Supabase Storage now in Beta

Summary

Supabase released Storage Beta with several functional and architectural improvements three months after its alpha launch. The storage service now supports the Content-Range HTTP header for streaming audio and video, alongside entirely public buckets configured with dashboard safeguards and standard authorization policies. Directory uploads are enabled via the File and Directory entries API, while self-hosted instances can use a new local filesystem backend rather than requiring AWS S3 configuration. To support Node.js without adding polyfills or bundling complexity, the storage server was updated to accept binary data and streams directly. Additionally, the dashboard storage explorer simulates filesystem directories using hidden placeholder files and implements list virtualization.

Context

Three months after launching Storage Alpha, Supabase aimed to improve developer experience, address security concerns with bucket exposure, remove AWS dependencies for self-hosted instances, and expand client support across Node.js and browser environments.

Approach / What changed

Supabase added Content-Range header support, enforced whole-bucket public visibility with dashboard warnings, implemented a local filesystem storage backend, modified the server to accept binary payloads directly, and introduced directory placeholder files with DOM virtualization in the dashboard.

Takeaways

• Buckets in Supabase Storage must be public in their entirety to eliminate ambiguity over exposed objects, while still enforcing Auth Policies for uploads and deletions.
• Modifying the storage server to accept binary data allowed the client library to support Node.js streams and binary formats without increasing its 15.8 kb bundle size.
• Empty directories in the dashboard storage explorer are simulated by uploading a hidden placeholder file that is removed once an object is uploaded to that path.

Related reading

• Supabase · Mar 30, 2021

  Storage is now available in Supabase

  Supabase launched Storage, adding a scalable object store to its existing Postgres, authentication, and API services. Existing open-source storage servers like Ceph, Swift, Minio, and Zenko were evaluated but rejected due to auth incompatibilities and external dependencies like etcd, MongoDB, and Kafka. Consequently, the team implemented a custom Storage API server built with Fastify and TypeScript behind the Kong gateway. Object metadata and access control reside directly in Postgres, leveraging Row Level Security policies written in SQL rather than a proprietary domain-specific language. Objects stream directly to managed backends like AWS S3 using Node streams with minimal in-memory buffering, accompanied by a default one-hour Cache-Control header.

  Inian Parameshwaran

• Supabase · May 5, 2021

  Supabase Beta April 2021

  Supabase focused on platform stability, security enhancements, and community support during its April 2021 beta update cycle. To address visual accessibility needs for developers with astigmatisms or those operating in brightly lit environments, the team delivered Light Mode within the dashboard settings. The release also introduced OpenAPI-powered Storage API documentation, community translations for the main repository spanning nineteen distinct languages, and an experimental synchronization server connecting Postgres with Stripe. Dashboard components are systematically migrating into an open-source UI library, establishing necessary foundations for local development tooling and self-hosted environments. Additionally, the team reported substantial contributor growth across its realtime server and UI repositories while continuing engineering on a Workflows engine aimed at a July release.