage? **URL:** \ **Category:** Ask us anything\ **Created:** [June 15, 2023, 11:05pm UTC](https://community.weweb.io/t/how-to-delete-a-file-from-supabase-storage/3075 "2023-06-15T23:05:34Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![visualdevs](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/visualdevs/32/6248_2.png) [@visualdevs](https://community.weweb.io/u/visualdevs)\ **Post date:** [June 15, 2023, 11:05pm UTC](https://community.weweb.io/t/how-to-delete-a-file-from-supabase-storage/3075/1 "2023-06-15T23:05:34Z")
I’m trying to delete the file from the storage bucket. What’s the best way to accomplish this? ---
**Author:** ![jaredgibb](https://avatars.discourse-cdn.com/v4/letter/j/ecd19e/32.png) [@jaredgibb](https://community.weweb.io/u/jaredgibb)\ **Post date:** [June 16, 2023, 12:16am UTC](https://community.weweb.io/t/how-to-delete-a-file-from-supabase-storage/3075/2 "2023-06-16T00:16:33Z")
I think you may need to set up an edge function to achieve this. Maybe not if you can make the js calls client side securely ---
**Author:** ![D-EFFCON](https://avatars.discourse-cdn.com/v4/letter/d/aeb1de/32.png) [@D-EFFCON](https://community.weweb.io/u/D-EFFCON)\ **Post date:** [June 16, 2023, 3:21am UTC](https://community.weweb.io/t/how-to-delete-a-file-from-supabase-storage/3075/3 "2023-06-16T03:21:10Z")
I’ve been getting as much answers as I can get from the Supabase AI assistant. This is what it said to try ```auto const response = await fetch('https://your-project-url.supabase.co/storage/v1/object/bucket-name/file-path', { method: 'DELETE', headers: { 'Authorization': 'Bearer your-supabase-api-key' } }) ``` ---
**Author:** ![Broberto](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/broberto/32/5918_2.png) [@Broberto](https://community.weweb.io/u/Broberto)\ **Post date:** [June 16, 2023, 5:57am UTC](https://community.weweb.io/t/how-to-delete-a-file-from-supabase-storage/3075/4 "2023-06-16T05:57:35Z")
> Blockquote I’ve been getting as much answers as I can get from the Supabase AI assistant. This is what it said to try ```auto const response = await fetch('https://your-project-url.supabase.co/storage/v1/object/bucket-name/file-path', { method: 'DELETE', headers: { 'Authorization': 'Bearer your-supabase-api-key' } }) ``` Yeah but you can’t do this in WeWeb, I mean you theorethically can, but it is very insecure. Unless you have any other protections in place. ---
**Author:** ![D-EFFCON](https://avatars.discourse-cdn.com/v4/letter/d/aeb1de/32.png) [@D-EFFCON](https://community.weweb.io/u/D-EFFCON)\ **Post date:** [June 16, 2023, 6:30am UTC](https://community.weweb.io/t/how-to-delete-a-file-from-supabase-storage/3075/5 "2023-06-16T06:30:11Z")
Agreed, but I think in this case you can use the native HTTP request in WeWeb which leds you hide the credentials. I haven’t been able to figure out how to do it for storage uploads (still resorting to custom javascript which exposes the access token) But this is why we need all the votes we can get here on the Supabase storage FR - [https://feedback.weweb.io/](https://feedback.weweb.io/) ---
**Author:** ![dorilama](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/dorilama/32/10403_2.png) [@dorilama](https://community.weweb.io/u/dorilama)\ **Post date:** [June 16, 2023, 6:36am UTC](https://community.weweb.io/t/how-to-delete-a-file-from-supabase-storage/3075/6 "2023-06-16T06:36:45Z")
> [@D-EFFCON](#): > > HTTP request in WeWeb which leds you hide the credentials http requests from weweb are like any other client side request: everything is exposed. If you don’t want to expose the details of the request you need to make it from your backend. ---
**Author:** ![D-EFFCON](https://avatars.discourse-cdn.com/v4/letter/d/aeb1de/32.png) [@D-EFFCON](https://community.weweb.io/u/D-EFFCON)\ **Post date:** [June 16, 2023, 6:50am UTC](https://community.weweb.io/t/how-to-delete-a-file-from-supabase-storage/3075/7 "2023-06-16T06:50:58Z")
I’m new, but pretty sure these features would hide it? ![image](https://us1.discourse-cdn.com/flex016/uploads/weweb/original/2X/f/f6509a777946e3435c32c2bddacd17688e71aba8.png) ---
**Author:** ![Broberto](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/broberto/32/5918_2.png) [@Broberto](https://community.weweb.io/u/Broberto)\ **Post date:** [June 16, 2023, 7:17am UTC](https://community.weweb.io/t/how-to-delete-a-file-from-supabase-storage/3075/8 "2023-06-16T07:17:46Z")
This could work, but I don’t know how it works in the background) An idea would be to bind the file to user id so only if the req.user.id === file.user.id → Remove file ---
**Author:** ![dorilama](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/dorilama/32/10403_2.png) [@dorilama](https://community.weweb.io/u/dorilama)\ **Post date:** [June 16, 2023, 8:31am UTC](https://community.weweb.io/t/how-to-delete-a-file-from-supabase-storage/3075/9 "2023-06-16T08:31:35Z")
Every http request made from weweb with the request action is a client side request and it is exposed to the browser. “make request through a server” is just to prevent CORS errors for those endpoint that don’t handle them, and usually if they don’t it’s probably because you should make the request on the backend. “send credentials” is to include third party cookies in the request. ---
**Author:** ![visualdevs](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/visualdevs/32/6248_2.png) [@visualdevs](https://community.weweb.io/u/visualdevs)\ **Post date:** [June 16, 2023, 11:14pm UTC](https://community.weweb.io/t/how-to-delete-a-file-from-supabase-storage/3075/10 "2023-06-16T23:14:42Z")
If we would want to make it through http request, how should be? I don’t find much information about how to set up this call ---
**Author:** ![D-EFFCON](https://avatars.discourse-cdn.com/v4/letter/d/aeb1de/32.png) [@D-EFFCON](https://community.weweb.io/u/D-EFFCON)\ **Post date:** [June 17, 2023, 12:29am UTC](https://community.weweb.io/t/how-to-delete-a-file-from-supabase-storage/3075/11 "2023-06-17T00:29:41Z")
Not trying to be a negative Nancy here, but trying to get absolute certainty here as it does influence a substantial amount of workflows I plan to setup depending on this. When I do the “make a request through a server” with both a field value and header value and look at Network in my Chrome Dev tools, I can see the request going to a weweb server, but it doesn’t contain the field value or header value. I’ve checked the endpoint and those values have come through. By that logic I can’t see how it’s exposed on the front end? Unless it’s stored somewhere else that is accessible? Any pointers where I should look to see how it’s exposed? @Joyce would be good if a WeWeb team member might shed some light on this. I couldn’t find much info on this beyond the tooltip provided. The Send User credentials tooltip is also blank, so for us non-technical users, it doesn’t give much clarity on what it can or cannot do or when it should be used. ---
**Author:** ![dorilama](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/dorilama/32/10403_2.png) [@dorilama](https://community.weweb.io/u/dorilama)\ **Post date:** [June 17, 2023, 7:30am UTC](https://community.weweb.io/t/how-to-delete-a-file-from-supabase-storage/3075/12 "2023-06-17T07:30:39Z")
If a request has secrets that you don’t want to expose make it from your backend. from weweb make a request to your backend endpoint that can validate the request coming from weweb, then make the request you want.