MD. HABIBULLAH SHARIF

Posted on Feb 22

Stop Setting Up Servers. Start Shipping Code. (Supabase, Appwrite & The BaaS Revolution)

#backend #webdev #beginners #supabase

There's a version of backend development where you spend two days setting up authentication before writing a single line of business logic.

You configure a database. You wire up JWT tokens. You write password reset flows. You manage file upload endpoints. You handle CORS. You set up email verification. You configure environment variables in three different places.

And then — finally — you start building the thing you actually wanted to build.

This is the problem Backend-as-a-Service (BaaS) platforms exist to solve. And in 2024–2026, two names come up constantly: Supabase and Appwrite.

What Is a BaaS and Why Does It Change Everything?

A Backend-as-a-Service gives you the infrastructure primitives every app needs — already built, already secured, already scalable — so you can skip straight to your actual product.

Think of it like this: instead of building a kitchen from scratch every time you cook, someone hands you a fully equipped one. You just... cook.

The core primitives every BaaS provides:

Database — store and query your data
Authentication — user sign-up, login, OAuth, sessions
Storage — files, images, documents
Realtime — live updates pushed to clients
Functions/API — custom backend logic without managing servers

That's the foundation. Now let's look at who does it best.

Supabase — The Open-Source Firebase (But With Postgres)

Supabase positions itself simply: "Build in a weekend. Scale to millions."

The magic is that underneath everything, it's just Postgres — the most trusted relational database in the world. Not a proprietary format. Not a document store with weird query limitations. Real SQL, real joins, real indexes. You're not locked in — your data is always yours.

What Supabase Gives You Out of the Box

Database — Full PostgreSQL. Use the visual table editor or write raw SQL. Includes views, materialized views, foreign tables, partitioned tables, stored procedures — the entire Postgres feature set.

Auth — Email/password, magic links, OAuth (Google, GitHub, Twitter, Apple, etc.), phone auth via SMS. Plugs directly into your app with pre-built components or their SDK.

Row Level Security (RLS) — This is Supabase's superpower and its biggest learning curve. You write Postgres policies that control which rows each user can read or modify. Incredibly powerful. Takes a day to really understand.

-- Only show users their own data
create policy "Users can view own profile"
  on profiles for select
  using (auth.uid() = user_id);

Storage — File uploads with S3-compatible storage, image transformations, CDN delivery, and access policies that respect your auth rules.

Realtime — Subscribe to database changes and push updates to connected clients live. Multiplayer features, live dashboards, chat — all without polling.

Edge Functions — Deploy TypeScript functions globally, close to your users. Deno-based runtime.

Instant APIs — Every table gets auto-generated REST and GraphQL endpoints the moment you create it. No controller code required.

MCP Support — Supabase now has MCP integration, meaning AI tools like Claude Code or Cursor can directly inspect your schema, suggest RLS policies, and write migrations. Genuinely changes the workflow.

The Honest Trade-offs

RLS policies are powerful but they're not beginner-friendly. Getting auth + policies + storage all talking together correctly has a learning curve. The community is helpful, but expect to spend time on it.

Edge Functions run on Deno, not Node — small adjustment if you're coming from a pure Node background.

Self-hosting Supabase is possible but involves running many Docker containers together (Postgres, PostgREST, GoTrue, Realtime, Kong, etc.). It works, but it's a lot of moving pieces to manage yourself.

Appwrite — The "Bring Any Framework" BaaS

Where Supabase is Postgres-first, Appwrite is developer-experience-first. It's built for teams that work across platforms — web, mobile (React Native, Flutter, iOS, Android), and server-side — and want everything under one SDK.

What Appwrite Gives You

Auth — All the standard flows plus one nice extra: Anonymous users that convert to real accounts when they sign up. Phone/SMS auth. Teams and memberships built in.

Databases — Document-model with collections and attributes. Not pure SQL, but it has relationships and indexing. The visual console is excellent for non-technical teammates managing data.

Storage — File buckets with permissions, image transformation (resize, crop, format), and virus scanning built in.

Functions — 30+ runtimes across 13 languages: Node, Python, PHP, Ruby, Go, Dart, .NET, Kotlin, Java, Bun, and more. You're not limited to TypeScript/Deno.

Messaging — This is an Appwrite exclusive in this tier: built-in push notifications, email, and SMS under one API. You're not stitching together Twilio + SendGrid + FCM separately.

Realtime — Subscribe to any Appwrite event — not just database changes but auth events, storage events, function completions.

Sites — Appwrite can also host your frontend. Git-connected deployments, preview URLs per branch. The full-stack in one place.

