How to Use Supabase

Supabase is an open-source Firebase alternative built on real Postgres — one project gets you a relational database, authentication, file storage, and an auto-generated API.

Step 1: Create a project

Pick a region and set a database password. Supabase provisions a dedicated Postgres instance behind the scenes — this isn't a proprietary database, it's Postgres you could connect to directly.

Step 2: Design your schema

Create tables visually in the spreadsheet-like Table Editor, or write SQL directly in the SQL Editor if you'd rather define things by hand.

Step 3: Turn on Row Level Security

Supabase auto-generates a REST API for every table via PostgREST. Row Level Security (RLS) policies are what actually control which rows a given user can read or write — without RLS enabled, a table is effectively public to anyone with your project's anon key.

Step 4: Add authentication

Enable email/password or an OAuth provider under Authentication, then call the client library's supabase.auth methods from your app to sign users up and log them in.

Step 5: Query from your app

The client library queries tables directly — supabase.from('table').select() — without you hand-writing a backend API layer in between.

Where it bites

Forgetting to enable RLS, or writing an overly permissive policy, is the single most common way Supabase projects accidentally expose data. Since the anon key ships in your client-side code by design, RLS is your only real access control — not an optional hardening step.