Supabase Auth

Summary

Following an early community launch on Hacker News, the open-source Firebase alternative Supabase faced heavy developer demand for a dedicated authentication and authorization solution. In response, the team evaluated existing open-source tools such as KeyCloak and Kratos before landing on an architecture combining a forked Netlify GoTrue server with PostgreSQL and PostgREST. The resulting Supabase Auth system provides client methods like signUp and signIn alongside authorization powered by PostgreSQL Row Level Security and policies. By leveraging SQL policies to enforce access rules directly in the database, developers avoid repetitive middleware filtering while maintaining granular access controls. Future roadmap plans include adding third-party OAuth providers, custom email templates, and simplified policy management interfaces for non-technical users.

Context

When Supabase was launched on Hacker News after three months of development, community feedback indicated that an authentication solution was the primary missing feature required before developers would adopt it for commercial projects.

Approach / What changed

Supabase created Supabase Auth by combining a fork of Netlify's GoTrue server for authentication with PostgreSQL and PostgREST for authorization. Authorization relies on PostgreSQL Row Level Security (RLS) and SQL policies, allowing access rules to be enforced directly at the database layer rather than via manual query filtering in middleware.

Takeaways

• Supabase Auth combines Netlify's GoTrue server for user authentication with PostgreSQL and PostgREST for authorization.
• PostgreSQL Row Level Security (RLS) and policies allow developers to enforce granular access rules in the database without manually filtering queries in middleware.
• The team evaluated open-source authentication tools including RedHat's KeyCloak and Ory's Kratos before selecting GoTrue.

Related reading

• Supabase · Aug 2, 2020

  Supabase Alpha July 2020

  Supabase announced the release of Supabase Auth following five months of development, providing resources and a video tutorial on implementing authentication with PostgreSQL Row Level Security. The Table Editor now allows users to drill multiple levels deep into table relationships as well as add, delete, and download rows directly. Newly created projects also include access to additional Postgres extensions, including pgsql-http, pgjwt, plpgsql_check, and pljava. Further platform updates include an or filter in the client library, expanded capabilities for the postgres-meta REST management server, and persistence for open tabs in the Table View. Additionally, the auto-generated documentation now integrates authentication guides, and visual page transition glitches have been resolved.

  Paul Copplestone

• Supabase · Dec 1, 2021

  Realtime Postgres RLS now available on Supabase

  Supabase updated its Realtime server to enforce PostgreSQL Row Level Security (RLS) policies when broadcasting database changes over websockets. Previously, Realtime operated as an opt-in beta feature that sent all replication changes to every client regardless of user authorization. To enforce RLS per subscriber without heavy performance overhead, Supabase introduced WALRUS, a security engine colocated inside PostgreSQL. For each replication change, WALRUS looks up active subscribers, assumes their identities, and evaluates row visibility using prepared statements queried by primary key. This in-database evaluation avoids external network round trips and single-query planning overhead while returning an authorized subscriber list to Realtime.