If you have ever started a side project and spent the first weekend wiring up a database, user sign-ups, file uploads and an API before writing a single feature, Supabase was built for you.
In this article we will look at what Supabase actually is, how it works under the hood, how to get a project running in a few minutes, and whether it is worth adding to your toolbox.
What is Supabase?
Supabase describes itself as "the Postgres development platform." The short version: you get a real Postgres database, plus the backend pieces most apps need, without having to build them yourself.
Out of the box you get:
- A hosted Postgres database (a full one, not a limited abstraction)
- Authentication with email, magic links, OAuth providers and more
- Auto-generated APIs (REST and GraphQL) based on your tables
- Realtime subscriptions to database changes over websockets
- Storage for files like images and documents
- Edge Functions for custom server-side logic
- Vector support through pgvector for AI and embeddings work
- A dashboard with a table editor, SQL editor and logs
It is often called an open source Firebase alternative. The big difference is that Supabase is built on SQL and Postgres instead of a proprietary NoSQL store, so your data model is relational and portable.
The project is very active: the main repository has over 100k stars on GitHub and is licensed under Apache 2.0.
How it works under the hood
One thing I like about Supabase is that it is not a black box. It is a collection of open source tools, glued together:
| Piece | What it does |
|---|---|
| Postgres | The database at the center of everything |
| PostgREST | Turns your database schema into a REST API |
| GoTrue (Auth) | JWT-based sign-up, login and sessions |
| Realtime | An Elixir server that broadcasts database changes over websockets |
| Storage API | S3-compatible file storage, with permissions handled in Postgres |
| pg_graphql | A Postgres extension that exposes a GraphQL API |
Because everything sits on top of Postgres, permissions are handled with Postgres Row Level Security (RLS). That means your security rules live next to your data, not scattered across your app code.
Getting started in 5 minutes
1. Create a project
Sign up at supabase.com, create a new project, and grab two values from the project settings:
- Your project URL
- Your publishable (anon) key
2. Create a table
Open the SQL editor in the dashboard and run:
create table todos (
id bigint generated always as identity primary key,
user_id uuid references auth.users not null default auth.uid(),
title text not null,
done boolean default false,
created_at timestamptz default now()
);
alter table todos enable row level security;
create policy "Users can manage their own todos"
on todos for all
using (auth.uid() = user_id)
with check (auth.uid() = user_id);
That last part matters. With RLS enabled and this policy in place, each user can only see and edit their own rows, even though the frontend talks to the database directly.
3. Install the client
npm install @supabase/supabase-js
import { createClient } from '@supabase/supabase-js'
const supabase = createClient(
'https://your-project.supabase.co',
'your-publishable-key'
)
4. Sign up a user
const { data, error } = await supabase.auth.signUp({
email: 'dev@example.com',
password: 'a-strong-password',
})
5. Read and write data
// Insert
await supabase.from('todos').insert({ title: 'Write a dev.to article' })
// Select
const { data: todos } = await supabase
.from('todos')
.select('*')
.order('created_at', { ascending: false })
No API routes, no ORM setup, no controller files. The REST API already exists because the table exists.
6. Listen for changes in realtime
supabase
.channel('todos-changes')
.on(
'postgres_changes',
{ event: 'INSERT', schema: 'public', table: 'todos' },
(payload) => console.log('New todo:', payload.new)
)
.subscribe()
That is enough to build a live-updating todo app, chat, or dashboard.
Local development
You do not have to develop against the cloud. The Supabase CLI runs the whole stack locally with Docker:
npx supabase init
npx supabase start
This gives you a local database, auth, storage and dashboard. You can write migrations, test them locally, and push them to your hosted project when you are ready. It also generates TypeScript types from your schema, which makes the client fully typed:
npx supabase gen types typescript --local > database.types.ts
If you want to avoid cloud hosting entirely, Supabase can also be self-hosted with Docker.
Client libraries
Official clients exist for JavaScript/TypeScript, Flutter, Swift and Python. The community maintains clients for C#, Kotlin, Go, Ruby and others. So whether you are building a Next.js app, a mobile app or a Python backend, you are covered.
The good and the not-so-good
What works well
- It is just Postgres. You can use SQL, joins, views, triggers, extensions and any Postgres tool you already know. If you ever leave, you take a standard Postgres database with you.
- Very fast to start. Auth, storage and an API in minutes is not marketing speak; it really is that quick.
- Open source. You can read the code, self-host it, and avoid hard lock-in.
- Strong docs and community. The docs are good, and the Discord and GitHub discussions are active.
- Good fit for AI apps. pgvector support means you can store embeddings next to your regular data.
What to watch out for
- You need to learn RLS. If you forget to enable Row Level Security or write a loose policy, your data can be exposed. Take the time to understand it.
- Logic in the database is a mindset shift. Policies, functions and triggers in SQL can feel unfamiliar if you are used to keeping all logic in your backend code.
- Free tier limits. The free plan is generous for learning and prototypes, but inactive free projects can be paused, and real production apps will usually need a paid plan. Check the pricing page for current details.
- Self-hosting takes effort. It is possible, but running the full stack yourself in production means you own upgrades, backups and monitoring.
So, is it worth a try?
Yes, for most developers it is.
Supabase is a great choice if you:
- Want to ship a side project, MVP or SaaS quickly
- Prefer SQL and relational data over document databases
- Are building frontend-heavy or mobile apps and do not want to write a custom backend
- Want an AI-ready database with vector search built in
It may not be the best fit if you need a highly custom backend architecture, have strict requirements that rule out managed services and do not want to self-host, or your team has no interest in learning Postgres.
The best way to decide is to build something small. Spin up a free project, create one table, turn on RLS, and connect a frontend. In an afternoon you will know whether Supabase fits the way you like to work.
Useful links
- GitHub: github.com/supabase/supabase
Top comments (1)
The afternoon test at the end is the right advice. One add. Row Level Security is per table, not per project. The table you add next month, from SQL or from an AI tool, starts without that lock even when the first table has it. Check the setting table by table, each time you add one.