Loading…
Supabase
Open-source backend platform providing PostgreSQL databases, authentication, storage, realtime APIs, and serverless functions.
- 227 posts summarised
- latest
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
From their blog
Latest articles
Authentication in Ionic Angular with Supabase
The tutorial builds a simple realtime messaging app with Ionic Angular and Supabase, covering account authentication and database protection. It defines Postgres tables for users, groups, and messages, enables Row Level Security with policies for public reads and authenticated operations, and adds a trigger to copy newly registered users into a public users table. Angular services, route guards, and Supabase client logic handle email/password registration and login, session state, protected navigation, and magic links. For native apps, Capacitor URL events extract access and refresh tokens from a custom-scheme callback before establishing the session and navigating to the groups page. The tutorial concludes that Supabase can support Ionic Angular authentication with magic links, while phone authentication through Twilio is another possible option.
Supabase Beta October 2022
Supabase’s October 2022 update reports a broad set of product, documentation, and community releases, while announcing that Launch Week 6 will run from December 12–16. The new supabase-js v2 and supabase-flutter v1 SDKs reached full release, alongside a revamped Next.js quickstart with pre-built Auth UI and Auth Helpers and a Next.js 13 example for fetching and caching data from the Serverless API. Documentation covers Supabase Auth’s server-side rendering flow, and a database-testing framework uses pgTAP and pg_prove; Edge Functions also gained support for GET, PUT, PATCH, and DELETE requests. Additional changes include functions support in supabase-py, session refreshing, provider refresh tokens, request-location detection through X-Forwarded-For, expanded logging, and storage downloads via a query parameter, alongside three featured community apps and hiring announcements.
What is PostgreSQL commitfest and how to contribute
PostgreSQL Commitfest is the community's month-long review process for patches intended for merging into core. Contributors submit patches to pgsql-hackers, create a Git branch from master, consolidate changes, generate a versioned patch, and associate its mailing-list thread with an open Commitfest entry. The process expects authors to explain rationale, respond to review, rebase or revise patches, and review a comparable number of other patches. Submitted changes are checked by CFBot across architectures and operating systems, while statuses such as "Needs review," "Ready for committer," and "Waiting on author" track progress. Commitfests occur five times yearly, with the March event tied to feature-freeze for the October major release.
supabase-flutter v1 Released
Supabase has released the stable v1 of its supabase-flutter SDK after several months of developer preview feedback and improvement. The release targets developer experience by reducing boilerplate and introducing more intuitive APIs, including removal of the required .execute() call from select, insert, update, delete, and stream operations; query errors are now thrown rather than returned. Authentication methods use more descriptive names such as signInWithPassword and signInWithOAuth, while onAuthStateChange returns a Dart stream. The SDK also adds first-class support for Realtime Multiplayer's broadcast and presence methods, including low-latency data sharing and client-status tracking, and the announcement provides updated documentation, a quick start guide, and a v0-to-v1 migration guide.
supabase-js v2 Released
Supabase-js v2 has been released after a release-candidate period during which the team incorporated user feedback and updated documentation, examples, quickstart guides, and a migration guide. The release’s major addition is built-in TypeScript support, including a CLI that generates types directly from a database. It also includes improvements aimed at addressing some of the largest pain points identified by users, with the announcement providing updates and differences from v1. Version 2.0 was produced through contributions from several Supatroopers, more than 100 contributors to the libraries, and more than 450 contributors to the documentation and websites; the listed package contributions include functions-js, gotrue-js, postgrest-js, realtime-js, storage-js, and supabase-js.
Postgres Full Text Search vs the rest
The post compares PostgreSQL Full Text Search with dedicated search engines including MeiliSearch, OpenSearch, SQLite FTS, and Typesense, asking whether a separate system is justified for common application search. It presents a PostgreSQL setup using a generated stored column built with to_tsvector('english', ...) and a GIN index, queried with websearch_to_tsquery. The benchmark loads a movie dataset and focuses on query speed after data ingestion, using comparable scripts and default configurations with limited tuning. PostgreSQL was close in performance to several alternatives; in-memory SQLite was fastest, while Typesense and MeiliSearch handled misspellings correctly and OpenSearch ingested data quickly. The conclusion is that PostgreSQL can provide good-enough search quality and speed for basic cases without adding another system, although dedicated engines offer capabilities PostgreSQL does not.
Supabase Beta September 2022
Supabase’s September 2022 update centers on reducing technical debt and clearing its backlog after five Launch Weeks. The team ran three Kaizen weeks focused respectively on QA and testing, documentation, and issue backlog and automation, closing over 250 open issues and 50 pull requests while pausing feature development. Product releases included Auth UI, a pre-built React component for Supabase Auth with custom themes and extensible styles, plus an open-source Postgres WASM release with Snaplet for running Postgres in a browser through an embeddable Linux Virtual Machine. Security changes to Dashboard database interactions simplify permissions and reduce the security surface area; they were scheduled for automatic application in November or could be run earlier through the Dashboard. Other updates covered Edge Functions, documentation, migration tooling, and community projects.
