Turns out the issue was I was using Supabase service key but actually needed to use ANON KEY if we are going to enable RLS.