Backend6 min read

Supabase

Open-source Firebase alternative - PostgreSQL database, auth, storage, edge functions, and real-time subscriptions in a managed platform.

SupabasePostgreSQLAuthReal-TimeBaaS

skill: Supabase category: Backend tags: [Supabase, PostgreSQL, Auth, Real-Time, BaaS] readingTime: 6

Supabase is the fastest path to a production-grade backend for small-to-medium teams. It removes infrastructure management while exposing the full power of PostgreSQL. For enterprise-grade custom auth or highly specific performance requirements, building a custom backend may be necessary. Self-hosted Supabase is also an option for data sovereignty.

Workflow

Set up the Supabase clientThe Supabase JS client handles auth state, database queries, storage uploads, and real-time subscriptions from a single import.
Authenticate usersSupabase Auth provides email/password, magic links, OAuth (Google, GitHub, Apple), and SMS - no custom auth logic needed.
Secure data with Row Level Security (RLS)RLS policies enforce data access rules at the database level - a user can only read/write their own rows, even if they bypass your API.
Query the databaseThe Supabase client provides a fluent query builder - no SQL needed for CRUD, with full PostgreSQL power available via rpc() and raw SQL.
Subscribe to real-time changesSupabase uses PostgreSQL's Logical Replication to push DB changes to clients - no polling, no custom WebSocket server.

Output Format

Supabase-backed app: auth, RLS-secured tables, typed queries, and real-time subscriptions.

lib/
├── supabase.ts       # Client singleton + types
├── auth.ts           # Auth helpers
└── queries/
    ├── posts.ts      # Typed query functions
    └── users.ts

supabase/
├── migrations/       # Schema SQL files
└── functions/        # Edge Functions (Deno)

Examples

Input

Output

Edge Cases & Gotchas

Anon key is public - The anon key is exposed in the client - RLS is the only thing preventing unauthorized data access. Never skip RLS for tables with sensitive data.
Real-time subscription overhead - Supabase real-time has a connection limit per plan. Don't subscribe to high-frequency tables (analytics, logs) - use polling or webhooks instead.
Storage bucket policies - Storage buckets default to private. Set bucket policies and signed URLs for user-uploaded content - don't make buckets public unless all content is non-sensitive.
Edge Functions cold starts - Supabase Edge Functions (Deno) have cold starts of 200-500ms. For latency-sensitive endpoints, keep functions warm with a periodic ping or use a traditional server.

When to Break These Rules

Use a custom Node.js/Python backend when business logic is too complex for PostgreSQL functions and RLS, or when you need integrations not supported by Supabase.
Self-host Supabase (via Docker) when data residency regulations prevent using Supabase Cloud in specific regions.

Reference Files

https://supabase.com/docs
https://supabase.com/docs/guides/database/row-level-security