Supabase Review 2026

What is Supabase?

Seven days. That is how long a project on Supabase's free plan can sit without database traffic before the platform pauses it, and it is the detail that trips up more side projects than any quota. The rest of the free offer is generous: two active projects, a 500 MB Postgres database, 1 GB of file storage and 50,000 monthly active users for sign-in. This review starts with what those numbers buy, then weighs supabase vs firebase for startups on data model and cost, and ends with the setup steps (Google login, row level security, Next.js, Docker) that decide whether the first week goes smoothly.

Paul Copplestone and Ant Wilson started Supabase in 2020. The company works remote-first, and funding coverage gives San Francisco as its base. In October 2025 it raised a $100 million Series E at a $5 billion valuation, co-led by Accel and Peak XV. The product is a hosted Postgres database with the usual backend pieces bolted around it: supabase auth for users, supabase storage for files, supabase realtime for live updates over WebSockets, and supabase edge functions for server-side TypeScript. Every table you create gets an instant REST API through PostgREST, plus an optional GraphQL endpoint. The core code is open source under Apache 2.0 on GitHub, where the main repository has close to 108,000 stars.

Supabase pricing: free plan limits against the $25 Pro bill

The table below follows the official pricing page as of October 2026. All prices are in US dollars and billed to a card; there is no rupee price list.

The $25 figure is a floor. Pro includes $10 of compute credit each month, which exactly covers one Micro instance (1 GB RAM, shared CPU). Each extra project runs its own compute, so a second Micro project adds roughly $10. Bigger instances are priced by the hour: Small is about $15 a month, Medium $60, and Large, the first size with 2 dedicated vCPUs, about $110. Pro ships with a spend cap switched on, so quota overages are refused rather than billed until you turn the cap off. Point-in-time recovery costs $100 a month per 7 days of retention, and preview branches bill at $0.01344 per branch per hour.

Team costs from $599 a month. It keeps the Pro usage quotas but adds SOC 2 and ISO 27001 reports, 14-day backups, 28-day log retention and HIPAA as a paid add-on. Enterprise is custom.

The paused-project problem, and how to resume one

Supabase's docs say a free project with too little database activity over 7 days is paused, and the owner gets a warning email around a week ahead. Once paused, the API stops answering, so a demo link shared with an investor simply fails. Recovery is manual: open the project in the dashboard and press Resume. The current pausing guide gives a one-year window to bring a paused project back with its data and settings intact. An older changelog post said 90 days, so keep your own dump of anything that matters. Paid projects are never paused for inactivity, which is the cleanest reason to pay $25 once real users arrive.

Supabase vs Firebase for startups: SQL tables or Google's document model

Both sell a backend you do not have to run, in very different shapes. Supabase gives you one relational postgres database where joins, foreign keys, views and SQL reports work out of the box. Firebase's main store, Cloud Firestore, keeps documents in collections and bills per read, write and delete; Google's SQL Connect puts managed Cloud SQL for PostgreSQL behind GraphQL; Spark projects get one three-month trial instance, then it needs Blaze, from about $9.37 a month.

On supabase vs firebase pricing, the difference is predictability. One Pro project on the default Micro instance costs $25 a month, and the spend cap blocks quota overages (compute upgrades and add-ons still bill). Firebase has no fixed fee, but a chatty screen that re-reads hundreds of documents can multiply the bill as traffic grows. For a mobile-first consumer app that needs push and crash reports in one console, Firebase is still the faster route. For a SaaS product with relational data, admin dashboards and reporting, the case for supabase vs firebase for startups usually tips towards Supabase.

Wiring up Supabase Auth with Google login

In Google Cloud's Auth Platform, configure the consent screen, add the openid scope, and create an OAuth client of type Web application. Paste the callback URL shown on Supabase's Google provider page into Authorized redirect URIs, then copy the client ID and secret back into that provider page. In code, a custom button calls signInWithOAuth with provider set to google; Google's own button or One Tap passes its credential to signInWithIdToken instead. For server-rendered apps the docs recommend the PKCE flow with a callback route that exchanges the code for a session. One detail founders miss: without a custom domain, users see your project-id.supabase.co address on Google's consent screen, which looks untrustworthy. Custom domains are a $10 a month add-on.

