Supabase and backend-as-a-service

📘What it really is

• Supabase provides a managed PostgreSQL database plus:
• authentication (email, phone, Google and others, passkeys);
• an automatic REST and real-time API over your tables;
• file storage;

• edge functions for server code.

• Its frontend library can query tables directly from the browser: supabase.from("enquiries").select("*").eq("status", "new"). This is safe only because of row-level security (Module 60): every table must have RLS enabled with policies based on the signed-in user, such as auth.uid() = owner_id.

• The main risk: a table without RLS (or with a policy that's too broad) is readable, or writable, by anyone with your public key, which is in your frontend. Supabase warns about this; check every table.

• The service role key bypasses RLS: it's for trusted server code only, never the frontend.

• When it fits: small teams, quick launches, apps that are mostly CRUD with sign-in. You still own the schema, policies, backups and testing. Similar services: Firebase (a NoSQL document database), Appwrite, PocketBase.

• You can also use Supabase simply as a managed PostgreSQL behind your own API (as in Module 60), using its connection string.