# Supabase Auth

[Supabase](https://yomu.fyi/company/supabase) · Paul Copplestone · Aug 5, 2020

**Type:** Announcement

## Summary

Following an early community launch on Hacker News, the open-source Firebase alternative Supabase faced heavy developer demand for a dedicated authentication and authorization solution. In response, the team evaluated existing open-source tools such as KeyCloak and Kratos before landing on an architecture combining a forked Netlify GoTrue server with PostgreSQL and PostgREST. The resulting Supabase Auth system provides client methods like signUp and signIn alongside authorization powered by PostgreSQL Row Level Security and policies. By leveraging SQL policies to enforce access rules directly in the database, developers avoid repetitive middleware filtering while maintaining granular access controls. Future roadmap plans include adding third-party OAuth providers, custom email templates, and simplified policy management interfaces for non-technical users.

## Context

When Supabase was launched on Hacker News after three months of development, community feedback indicated that an authentication solution was the primary missing feature required before developers would adopt it for commercial projects.

## Approach / What changed

Supabase created Supabase Auth by combining a fork of Netlify's GoTrue server for authentication with PostgreSQL and PostgREST for authorization. Authorization relies on PostgreSQL Row Level Security (RLS) and SQL policies, allowing access rules to be enforced directly at the database layer rather than via manual query filtering in middleware.

## Takeaways

- Supabase Auth combines Netlify's GoTrue server for user authentication with PostgreSQL and PostgREST for authorization.
- PostgreSQL Row Level Security (RLS) and policies allow developers to enforce granular access rules in the database without manually filtering queries in middleware.
- The team evaluated open-source authentication tools including RedHat's KeyCloak and Ory's Kratos before selecting GoTrue.

**Tags:** [Architecture](https://yomu.fyi/topic/architecture), [Authentication](https://yomu.fyi/topic/authentication), [Open Source](https://yomu.fyi/topic/open-source), [Postgres](https://yomu.fyi/topic/postgres)

[Read original post](https://supabase.com/blog/supabase-auth)