Postgres WASM by Snaplet and Supabase
Supabase and Snaplet open-sourced postgres-wasm, a PostgreSQL server that runs inside a browser and supports browser persistence, pg_dump restoration, and logical replication with a remote database. Rather than compiling PostgreSQL directly to WebAssembly, the project packages a stripped-down Linux image with PostgreSQL in a Buildroot-based virtual machine, then runs it through v86 in the browser. PostgreSQL 14 startup failures were resolved by disabling v86 JIT compilation, while image optimization used a compressed 9P filesystem, asynchronous HTTPS loading, and page_poison=on to produce an initial state of about 12MB. Websocket proxying provides outbound connectivity and a forked proxy with nginx tunnels incoming connections to PostgreSQL. The project remains experimental because the download is currently about 30MB, but the post identifies offline data, testing, development environments, snapshots, and support as potential uses.
Choosing a Postgres Primary Key
Choosing a Postgres primary key involves balancing simplicity, storage, sortability, standards compliance, information leakage, and collision avoidance. The discussion starts with natural and surrogate keys, then compares integer and biginteger identity columns with serial sequences, noting that sequences can have gaps and exposed numeric IDs may reveal information. It then examines pseudorandom and secure random numeric IDs before turning to UUIDs, including UUIDv4 and time-based alternatives, whose generation methods and index behavior differ. Postgres integration, size queries, and the pg_idkit library provide practical ways to generate and evaluate identifiers; the suggested rules of thumb favor integers for simplicity, UUIDv4 for collision avoidance, xid for time-based sort friendliness, and UUIDv6 or UUIDv7 for a more standards-oriented choice.
Supabase Beta August 2022
Supabase’s August 2022 Beta Update recaps Launch Week 5 releases, the Supa Hackathon, platform changes, migration resources, and community contributions. The release set includes Supabase CLI v1 with TypeScript type generation, the Management API Beta for programmatic project and organization control, and the supabase-js v2 release candidate with type support, new authentication methods, an async Auth overhaul, and Edge Functions improvements. Supabase also announced SOC2 compliance and made Realtime Presence and Broadcast available to all projects, alongside Vault, Auth UI, dashboard permissions, JSON schema validation, pg_graphql v0.4.0, and MFA early access. From September 11, HTTP API requests will redirect to HTTPS, and clients no longer need to send anon or service keys in the apiKey header; client-library users require no change.
Launch Week 5 Hackathon Winners
Supabase announces the winners of its Launch Week 5 Hackathon, which received 46 project submissions and was described as the most popular hackathon yet. The awards recognized Supabase Cache Helpers as Best Overall for a caching utility that turns Supabase queries into cache keys and provides methods to retrieve and mutate database data, while Super UI was runner-up with a customizable React component library. Other category winners included Hop, a Tinder-like job board; Otentik Authenticator, a desktop app for managing two-step verification tokens; That Hot Dog Game, which uses facial recognition to detect eating; Quid Faciam Hodie?, a video journaling app; and RepoWatch, which shows Supabase GitHub organization updates in realtime. Winning team members receive limited-edition golden Supabase caps, runners-up receive silver caps, and all submissions are available on madewithsupabase.com.
Building a Realtime Trello Board with Supabase and Angular
The tutorial builds a Trello-style project-management board with Supabase, Angular, and Tailwind rather than stopping at a small “hello world” example. It defines boards, lists, cards, users, and user_boards in Postgres SQL, adds magic-link authentication, and uses Row Level Security policies plus helper functions and triggers to control access and maintain relationships. Angular components and services use the Supabase JavaScript client, while realtime is enabled for cards and lists and exposed through an Observable that applies INSERT, UPDATE, and DELETE events to local board state. The resulting clone supports shared boards for invited, already registered users, and the article provides SQL and source code for running the project with a Supabase instance.
One more thing
During Launch Week, Supabase announces six product updates spanning database security, authentication, dashboard administration, and developer tooling. Supabase Vault is a Postgres extension for managing secrets and encryption inside the database, built as a thin usability layer over pgsodium and released to gather user feedback rather than for immediate Supabase Platform availability. Auth UI moves from the @supabase/ui library into @supabase/auth-ui-react, with customizable themes, CSS and inline styles, and overridable labels for multilingual support; the initial release supports React. The update also adds granular Dashboard roles, pg_jsonschema for JSON Schema validation on json and jsonb, pg_graphql v0.4.0 with json/jsonb, the in filter, and larger-schema introspection, plus early-access signups for Supabase Auth MFA.
pg_jsonschema: JSON Schema support for Postgres
pg_jsonschema is a Postgres extension released on the Supabase platform that adds JSON Schema validation for json and jsonb data types. The post addresses a trade-off in storing complex webhook payloads as documents: JSON simplifies the model and accommodates changing payloads, but an unconstrained column cannot enforce required structure or types. It introduces JSON Schema as a formal, human-readable way to describe those constraints, including an object with a required string foo attribute and no additional properties. The extension provides json_matches_schema and jsonb_matches_schema, which can be used in a Postgres CHECK constraint to validate inserted documents. In the example, the constraint handled all eight test cases correctly, and invalid rows produced a constraint-violation error.
