You Probably Misunderstand Supabase

July 3, 2026 • 13 min read

Supabase BaaS

Supabase isn’t what you think it is. It’s more than just a database.

The Confusion

See the first time I really used Supabase was when I was building a POS and inventory management system for a project as a part of semester work for a course where we were using C# and .NET WinUI to build a desktop application. At that time, a contributor said we’ll use Supabase as the “Database” for our project. I had seen it in production before on my internship but never really worked with it. So I took my team-member’s word for it and logged on to the project he had created. My impression of it was that it’s Postgres with a fancy UI. I just had to complete the semester project in all honesty so I just did what I had to with the database and moved back to working on just completing the project in time somehow.

The Problem

This past semester I put myself through another miserable choice of project for a number of courses. I thought we’d build one simple project and use it for all the courses: a web-desktop app for meetings with native AI note taking and Action item generation, all built from scratch. The real pain was building a backend and integrating WebRTC for the meetings and also keeping track of all the data moving through the app, whether it be the meeting transcriptions, the action items generated, the meeting notes.

Now, the easy solution is to use Postgres on the backend… but when you’re building a project having so many different moving parts and so much data - self-hosting and maintaining a Postgres database is really going to be a pain especially for a team of 3, working on a project where there is no real compensation. So we look for alternatives. What do we need? A database that is hosted somewhere high up in the clouds, you can put the data, get the data back from the clouds without it being wet and you can keep a lot of data because the clouds are: 1 beautiful, 2 fast & reliable , 3 high up in the sky above so presumably safe. Don’t we all love the cloud.

P.S. the cloud also must maintain the database because we are too busy. See the joke

The Solution

So what we were looking for, was there in Supabase. And no wait — you’re telling me they do auth too? So no more JWTs? No more session management? Shut up — I don’t have to deal with password hashing anymore? And best of all you can see it. Literally everything. No SELECT * FROM table (not that I don’t like it.)

We Used to pray for times like these

What’s next? You’ll do my dirty laundry? My dishes too? Drive me to university?

So that one project made me realize that Supabase is not just an ordinary database, it is a supercharged database. It does auth, it does sessions, it has a good UI, it is easy to set up, it has built-in input validation. And some sweet stuff like Row Level Security and Policies.

We’re not done yet!

You must think, ok Abdullah, that’s pretty cool and enough functionality for a Postgres based database that does auth and sessions etc. And I’d say yeah that’s it, only because I’m naive — or was naive to be correct.

See Supabase never calls itself a “Postgres Database” rather if you ever read its docs it positions itself to have multiple “Products.”

Following is its list of products and we’re going to break them down one by one and maybe in a part two(if there is) we can also try to build something that uses all of these features. Nonetheless I’ll do my best to give at least one good example for each of its products.

supabase-never-was-a-database

Some pre-req

So, before discussing the products, how Supabase really works is you create a project. Each project gets access to all the products just everything is not enabled or setup by default. You have to enable them as per your project’s requirements.

1. Database

Surprise, surprise. Their base product is a Postgres database. Each project gets a full Postgres database, not an abstraction. It’s all yours. This is the foundation for all the other products. I could write a whole separate blog about database design and creating tables in Supabase so we’re not going to go into detail rather you should know that Supabase allows you to create database tables without really writing SQL. I’d say it’s low-code.

What’s even more fun is that Supabase allows you to import data from .csv format directly into the database using the UI. For small datasets you can import directly via the dashboard or for apps in production with low latency tolerance you could use the pgloader which works with Supabase. All relevant steps are noted in the docs here

Row Level Security

Now traditionally we have a backend layer that a user connects to. A user typically creates a session and the backend is responsible to maintain that session with the user using something like a JWT. Now whenever a user requests for some data, the backend knows that this user is already authenticated so it queries the database with a user filter or filter the results on the server side(yeah I’ve seen this too, horrendous I know.) and sends back the data as a response. Simple? Not really.

So what Supabase does is really clever, it introduces Row Level Security Policies. You can define that what kind of user can get what sort of data. Policies are Postgres’s rule engine. Policies are easy to understand once you get the hang of them. Each policy is attached to a table, and the policy is executed every time a table is accessed. Think of them as a WHERE clause that is added to each query when querying the table. So what you can do is for a SELECT set one WHERE clause, one for UPDATE one for DELETE and so on.

Now in action it would look something like this:

Name	username	email
Abdullah	abdullah	me@me.com
Abdullah	a2	notme@notme.com

Generally you want abdullah to see a2's username and email and vice versa. So the RLS Policy should be to allow everyone to SELECT from the table, but a2 should never be able to UPDATE or DELETE any other row than his, so the RLS Policy should be to only allow authenticated users to modify his row. This saves you all the extra backend logic given that you are using Supabase’s user auth (I mean why won’t you.)

Apart from all this it comes with all the database functions, triggers, indexing, roles and permissions etc. One interesting thing is the Database Webhooks

Database Webhooks

We all know what webhooks do. Webhooks are HTTP callbacks that automatically send data to another application when a specific event occurs. Database Webhooks allow you to send real-time data from your database to another system whenever a table event occurs. You can hook into three table events: INSERT, UPDATE, and DELETE. All events are fired after a database row is changed. They are like triggers because they are wrappers around triggers that just leverage pg_net extension.

Sorry for the long yap, moving forward will keep it more brief

2. Data API

Remember how I said Supabase gives you a real Postgres database? Well now imagine writing an API on top of every table… and then finding out someone already did it for you.

Every table you create automatically gets a REST API (and GraphQL if you enable the extension). No Express server. No NestJS controllers. No CRUD endpoints you’ve written a hundred times before. Just make a table and congratulations—you accidentally made an API.

Want every user?

