infrastructure//Supabase

2026-03-12

Supabase is an open-source backend-as-a-service built on PostgreSQL that combines auth with roles, a robust relational database and real-time APIs in one service. It is the backend for an application's users: a server separate from the frontend, which talks to it through an API.

The database is PostgreSQL itself, with full SQL, JOINs and extensions such as pgvector for vector search, and it belongs to the project to use however it wants. Data beyond what the SDK manages (additional client data, custom queries, extra tables) goes through a direct connection, as with any regular Postgres database.

Auth comes built in with email, OAuth and magic links, and with row-level security (RLS): users get permissions per table and per row, and no third-party auth service is needed. Supabase Auth handles OAuth natively with Google, so one login gives both identity and Gmail access.

Real-time subscriptions to database changes run over WebSockets, and the API pushes updates to connected clients instantly. Storage adds file uploads with access control, like a simple S3.

Client SDKs for React, Next.js and Flutter talk to the Supabase API. A common pairing puts the frontend on Vercel and the database, auth, storage and real-time on Supabase.

The Table Editor and the SQL Editor split the work. The Table Editor is visual (a spreadsheet view to click, edit, filter and sort rows) and only touches rows; the SQL Editor runs commands (DDL, triggers, indexes, RLS policies, complex queries), can do everything, and saves queries as favorites.

Access goes through four layers: the URL (where the building is), the publishable key (the front door, a light lock), a session token per user (the real identity) and RLS (the lock at the database level). The publishable key is not the security; the token and RLS are.