PostgREST v10: EXPLAIN and Improved Relationship Detection
PostgREST v10 adds HTTP and supabase-js access to PostgreSQL execution plans for reads, writes, and RPC requests, with the feature restricted to development-oriented use through db-plan-enabled. Plans can be returned as text or JSON, analyzed to show execution time and RLS filtering, and queried in verbose form for the pg_stat_statements query identifier and related settings. The release also improves relationship detection: unique or foreign-key primary keys produce one-to-one JSON objects, while computed relationships let SQL functions define efficient links for views and materialized views. Many-to-many detection now requires a join table’s primary key to include both foreign-key columns, a breaking change; the post says PostgREST 10 was not yet on the Supabase Platform and was planned for release there over the following month.
Supabase Vault
Supabase Vault is a Postgres extension for managing secrets and encryption inside the database, presented as a thin usability layer over pgsodium. The announcement contrasts it with pgcrypto, which accepts raw encryption keys directly and lacks public key signing, key derivation APIs, and streaming encryption. Vault stores secrets in an encrypted text column, while a unique per-database root key is managed outside SQL by pgsodium and libsodium; rows expose an internally derived key ID rather than the raw key. The vault.decrypted_secrets view decrypts values on demand, leaving stored data encrypted on disk and in backups, and users can create additional keys with pgsodium.create_key(). Vault uses Authenticated Encryption with Associated Data, binding the associated column to the authentication signature, and is positioned for API keys, access tokens, and environment variables rather than larger PII datasets.
Realtime: Multiplayer Edition
Supabase announces the general availability of Realtime’s multiplayer features, Broadcast and Presence, alongside a new channel-based architecture and supabase-js support. Realtime originally used Postgres logical replication, rather than LISTEN/NOTIFY, to avoid the latter’s 8,000-byte payload limit and the latency of querying each change from the database. In the new design, Channels act as rooms that support ephemeral publisher/subscriber Broadcast messages, shared Presence state, and Postgres change events; Presence uses Phoenix Tracker, a delta-based CRDT, for eventually consistent synchronization and removes disconnected users automatically. Realtime now runs as a distributed Elixir and Phoenix cluster on Fly, with clients connecting to the nearest node and nodes communicating across a backbone network to improve connection speed, stability, and latency. Free-plan active projects and projects created from August 18 have access, while other projects are scheduled for migration over the following weeks.
Supabase is SOC2 compliant
Supabase reports achieving SOC2 Type 1 compliance and later updates the announcement to say it is SOC2 Type 2 compliant. The post explains SOC2’s five Trust Services Criteria and distinguishes Type 1’s point-in-time audit from Type 2’s observation period, while framing customer expectations and data stewardship as the main reasons for pursuing certification. Supabase used Vanta to monitor controls and collect evidence, selected an auditor familiar with SaaS companies and Vanta, and formalized practices covering device security, access control, policies, logging, monitoring, vendor reviews, and repository protection. The process still required substantial manual evidence, and the company found that audit scope and auditor expectations mattered more than achieving a perfect automated-tool score. Supabase also launched a security center and identified HIPAA certification as a next step.
supabase-js v2
Supabase announces supabase-js v2, a release focused on developer quality-of-life improvements and designed around incremental changes rather than a large rewrite. Its type system uses CLI-generated database definitions at the client level, while authentication adds explicit signInWithPassword() and signInWithOtp() methods, makes most Auth operations asynchronous, and moves server-side methods under auth.admin. Data mutations return minimal by default unless select() is appended, constructor options are scoped by library, and Edge Functions automatically detect request and response content types. The release also introduces typed errors, a channel() interface for presence and PostgreSQL change subscriptions, and a preparatory path toward multiplayer features; older realtime syntax remains supported for now. Developers can install v2, consult updated documentation and migration guidance, while v1 continues receiving security fixes and maintenance patches for three months.
Supabase CLI v1 and Management API Beta
Supabase CLI v1 is moving out of beta with capabilities for managing database migrations and generating TypeScript types, alongside a beta Management API. The CLI can manage organizations and projects, link projects locally, run schema and manual migration workflows, support CI/CD through local and GitHub Actions workflows, and generate types from local or remote databases. Migration changes include improved manually written migrations, an experimental migra-backed db diff that is faster and produces more concise DDL, and local branching for testing DDL without data loss; the source notes that generated scripts are not perfect. The REST-based Management API, previously called the Admin API, is consumed by the CLI and exposes programmatic management of organizations, projects, Edge Functions, and more, with endpoints intended for CI/CD and test-environment creation.
Topics they write about
All topics →Weekly digest
The best engineering reads, once a week.