Storage is now available in Supabase

Summary

Supabase launched Storage, adding a scalable object store to its existing Postgres, authentication, and API services. Existing open-source storage servers like Ceph, Swift, Minio, and Zenko were evaluated but rejected due to auth incompatibilities and external dependencies like etcd, MongoDB, and Kafka. Consequently, the team implemented a custom Storage API server built with Fastify and TypeScript behind the Kong gateway. Object metadata and access control reside directly in Postgres, leveraging Row Level Security policies written in SQL rather than a proprietary domain-specific language. Objects stream directly to managed backends like AWS S3 using Node streams with minimal in-memory buffering, accompanied by a default one-hour Cache-Control header.

Context

Users required a scalable object store integrated into the Supabase ecosystem, but existing open-source storage servers could not use Postgres as their primary datastore and bundled incompatible authentication systems.

Approach / What changed

Built a custom Storage API server using Fastify, TypeScript, and Node streams behind a Kong gateway, delegating metadata and authorization to Postgres tables via Row Level Security while storing actual objects in S3.

Takeaways

• Instead of introducing a custom policy DSL, Supabase Storage leverages Postgres Row Level Security on a dedicated storage schema to evaluate authorization.
• Node streams upload objects directly to S3 with minimal in-memory buffering, reducing RAM consumption during large file transfers.
• Supabase Storage applies a default Cache-Control header of one hour to retrieved objects to ensure browser caching, which can be overridden.

Related reading

• Supabase · Mar 25, 2021

  Launch week

  Following its transition from Alpha to Beta, Supabase scheduled an intensive Launch Week to deliver multiple major features built over a three-month cycle. The event opened with a pricing model designed around predictable metrics like storage to prevent unexpected billing spikes from API requests. The team subsequently launched Supabase Storage, combining a Fastify Node.js API layer with Kong authentication and Postgres Row Level Security for policy evaluation. Additional launches delivered a CLI supporting database migrations and Docker self-hosting, alongside an open-source dashboard UI component library. Finally, Supabase added PgBouncer connection pooling for Postgres instances, previewed an Elixir workflow engine, and transitioned its primary domain to supabase.com.

  Ant Wilson

• Supabase · Jul 27, 2021

  Supabase Storage now in Beta

  Supabase released Storage Beta with several functional and architectural improvements three months after its alpha launch. The storage service now supports the Content-Range HTTP header for streaming audio and video, alongside entirely public buckets configured with dashboard safeguards and standard authorization policies. Directory uploads are enabled via the File and Directory entries API, while self-hosted instances can use a new local filesystem backend rather than requiring AWS S3 configuration. To support Node.js without adding polyfills or bundling complexity, the storage server was updated to accept binary data and streams directly. Additionally, the dashboard storage explorer simulates filesystem directories using hidden placeholder files and implements list virtualization.