What Is Supabase? How It Works, and Why AI App Builders Use It

Ask AI

ChatGPTClaudePerplexityGrok

Supabase is a hosted Postgres database that comes with user login, file storage, realtime updates and serverless functions. It turns your tables into an API that your app’s frontend can call directly, so you don’t have to write a backend. That shortcut explains its growth.

As of October 2026, more than 13 million developers use it, it adds over 4 million new databases a month, and 70% of those are created by AI agents and app builders rather than people. It’s also the source of its most common mistake: because the browser talks to the database directly, your data is only as safe as the access rules you write in Postgres.

What You Get When You Create a Supabase Project

Each project is a dedicated Postgres database with these services attached. Most are open-source tools Supabase maintains or packages.

Since Auth stores users in your own database, a user_id column in an orders table can reference the logged-in user directly. Firebase keeps users in a separate system, so you can’t link them to your data with a database relation like this.

Your Frontend Talks Straight to the Database

In most stacks, the browser calls your server and your server queries the database. Supabase removes that middle layer. Your app ships a public “anon” key, and anyone who opens the browser’s developer tools can find it. That’s by design. The key identifies your project, and Postgres RLS policies decide what each request can do.

This is all the frontend code it takes to read a table. There’s no server in between:

import { createClient } from '@supabase/supabase-js'

const supabase = createClient('https://YOUR-PROJECT.supabase.co', 'YOUR-PUBLISHABLE-KEY')
const { data, error } = await supabase.from('orders').select('*')

Whether data contains one user’s orders or every order in the table depends entirely on the policy below.

A policy is a short piece of SQL. This one lets users see only their own orders:

alter table orders enable row level security;

create policy "Users read their own orders"
on orders for select
using (auth.uid() = user_id);

If you forget the first line, or enable RLS without writing any policies, the result is very different. A table with RLS enabled but no policies blocks everyone. A table with RLS disabled is open to anyone who has the anon key. That gap is where real problems have come from. In May 2025, security researcher Matt Palmer published CVE-2025-48757, showing that Lovable projects created on or before 15 April 2025 could have tables without effective RLS, exposing names, email addresses, payment records and third-party API keys. A follow-up scan found 303 open endpoints across 170 projects. Supabase’s own April 2026 post on AI agents lists “skipping RLS policies on exposed schemas” as the first mistake agents make, along with creating views that bypass RLS.

The rule is simple. Secret keys (the service role key, Stripe secrets, OpenAI keys) belong only in Edge Functions or your server. Every table the frontend can reach needs RLS enabled and a policy you’ve read yourself.

Why AI App Builders Default to Supabase

When an AI tool builds an app for you, it needs somewhere to store users and data that it can set up without you writing server code. Supabase fits that need. A project can be created through an API, the schema is plain SQL that language models write well, and the auto-generated API means the agent only has to write frontend code. That’s why app builders such as Lovable connect to it natively. Our AI app builders comparison covers which builders use Supabase and which run their own backend.

Supabase now builds for agents as well as human developers:

Supabase’s own docs advise caution. They recommend connecting the MCP server to production only when needed, with read-only mode and project scoping, because instructions hidden in data, such as a support ticket, could trick an agent into running harmful queries. If you’re vibe coding an app, point the agent at a development branch, not your live database.

Getting Started With Supabase in Five Steps

1. Create a project at supabase.com, pick the region closest to your users (Mumbai for India) and save the database password.
2. Create a table in the Table Editor and keep “Enable Row Level Security” ticked.
3. Add a policy for each action your app needs, such as “users can read their own rows,” in the Policies screen or the SQL Editor.
4. Copy your project URL and publishable (anon) key from the project’s API settings.
5. Install @supabase/supabase-js in your app and query the table, or connect the project to an AI app builder or coding agent through the MCP server.

Before you invite real users, open the Security Advisor in the dashboard. It flags tables with RLS off and views that bypass it.

Supabase vs Firebase: How They’re Built

Both give you a backend without running servers, but they’re built very differently.

Choose Supabase if your data has relations (customers, orders, invoices, line items) or you want to keep the option to leave. Firebase is still easier for mobile apps that need offline sync, and for teams already working in Google Cloud.

Self-Hosting Supabase: What You Give Up

You can run Supabase on your own server with Docker Compose, and some teams do this for data residency or cost control. According to Supabase’s self-hosting docs, you then handle servers, security updates, backups, high availability and monitoring yourself. Studio manages one project only, and branching, managed backups with point-in-time recovery, analytics and vector buckets, ETL pipelines and the Management API aren’t available. Support is community-only, through GitHub, Discord and Reddit. For most small teams, the hosted free plan or Pro plan is less work than a self-hosted server.

What Supabase Costs

There’s a free plan with two active projects, a 500 MB database and 50,000 monthly active users. Pro starts at $25 a month. Compute, storage and egress beyond the included amounts are what usually raise the bill. For plan limits, overages and real bill examples, see our Supabase pricing guide.

Using Supabase From India

Supabase has a South Asia (Mumbai) region, ap-south-1, so Indian users get low-latency database access if you choose it when creating the project. You can’t change the region later without migrating.

You should also know about the 2026 block. On 24 February 2026, the government issued an order under Section 69A of the IT Act, and Jio, Airtel and ACT users couldn’t reach supabase.co, the domain apps use to talk to their database. The marketing site stayed up. Supabase said access was fully restored across India on 3 March 2026, and no public reason for the order was given. For an app whose users are mostly in India, a custom domain for your Supabase project, which Supabase suggested as a workaround in its March post on regional blocks, reduces the risk of a domain-level block taking your app offline again.

When Supabase Is the Wrong Choice

• You need offline-first mobile sync out of the box.
• Your workload is heavy analytics on billions of rows, not app data.
• Nobody on the team will review RLS policies before launch.
• You want a backend where business logic lives on a server you control, not in database policies.
• A demo or side project needs to stay online with almost no traffic (free projects pause).

Supabase Alternatives Worth Knowing

Databricks said more than 80% of databases on Neon were created by AI agents at the time of the deal, the same trend Supabase reports.

What Changed at Supabase in 2026

FAQs