Security built-in — DDoS protection, encryption at rest and in transit, GDPR compliance, SOC-2, HIPAA. Not bolt-ons — defaults.

The Honest Trade-offs

Appwrite's database is document-based (like a more structured MongoDB), not relational SQL. If you need complex joins, reporting queries, or a relational data model — Supabase's Postgres is the better fit.

The self-hosted version requires Docker and some server management knowledge. Appwrite Cloud makes it seamless, but if budget matters, self-hosting is doable with some effort.

Supabase vs Appwrite — The Direct Comparison

Feature	Supabase	Appwrite
Database	PostgreSQL (full SQL)	Document DB (NoSQL-ish)
Auth	✅ Excellent	✅ Excellent
Storage	✅ S3-backed	✅ Built-in
Realtime	✅ DB change streams	✅ All events
Functions	TypeScript/Deno	13 languages, 30+ runtimes
Messaging	❌ Not included	✅ Push, Email, SMS
Frontend Hosting	❌ Not included	✅ Sites included
Self-hosting	✅ Complex (many containers)	✅ Easier (Docker)
Best for	SQL lovers, complex queries, AI apps	Multi-platform teams, mobile, polyglot stacks

Rule of thumb: If your team thinks in SQL and relations — Supabase. If your team builds across multiple platforms or languages — Appwrite.

The Alternatives Worth Knowing

Firebase — The Veteran

Google's platform. Battle-tested, enormous SDK ecosystem, excellent offline support. But it's NoSQL (Firestore), vendor-locked to Google Cloud, and pricing can surprise you at scale. The "Firebase Data Connect" feature now adds Postgres + GraphQL, which narrows the gap with Supabase.

Best for: Mobile-first apps, teams already in Google Cloud, real-time experiences.

PocketBase — The Minimalist's Dream

A single Go binary. Drop it on a server, it runs. Includes database (SQLite), auth, file storage, real-time, and a REST API — with a built-in admin UI. MIT licensed. Completely free.

./pocketbase serve
# That's it. Your backend is running.

The catch: SQLite means it's not for massive multi-tenant SaaS. But for side projects, internal tools, prototypes, or anything that doesn't need horizontal database scaling — it's extraordinary.

Best for: Solo developers, prototypes, internal tools, small apps.

Nhost — GraphQL-First

Same idea as Supabase (Postgres under the hood) but everything goes through GraphQL via Hasura. If your team is GraphQL-native and wants real-time subscriptions in that workflow, Nhost feels very natural.

Best for: GraphQL-first teams, JAMstack apps with real-time needs.

Convex — The TypeScript-Native Backend

Convex is a different mental model. Your backend logic lives in TypeScript functions that react to data changes automatically. No SQL policies, no REST endpoints to design. Just reactive TypeScript functions. It's genuinely elegant if you're TypeScript-first.

Best for: TypeScript-heavy teams who want reactive patterns without policy-based auth complexity.

Neon — Just Postgres, Nothing Else

Sometimes you just want serverless Postgres with branching, auto-suspend when idle, and scale-to-zero pricing. Neon does exactly that — nothing more, nothing less. You bring your own auth (Clerk, Auth.js, etc.) and storage.

Best for: Teams who know what they need and want to assemble it themselves without a full BaaS bundle.

Quick Decision Guide

Do you need complex relational queries / SQL?
├── Yes → Supabase
└── No  → Keep going

Are you building for mobile + web + possibly other platforms?
├── Yes → Appwrite (best multi-platform SDK support)
└── No  → Keep going

Is this a small app, tool, or prototype?
├── Yes → PocketBase (zero cost, zero ops)
└── No  → Keep going

Is your team GraphQL-first?
├── Yes → Nhost
└── No  → Keep going

Is your team TypeScript-first and wants reactive patterns?
├── Yes → Convex
└── No  → Supabase or Appwrite — pick based on DB preference

What This Actually Means for Your Workflow

Before BaaS: You write auth. You design token systems. You write password reset flows. You configure email. You set up file upload. You write access control middleware. You do all of this before building your actual product.

After BaaS: You call supabase.auth.signUp() or account.create() and move on.

The hours you save on infrastructure plumbing get redirected to the actual user-facing features that make your product good. That's the real argument for this category — not that it's easier (though it is), but that it radically changes what you spend your time on.

Bottom Line

Supabase if you want the power of Postgres with auth, storage, realtime, and edge functions bundled together — and you're comfortable with a bit of SQL policy writing.

Appwrite if you want the widest platform support (especially mobile), messaging included, frontend hosting, and a more flexible function runtime.

PocketBase if you want to move fast on a smaller project without any monthly bill.

The best BaaS is the one that removes friction for your specific stack and team. All three of these do it well — the differences are in the details.