Serverless

Supabase

An open source Firebase alternative on PostgreSQL: database, auth, file storage, realtime and Edge Functions.

Official siteRepository

What it is

Supabase is a backend as a service built on PostgreSQL. With every table you get REST and GraphQL APIs (via PostgREST), plus auth, file storage, realtime subscriptions and Edge Functions on Deno.

The main difference from Firebase: under the hood it is plain Postgres with SQL, extensions (pgvector, PostGIS) and the ability to take your database elsewhere at any time. The project is open source and can be self-hosted.

Data access is protected by Row Level Security (RLS): policies inside the database define which rows a user sees. This is the key thing to configure so a client can safely talk to the database directly.

Use it when

  • You need a fast backend for a web or mobile app with relational data.
  • You want Postgres and SQL rather than Firebase's NoSQL model.
  • You need auth, storage and realtime in one place.
  • Self-hosting and no lock-in matter.

Avoid it when

  • Complex business logic that is better kept in your own backend than in RLS policies and database functions.
  • You need features outside the Postgres-centric model (deep integration with Google services).
  • The team is not ready to learn RLS: policy mistakes expose data.

Key concepts

Row Level Security
PostgreSQL policies that limit row access depending on the user (auth.uid()).
PostgREST
Generates a REST API directly from the Postgres schema.
Auth
Email, OAuth, magic links, phone and JWT tokens tied to users in the database.
Realtime
Subscriptions to table changes and broadcast channels over WebSocket.
Edge Functions
Server-side TypeScript code for Deno that runs close to users.

Example

Querying a table through supabase-js (RLS policies apply).

Interview questions

  1. 1. What is Row Level Security and why is it critical in Supabase?

    RLS is Postgres policies that filter rows depending on the user. The client key is public, so without policies anyone could read or change data, and RLS is what makes direct access safe.

  2. 2. How does Supabase differ from Firebase?

    Supabase is built on relational Postgres with SQL and is open source, while Firebase uses NoSQL documents (Firestore) and is a closed Google service. Supabase is easier to migrate away from and to self-host.

  3. 3. Which key may be exposed in the client?

    The public anon key, because its rights are limited by RLS policies. The service role key bypasses RLS and must live only on the server.

Related technologies

Logos belong to their owners and are used for identification only. Icons: Simple Icons (CC0), Devicon (MIT).

Explore the platform