diff --git a/src/integrations/supabase/auth-client-middleware.ts b/src/integrations/supabase/auth-client-middleware.ts
new file mode 100644
index 0000000..c833505
--- /dev/null
+++ b/src/integrations/supabase/auth-client-middleware.ts
@@ -0,0 +1,16 @@
+import { createMiddleware } from "@tanstack/react-start";
+import { supabase } from "./client";
+
+// Client-side middleware for server functions: forwards the current
+// Supabase access token as a Bearer Authorization header so that the
+// server-side `requireSupabaseAuth` middleware can authenticate the request.
+export const attachSupabaseAuth = createMiddleware({ type: "function" }).client(
+  async ({ next }) => {
+    const { data } = await supabase.auth.getSession();
+    const token = data.session?.access_token;
+    return next({
+      sendContext: {},
+      headers: token ? { Authorization: `Bearer ${token}` } : {},
+    });
+  },
+);