Supabase and Stripe Customer ID with RLS

In a NextJS project I'm trying to add a stripe_customer_id to a Supabase user when they first sign up.

I can get this working fine when RLS isn't enabled but I need RLS to hide user data from anyone who isn't authenticated.

Can anyone help with what RLS policy I need to write to allow the create-stripe-customer api to update the customer_id column in Supabase?

Below is the create-stripe-customer (the file that works when RLS isn't enabled but not when RLS is enabled)

import initStripe from "stripe";
import { supabase } from "../../utils/supabaseClient";

const handler = async (req, res) => {

  if (req.query.API_ROUTE_SECRET !== process.env.API_ROUTE_SECRET) {
    return res.status(401).send('You are not authorized to call the API');
  }

  const stripe = initStripe(process.env.STRIPE_SECRET_KEY);

  const customer = await stripe.customers.create({
    email: req.body.record.email,
  });

  console.log("REQUEST-", req.body.record.id);
  console.log("CUST ID-", customer.id);

  await supabase
    .from("profiles")
    .update({
      stripe_customer: customer.id,
    })
    .eq("id", req.body.record.id);

  res.send({ message: `stripe customer creaded: ${customer.id}` });

  console.log("TESTTESTTEST");
};

export default handler;