Supabase

A backend built around one dedicated Postgres database per project, with a REST API generated from its schema, JWT auth, file storage, realtime updates and edge functions, all assembled from open-source parts you can also self-host.

What it is: Backend as a service (BaaS)
Used for: Relational databases,Authentication,GraphQL-native databases
Type: Commercial product
Made by: Supabase, Inc.
License: Apache 2.0 (platform repo); hosted service proprietary
Facts checked: 13 October 2026

What it is

Each project is a full Postgres database on its own server, and you can use it with full privileges. Around it Supabase runs separate open-source services: PostgREST reflects the schema into a REST API at https://<project_ref>.supabase.co/rest/v1/ (with the pg_graphql extension for GraphQL), GoTrue issues JWTs for signed-in users, Realtime (in Elixir) streams database changes and broadcasts messages over WebSockets, the Storage API serves S3-compatible files while keeping their metadata in Postgres, Edge Functions run TypeScript on Deno, Supavisor pools connections and Envoy is the API gateway. Browsers can call the API directly because every request runs as a Postgres role (anon or authenticated) and Row Level Security policies decide which rows it may read or write; PostgREST turns each request into a single SQL statement.

On the hosted platform you pay for a plan and for compute per project, billed hourly. The Free plan gives 500 MB of database, 1 GB of files and 50,000 monthly active users, allows 2 active projects and pauses a project after a week of inactivity. Pro starts at $25 a month with $10 of compute credit, which covers one Micro instance (shared CPU, 1 GB of RAM); sizes go up to 16XL at $3,730 a month for 64 dedicated vCPUs and 256 GB. Self-hosting uses Docker Compose and runs as a single project, without branching, managed backups, point-in-time recovery or the Management API.

Why teams pick it

It is plain Postgres: you can connect with any Postgres client or ORM, use extensions such as pgvector, and leave with pg_dump
Authorization lives in the database as Row Level Security policies, so the generated API, Realtime and Storage all enforce the same rules
Every component is open source (Postgres, PostgREST, GoTrue, Realtime, Storage, Supavisor), and the hosted platform is meant to stay compatible with self-hosting
Predictable entry pricing: a $25 Pro plan includes 100,000 monthly active users, 8 GB of disk, 250 GB of egress and 2 million Edge Function invocations

Watch out for

A table in an exposed schema without RLS is readable and writable by any role with a grant on it, and views bypass RLS by default, so a missed policy exposes data to the browser
Compute is charged per project, so each extra project on a paid plan adds at least $10 a month; Free projects pause after 1 week of inactivity
Edge Functions get 256 MB of memory, 2 s of CPU time per request and a wall clock of 150 s (Free) or 400 s (paid), with no multithreaded Node libraries such as sharp
Self-hosted Supabase is one project per install, community-supported, and lacks branching, PITR and managed backups

Specs

Compare with alternatives →

Data model: Relational (PostgreSQL), one database per project
Query language: SQL, plus a REST API from PostgREST and GraphQL through pg_graphql
Client protocol: PostgreSQL wire protocol, HTTP and WebSockets
How it scales: One Postgres server per project, from Micro up to 64 vCPUs and 256 GB
Ways to run it: Hosted platform, or self-hosted with Docker Compose
Pricing model: Plan fee plus compute per project, billed hourly

Alternatives

What all backend as a service (baas) have in common →Compare side by side →

NeonCommercialServerless Postgres that keeps data in a shared storage layer, so compute can scale to zero and a branch of the database is a pointer, not a copy.

XataCommercialA platform that runs unmodified Postgres on Kubernetes with copy-on-write branches at the storage layer, scale to zero, and anonymized copies of production for development.

8baseDormantCommercialA hosted backend on AWS that generates a GraphQL API from the tables you define, backed by Aurora MySQL, with roles, authentication, file storage and custom functions on Lambda.

OmnigresDormantOpen sourceA set of more than 30 Postgres extensions that turn one Postgres instance into an application server: it answers HTTP, runs Python, loads code from files and sends email, all inside the database’s transactions.