GET /rest/v1/users

Want only Abdullah?

GET /rest/v1/users?username=eq.abdullah

Want only usernames?

GET /rest/v1/users?select=username

It supports filtering, sorting, pagination, embedding relationships, and—most importantly—it still respects your Row Level Security policies. So just because the endpoint exists doesn’t mean everyone can query everything.

This is probably the point where I realized I had been writing way too many CRUD endpoints.

3. Auth

Supabase just eases the headache that is Authentication and Authorization. It checks if a user is who they claim to be, and whether they’re allowed… do something respectively. Supabase uses JWT (Jason Web Tokens - big up to Jason for the tireless work) for authentication. The best part is the Auth integrates with RLS like a dream, making it soooo easy to manage Authorization. Supabase also works with multiple social and mobile auth partners. The auth has a four-layer architecture. 1 Client layer 2 Kong API gateway 3 Auth Service 4 Postgres database. The client layer is the browser, backend server or the native application. All the traffic is moved to Kong API and then redirected to Auth Service, It is a fork of the GoTrue project, originally created by Netlify. The auth service then is responsible for Validating, issuing, and refreshing JWTs, serving between your app and Auth information in the database and so on. Supabase Auth uses the auth schema in your Postgres database to store user tables and other information. For security, this schema is not exposed on the auto-generated API. In short it is super-cool and does all the session management and auth for you.

Supabase Auth provides several passwordless login methods. Passwordless logins allow users to sign in without a password, by clicking a confirmation link or entering a verification code.

Magic Links

They are a form of passwordless login where users click on a link sent to their email address to log in to their accounts. Magic Links only work with email addresses and are one-time use only.

OTP

Email one-time passwords (OTP) are a form of passwordless login where users key in a six digit code sent to their email address to log in to their accounts.

4. Edge Functions

Edge Functions are such a cool name. It’s the same concept as Firebase Functions. Why call them Edge functions? You’ll know in a minute. How they work is 1 A request first reaches Supabase’s edge gateway, which routes it to the correct function and performs checks like JWT validation and rate limiting. 2 The request is then forwarded to an Edge Function running on the server closest to the user, minimizing latency (Thus the name.) 3 From there, the function can interact with Supabase services such as Postgres, Auth, and Storage, or call external APIs. 4 Throughout execution, logs and metrics are collected for monitoring. 5 Once the function completes, the response is sent back to the client through the edge gateway.

Imagine you’re feeling generous one day. You log onto XYZ website and you click on that “Buy premium subscription button.” Now consider that website happens to use Supabase. They could leverage Edge functions right here. Instead of calling Stripe or any other payment gateway directly from the client , the frontend invokes an Edge Function, which creates a Stripe Checkout session using your secret API key and returns the checkout URL. The frontend redirects the user to Stripe’s hosted checkout page. The user enters their payment details and completes the purchase on Stripe. Stripe sends a webhook to another Supabase Edge Function confirming the payment. The webhook verifies Stripe’s signature, updates the user’s subscription status in your Postgres database, and grants them access to premium features. The next time the user opens your app, they are recognized as a subscribed user. All done without maintaining your own backend server.

5. Realtime

Now one of the most powerful features of any UI would be realtime interaction with other users. It is implemented in almost all the modern work tools such as Google Docs, Figma etc. Secondly, all messaging also is done in realtime too. Supabase provides a globally distributed Realtime service with 1 Broadcast which sends low-latency messages between clients. Perfect for real-time messaging. 2 Presence to track and synchronize user state across clients where you can show who is online or what changes someone is making. 3 Postgres Changes to Listen to database changes in real-time.

What can you make?

The official docs list the following things:

Chat applications - Real-time messaging with typing indicators and online presence
Collaborative tools - Document editing, whiteboards, and shared workspaces
Live dashboards - Real-time data visualization and monitoring
Multiplayer games - Synchronized game state and player interactions
Social features - Live notifications, reactions, and user activity feeds

6. Storage

The docs say “robust”, “scalable” solution for managing files of any size with “fine-grained access controls” and “optimized delivery”. I’ve never heard a more AI-generated sentence.

In reality, Supabase has three different things:

Storage stores files in buckets (images, videos, PDFs, etc.) with direct URL access and RLS. Analytics stores logs and usage data in Apache Iceberg tables for querying and reporting. Vectors 🔥 store embeddings inside Postgres using pgvector for semantic search, RAG, and other AI features.

If you ever need to store user uploads, use Storage. If you’re building the next ChatGPT model with RAG, look into Vectors 🔥🔥. And unless you’re analyzing logs at scale, you can probably ignore Analytics for now.

Conclusion

As I said, you probably misunderstand what Supabase is, how it works (not that you need to know), and what it actually provides. It is not just a database. It’s a modern Backend as a Service that, in many cases, can replace large parts of a traditional backend. Authentication, storage, real-time communication, APIs, serverless functions, vector search—the list just keeps going.

At this point I’m convinced the Supabase team every morning ask themselves: “Can we somehow make Postgres do this too?” (The answer is generally yes)

The Supabase ecosystem is so large that I couldn’t possibly cover everything in a single article, and I barely scratched the surface of what Postgres itself is capable of. The best part? Almost all of it is open source, and the team has made it clear that keeping it open source is one of their core principles.

So yes… I definitely misunderstood Supabase. Hopefully, now you won’t either.

The Cloud Joke

Someone please help me forget this Kamala Harris quote 😭

No longer are you keeping those private files in some file cabinet. It’s on your laptop, and it’s then therefore up here in this cloud, that exists above us. It’s no longer in a physical place.

See the full story here

Also if you’ve read all the way through and want to see some tutorial style blog or any other suggestions then just drop-em here with the subject: “Supa Supa Suggestion”