A Supabase row level security tutorial in five lines of SQL

Row level security is what makes it safe to query the database straight from the browser with the public publishable key. Turn it on per table, then write a policy for each operation:

• alter table todos enable row level security;
• create policy "own rows" on todos for select to authenticated using ((select auth.uid()) = user_id);
• Add matching insert, update and delete policies; insert needs with check rather than using.
• Index the user_id column, because every query now filters on it.

Why does Supabase return empty data with RLS on? Because a table with RLS enabled and no matching policy gives the anon and authenticated roles zero rows, without an error. If a select comes back as an empty array, check that a select policy exists, that the user is actually signed in when the query runs, and that the role in the to clause matches. A permission error (code 42501) instead means a missing grant. The secret key bypasses RLS entirely, so it belongs only on a server.

Connecting to Next.js and the rest of the toolchain

The quickest route is npx create-next-app -e with-supabase, which ships cookie-based auth with the @supabase/ssr package. Copy the project URL and publishable key from the dashboard's Connect panel into NEXT_PUBLIC_SUPABASE_URL and NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY in .env.local, and the template's browser and server clients do the rest. Official client libraries also cover Flutter, Python, Swift, Kotlin and C#, with Go in alpha. The supabase cli runs the full stack locally and manages migrations, and supabase branching gives each pull request its own preview database. For AI features, the pgvector extension stores embeddings next to normal rows, so similarity search is a SQL query rather than a separate vector service. Lovable users meet Supabase indirectly: new Lovable projects run on Lovable Cloud, which is built on Supabase's open-source stack, and an existing Supabase project can be connected instead.

Supabase self hosting with Docker: what you take on

Because the stack is open source, you can run it on your own server. The self-hosting guide expects a Linux server with several gigabytes of RAM, more than one CPU core, SSD storage, Docker Compose and someone comfortable administering it. You clone the repository at a pinned tag, copy the docker folder, generate fresh keys with the bundled scripts, and start Studio, Postgres, Auth, PostgREST, Realtime, Storage, the Edge Runtime and the Supavisor pooler. You also inherit chores the hosted plan handles: an HTTPS reverse proxy, your own SMTP for auth emails, S3 for file storage, upgrades and backups. A cheap VPS beats $25 a month only if someone owns that work.

Is it production ready, and where does Indian data sit?

Supabase encrypts data with AES-256 at rest and TLS in transit, holds SOC 2 Type 2 and ISO 27001, and will sign a HIPAA BAA, though the reports and BAA are only for Team and Enterprise customers. A public status page shows uptime by region and component. Projects can be created in South Asia (Mumbai), ap-south-1, one of 17 specific AWS regions, which cuts latency for Indian users and keeps the primary database in India; the docs add that picking a region is a location control, not a compliance certificate. The privacy notice says Supabase processes project data on your instructions, while questions typed into its AI support tools are kept to improve the service. Support means Discord plus dashboard tickets, with priority email support and SLAs on Team.

Weak points are real. Free projects have no backups. Connection limits on small instances are tight (60 direct connections on Micro). There is no rupee billing or UPI. And security sits with you: a table left without RLS is readable by anyone holding the public key.

Who gets the most from Supabase, and the alternatives worth pricing

Supabase suits SQL-literate founders, agencies building client dashboards, and AI-app builders who want auth, data and vectors in one place. Mobile-heavy teams may prefer Firebase. Appwrite is the closest open-source rival with a similar feature list, Neon offers serverless Postgres alone if you bring your own auth, and PocketBase packs a small backend into one binary for internal tools. A sensible first week: create a free project in the Mumbai region, enable RLS on every table before writing any frontend code, connect Google login, then move to Pro before your first paying customer so the project never pauses.