TL;DR: Supabase is an open-source alternative to Firebase built on PostgreSQL. You get Auth, Realtime, Storage, Edge Functions, and Row Level Security — all out of the box. And yes, you can self-host it.

If you've ever worked with Firebase, you know the feeling: everything's great at first, but at some point you realize you're locked into a proprietary ecosystem. That's exactly where Supabase comes in. Let's take a look at what it brings to the table.

What is Supabase anyway? 🤔

Supabase is an open-source platform that gives you a complete backend — built on PostgreSQL. Instead of a proprietary NoSQL database (like Firestore), you get a real relational database with all the bells and whistles. The best part: you can export your data and migrate anywhere, anytime. No vendor lock-in.

At its core, Supabase consists of several open-source tools that together form a powerful backend:

• PostgreSQL — The database that holds everything together
• GoTrue — Authentication server
• PostgREST — Automatic REST API from your DB schema
• Realtime — WebSocket server for live updates
• Storage — S3-compatible file storage
• Edge Functions — Serverless functions powered by Deno

Supabase | The Postgres Development Platform

Start your project with a Postgres database, Authentication, instant APIs, Edge Functions, Realtime subscriptions, Storage, and Vector embeddings.

Supabase

PostgreSQL under the hood 🐘

The heart of Supabase is PostgreSQL — and that's no accident. Postgres is one of the most powerful open-source databases out there. You get:

• Real SQL queries instead of proprietary query languages
• Foreign keys, joins, views, stored procedures
• Extensions like pgvector for AI/embedding search
• Full-text search directly in the database
• JSON/JSONB columns when you want schemaless flexibility

The Supabase dashboard even gives you a SQL editor where you can run queries directly. No extra tools needed.

Client Setup 🛠️

Before we dive into the individual features, let's set up the client. It's incredibly quick:

import { createClient } from '@supabase/supabase-js'

const supabaseUrl = 'https://your-project.supabase.co'
const supabaseKey = 'your-anon-key'

const supabase = createClient(supabaseUrl, supabaseKey)

That's it. Seriously. One import, two variables, one function call. From here on, you can access everything through the supabase client.

Warum du nur noch TypeScript nutzen solltest ☝️

TypeScript bringt Typsicherheit in deine JavaScript-Projekte.

disane.dev

CRUD Operations 📝

The Supabase client library makes CRUD operations a breeze. Here are some examples:

// Read data
const { data: posts, error } = await supabase
  .from('posts')
  .select('id, title, content, created_at')
  .order('created_at', { ascending: false })
  .limit(10)

// Read a single record
const { data: post } = await supabase
  .from('posts')
  .select('*')
  .eq('id', 42)
  .single()

// Create a new record
const { data: newPost, error: insertError } = await supabase
  .from('posts')
  .insert({
    title: 'My first post',
    content: 'Hello World!',
    author_id: user.id
  })
  .select()
  .single()

// Update a record
const { data: updated } = await supabase
  .from('posts')
  .update({ title: 'Updated Title' })
  .eq('id', 42)
  .select()
  .single()

// Delete a record
const { error: deleteError } = await supabase
  .from('posts')
  .delete()
  .eq('id', 42)

The beauty of it: the API is chainable and type-safe (when using generated types). No more string-based query building.

REST-APIs verstehen und nutzen

Eine umfassende Einführung in REST-APIs und wie du sie in deinen Projekten einsetzt.

disane.dev

Authentication 🔐

Supabase comes with a complete auth system. Email/password, magic links, OAuth with Google, GitHub, Apple, and many more — all built in.

// Sign up
const { data, error } = await supabase.auth.signUp({
  email: '[email protected]',
  password: 'secure-password-123'
})

// Sign in
const { data: session, error: loginError } = await supabase.auth.signInWithPassword({
  email: '[email protected]',
  password: 'secure-password-123'
})

// OAuth login (e.g. GitHub)
const { data: oauthData, error: oauthError } = await supabase.auth.signInWithOAuth({
  provider: 'github',
  options: {
    redirectTo: 'https://your-app.com/callback'
  }
})

// Get current user
const { data: { user } } = await supabase.auth.getUser()

// Sign out
await supabase.auth.signOut()

The auth system integrates seamlessly with Row Level Security (more on that in a moment). This means your database automatically knows who's currently logged in.

Supabase Documentation

Learn how to get started with Supabase - the open source Firebase alternative.

Supabase

Realtime Subscriptions ⚡

One of the coolest features of Supabase: Realtime. You can subscribe to changes in your database and receive updates pushed via WebSocket.

// Listen to all changes in the posts table
const channel = supabase
  .channel('posts-changes')
  .on(
    'postgres_changes',
    {
      event: '*',  // INSERT, UPDATE, DELETE
      schema: 'public',
      table: 'posts'
    },
    (payload) => {
      console.log('Change detected:', payload.eventType)
      console.log('New data:', payload.new)
      console.log('Old data:', payload.old)
    }
  )
  .subscribe()

// Listen only to INSERTs in a specific table
const insertsChannel = supabase
  .channel('new-messages')
  .on(
    'postgres_changes',
    {
      event: 'INSERT',
      schema: 'public',
      table: 'messages',
      filter: 'room_id=eq.42'
    },
    (payload) => {
      console.log('New message:', payload.new)
    }
  )
  .subscribe()

// Unsubscribe from channel
supabase.removeChannel(channel)

With this, you can build real-time features like chat, live dashboards, or collaborative editing — without setting up a separate WebSocket server.