RealmDeprecatedOpen sourceAn embedded object database for mobile apps, a replacement for SQLite and Core Data, whose cloud sync service MongoDB shut down in 2025.

RethinkDBDormantOpen sourceA clustered JSON document database whose queries can stay open as changefeeds, pushing every change to the client instead of the app polling for it.

SurrealDBCommercialA multi-model database in Rust that stores documents, graph edges, vectors and time series in one engine, queried with an SQL-like language, SurrealQL, and able to run embedded, as a server or as a cluster.

Hasura GraphQL EngineOpen sourceHasura’s open-source v2 engine: point it at Postgres or another supported database and it serves a GraphQL API with queries, mutations and live subscriptions, guarded by role-based row and column permissions.

How it fits with other technologies

What Supabase uses

What uses Supabase

ChartDBdraws diagrams of Postgres schemas inSupabaseDatabase clients and design tools

Let signed-in users read only their own rows through the generated API · sql

create table public.todos (
  id bigint generated always as identity primary key,
  user_id uuid not null references auth.users (id),
  task text not null
);

alter table public.todos enable row level security;

-- Grant only what each client role needs: signed-out visitors get nothing
revoke all on table public.todos from anon, authenticated;
grant select, insert, update, delete on table public.todos to authenticated;

create policy "Individuals can view their own todos."
  on public.todos for select
  to authenticated
  using ( (select auth.uid()) = user_id );

-- GET https://<project_ref>.supabase.co/rest/v1/todos with the user's JWT
-- now returns only that user's rows

See it in a real stack

No architecture uses Supabase yet. Drop it into the playground and wire it up yourself.Open playground →

Where it came from2020–2026

Firebase made it easy to build an app without writing a backend, but it stored data in a NoSQL document database. Supabase started in early 2020 to give developers the same experience on Postgres. Its architecture page says it deliberately chose Postgres over a NoSQL store and, wherever possible, uses and supports existing open-source tools instead of building from scratch.

The first alpha, announced by co-founder and CEO Paul Copplestone in May 2020, could set up a Postgres database in about two minutes and auto-generate APIs from it; it was free to use thanks to DigitalOcean’s startup program and was not production ready. Magic-link auth and supabase-js 1.0 followed that autumn, and after about ten months of building Supabase entered beta in December 2020, along with a $6M seed round from Y Combinator, Mozilla and Coatue. Storage and a CLI for local development were next on the list.

Supabase declared general availability on 15 April 2024, saying it had kept the beta label until it could support every kind of customer. Since then most of its growth has come from AI tools: in its June 2026 Series F ($500M at a $10B pre-money valuation) it said more than 60% of new databases are launched by some kind of AI tool. In October 2026 it announced it is acquiring Turso, whose SQLite-based platform can manage millions of small databases per server, aiming at agents that create databases on demand.

Why it’s built this way

Postgres instead of a NoSQL store: Supabase says no other database offered the functionality needed to compete with Firebase while still scaling beyond it, and it does not abstract the database: you get full access to it.
Assemble existing open-source tools: Its principles ask that each piece works on its own with nothing but a Postgres database, so it adopted PostgREST, GoTrue and Envoy and built only what was missing, such as Realtime and the Storage API.
Authorization as Postgres Row Level Security: Because the API runs every request as a database role, policies written once in SQL protect the data whether it is read through REST, Realtime or Storage, which lets apps talk to the database straight from the browser.
Portability over lock-in: The hosted platform is meant to stay compatible with self-hosting and to use standards such as pg_dump and CSV, so customers can migrate in and out; Supabase says it prefers upstreaming Postgres features to running a fork.

Timeline

2020
First alpha in May: hosted Postgres with auto-generated APIs
2020
Beta in December, with a $6M seed round
2024
Generally available on 15 April
2026
$500M Series F in June; Multigres v0.1 alpha released as open source
2026
Announces it is acquiring Turso on 2 October

Sources10 · facts checked 13 October 2026

Improve this page on GitHub