Supabase

When to Use

• Rapid Application Development: Get Auth + DB + APIs in 5 minutes.
• Postgres Power: Unlike Firebase, you have full SQL power (JOINs, aggregation).
• Realtime: Subscribe to DB changes via WebSockets.
• Vector/AI: Highly integrated

  pgvector

  support for AI apps.

Quick Start (JS)

import { createClient } from "@supabase/supabase-js";

const supabase = createClient("https://xyz.supabase.co", "public-anon-key");

// Listen to changes
const subscription = supabase
  .channel("public:messages")
  .on(
    "postgres_changes",
    { event: "INSERT", schema: "public", table: "messages" },
    (payload) => {
      console.log("New message:", payload);
    },
  )
  .subscribe();

Core Concepts

Row Level Security (RLS)

CREATE POLICY "Users can see own data" ON "profiles"
FOR SELECT USING (auth.uid() = user_id);

PostgREST

Extensions

Best Practices (2025)

• Enable RLS immediately: Never launch without RLS policies.
• Use Supabase CLI: For local development and migrations. Develop locally, push to prod.
• Use Generated Types:

  supabase gen types typescript

  generates accurate TS definitions from your DB schema.

• Don't access

  service_role

  key in client: Allows bypassing RLS. Server-side only.
• Don't put business logic in triggers: Hard to debug. Use Database Webhooks or Edge Functions.

References

• Supabase Docs