Storage 📦

Need to upload files? No problem. Supabase Storage is an S3-compatible file store with fine-grained access control.

// Upload a file
const { data, error } = await supabase.storage
  .from('avatars')
  .upload('user-123/profile.png', file, {
    cacheControl: '3600',
    upsert: true
  })

// Generate a public URL
const { data: urlData } = supabase.storage
  .from('avatars')
  .getPublicUrl('user-123/profile.png')

// Signed URL for private files
const { data: signedUrl } = await supabase.storage
  .from('private-docs')
  .createSignedUrl('report.pdf', 3600) // valid for 1 hour

Edge Functions 🌍

Sometimes you need server-side logic that shouldn't run directly in the database. That's what Edge Functions are for — serverless functions running on Deno, deployed globally.

// supabase/functions/send-welcome-email/index.ts
import { serve } from 'https://deno.land/[email protected]/http/server.ts'
import { createClient } from 'https://esm.sh/@supabase/supabase-js@2'

serve(async (req) => {
  const { email, name } = await req.json()

  // Supabase client with service role key
  const supabase = createClient(
    Deno.env.get('SUPABASE_URL')!,
    Deno.env.get('SUPABASE_SERVICE_ROLE_KEY')!
  )

  // Send email, write log, etc.
  const { error } = await supabase
    .from('email_log')
    .insert({ email, name, sent_at: new Date().toISOString() })

  return new Response(
    JSON.stringify({ success: !error }),
    { headers: { 'Content-Type': 'application/json' } }
  )
})

Edge Functions are perfect for webhooks, third-party integrations, or anything where you need server-side secrets.

Row Level Security (RLS) 🛡️

This is where it gets really exciting. Row Level Security is THE killer feature of Supabase. It lets you define directly in PostgreSQL who can see and modify which rows.

-- Enable RLS
ALTER TABLE posts ENABLE ROW LEVEL SECURITY;

-- Everyone can read published posts
CREATE POLICY "Public posts are visible"
  ON posts FOR SELECT
  USING (published = true);

-- Users can only update their own posts
CREATE POLICY "Users can update own posts"
  ON posts FOR UPDATE
  USING (auth.uid() = author_id)
  WITH CHECK (auth.uid() = author_id);

-- Users can only create their own posts
CREATE POLICY "Users can create posts"
  ON posts FOR INSERT
  WITH CHECK (auth.uid() = author_id);

-- Users can only delete their own posts
CREATE POLICY "Users can delete own posts"
  ON posts FOR DELETE
  USING (auth.uid() = author_id);

The brilliant part: these policies apply always — whether you access data through the REST API, the client, or directly via SQL. Security is enforced at the database layer, not in your application logic. This is a fundamental difference from Firebase Security Rules.

Self-Hosting with Docker 🐳

Want full control? No problem! Supabase can be completely self-hosted with Docker. The official repository provides a docker-compose.yml that lets you spin up the entire stack locally or on your own server.

# Clone the Supabase repository
git clone --depth 1 https://github.com/supabase/supabase
cd supabase/docker

# Configure environment variables
cp .env.example .env
# Edit .env as needed (secrets, ports, etc.)

# Start the stack
docker compose up -d

After that, you'll have the complete Supabase stack running: PostgreSQL, Auth, REST API, Realtime, Storage, and the Dashboard. Perfect for development, testing, or when you want to keep your data off the cloud.

Docker: Einfache Bereitstellung von Diensten 🚢

Docker revolutioniert die Bereitstellung von Anwendungen mit Containern.

disane.dev

Supabase vs. Firebase — The Comparison ⚔️

When should you use Supabase? 🎯

Supabase is particularly well-suited when you:

• Have relational data — meaning your data has relationships (and it usually does)
• Already know SQL or want to learn it — you work directly with PostgreSQL
• Want no vendor lock-in — you can migrate anytime
• Need self-hosting — GDPR, compliance, or simply control
• Love type safety — the generated TypeScript types are first-class
• Want to leverage existing PostgreSQL knowledge

Firebase, on the other hand, might be the better choice if you have a very simple project, are deep in the Google ecosystem, or prefer NoSQL data models.

NestJS: Server-Framework auf Steroide 🎉

NestJS bringt Struktur und Architektur in deine Node.js-Backend-Entwicklung.

disane.dev

Conclusion 🚀

Supabase has quickly become a serious alternative to Firebase — and in many areas, it's actually superior. The combination of PostgreSQL, built-in auth, Realtime, Storage, and Edge Functions gives you a complete backend without tying you to any single vendor.

Next time you start a new project and need a backend, give Supabase a shot. You'll be surprised how quickly you become productive.

Happy Coding! ✌️