GraphQL is now available in Supabase

Summary

Supabase announced the general availability of GraphQL support on its platform via pg_graphql, an open-source PostgreSQL extension that reflects SQL schemas into GraphQL types, fields, and relationships. Accessible through SQL functions or HTTP endpoints, the extension enforces PostgreSQL row-level security and filters introspection schemas according to the SQL roles assigned to request JWTs. To optimize performance, pg_graphql transpiles every GraphQL query into a single SQL query that aggregates results into JSON, avoiding the N+1 query problem and eliminating redundant join data payloads. Transpiled queries are cached as prepared statements to bypass planning overhead, and all generated mutations and queries support bulk operations. On Supabase Free Plan hardware, these optimizations achieve mean throughputs of 377.4 requests per second over the API and 656.2 queries per second over SQL connections.

Context

Providing GraphQL access on top of relational databases often introduces N+1 resolver inefficiencies, excessive payload duplication across multiple joins, and duplicate authorization layers disconnected from database-level security policies.

Approach / What changed

Supabase implemented pg_graphql, an open-source PostgreSQL extension that reflects database tables, columns, and foreign keys into GraphQL schemas accessible via SQL or HTTP. The extension leverages Postgres role permissions and Row Level Security, transpiles incoming GraphQL operations into a single JSON-aggregating SQL query, caches queries as prepared statements, and exposes bulk CRUD operations.

Takeaways

• pg_graphql automatically reflects PostgreSQL tables to types, columns to fields, and foreign keys to relations with Relay-style keyset pagination.
• Transpiling each GraphQL query into a single JSON-aggregating SQL query eliminates the N+1 resolver problem and prevents geometric payload duplication across joins.
• Authentication and authorization utilize native PostgreSQL permissions and Row Level Security, allowing a single GraphQL endpoint to serve schemas tailored to the user role in the request JWT.

Related reading