Manage session/authentication with RLS

Started to use supabase and focus a bit on auth/session ...

I have a simple Node app with signInWithPassword and a endpoint getClients.

My table has a policy for SELECT

alter policy "Enable read access for all users"

on "public"."clients"

to authenticated

using (

true

);

Node, signInWithPassword:

export const loginRepository = async (email: string, password: string) => {
  const { data, error } = await supabase.auth.signInWithPassword({
    email,
    password,
  });
  if (error) throw new Error(error.message);
  return data;
};

getClients

export const getClientsRepository = async () => {
  const { data, error } = await supabase.from("clients").select();

  if (error) throw new Error(error.message);

  return data;
};

Clients table is just a table with id, name, surname, email and phone number. This is for test purpose.

I noticed when calling signInWithPassword from postman, I can then retrieve the data from everywhere (brower, postman ...)

I don't understand the behavior behind the scene ? Why supabase know me ? How this is managed ?

Following the doc, anon or publishable key authenticate the app, not the user.

I use the publishable key but same behavior with anon key.

If someone can explain or just give me the doc about that, it will be really apreciated.