DOCSEARCHbyAlgolia
Submit Docs

Supabase Documentation

website·Indexed 30 days ago

https://docs-supabase.vercel.app/docs

Technical documentation for Supabase, featuring JavaScript API references for file and vector buckets, analytics, and authentication. Includes comprehensive guides for configuring Single Sign-On (SSO) with providers like Okta, Azure, and Google Workspace, as well as details on IdP-initiated and SP-initiated sign-in flows.

Tokens
1.4M
Snippets
8.2K
Records
11.5K
Agent score
74%

What's inside Supabase

  1. Overview of Multi-Factor Authentication (MFA) in Supabase Swift

    Multi-Factor Authentication (MFA) methods in the Supabase Swift client are accessed via the supabase.auth.mfa namespace. The primary stable second factor is TOTP (time-based one-time password). Users can enroll up to 10 TOTP factors, which is recommended as a strategy for recovery instead of using recovery codes, which are not supported.

    WebAuthn/Passkey as a second factor is currently experimental. To use it, you must opt in by importing the experimental SPI.

    @_spi(Experimental) import Supabase

  2. Overview of Supabase Analytics self-hosting

    The Supabase Analytics server is a self-hostable Logflare instance that manages ingestion and query pipelines for structured analytics events. It integrates with Supabase Studio to provide a logging experience similar to the Supabase Platform. It supports two primary deployment scenarios: local development via the Supabase CLI and full-stack self-hosting using Docker Compose.

  4. Overview of Supabase Authentication and Authorization

    Supabase Auth provides client SDKs and API endpoints to manage user identity and access control.

    • Authentication: Verifies the identity of a user. Supabase Auth uses JSON Web Tokens (JWTs) for this purpose.
    • Authorization: Determines which resources a user can access. Supabase integrates Auth with Postgres Row Level Security (RLS) to handle authorization on a row-by-row basis.

    Supported authentication methods include passwords, magic links, one-time passwords (OTP), social login, and single sign-on (SSO).

  5. Overview of Supabase Reports observability

    Supabase Reports provide monitoring dashboards for projects hosted on the Supabase Cloud platform (not available for self-hosted instances). These reports offer self-debugging tools and actionable insights for the following systems:

    • Database
    • Auth
    • Storage
    • Realtime
    • API systems

  6. Overview of Supabase Realtime Architecture

    Supabase Realtime is an Elixir server built on the Phoenix Framework that listens to Postgres database changes via logical replication and broadcasts them to clients via WebSockets. It is available in two versions:

    1. Realtime: Listens to Postgres logical decoding, converts the byte stream to JSON, and broadcasts to all connected clients.
    2. Realtime RLS: Uses logical decoding with the wal2json output plugin. It passes changes to the WALRUS (Write Ahead Log Realtime Unified Security) Postgres function to determine authorized subscribers based on Row Level Security (RLS) policies before broadcasting JSON changes to those specific subscribers.

  7. Overview of Supabase Auth OAuth 2.1 Grant Types

    Supabase Auth implements OAuth 2.1 with OpenID Connect (OIDC) to allow third-party client applications to authenticate with a Supabase project. It supports two specific grant types:

    1. Authorization Code with PKCE (authorization_code): Used to obtain initial access tokens. This is the recommended flow for all client types, including SPAs, mobile apps, and server-side applications.
    2. Refresh Token (refresh_token): Used to obtain new access tokens without requiring the user to re-authenticate.

    Note: client_credentials and password grant types are not supported. These flows require custom implementation and are not available via the @supabase/supabase-js library, as that library is intended for authenticating with Supabase, not for building an OAuth server.

  8. Overview of Supabase OAuth Admin API

    The OAuth Admin API provides programmatic management of OAuth clients. This API is only applicable when the OAuth 2.1 server is enabled within Supabase Auth. Because these operations require a secret key, they must be executed exclusively on the server side to prevent security leaks; never expose the secret key in a browser environment.

  9. Overview of Supabase Temporary Access

    Temporary access allows users to connect to the Postgres database and Supavisor (Connection Pooler) using a Supabase API token (Personal Access Token) or a dashboard session token (JWT). This is useful for short-lived access or for services like GitHub Actions where sharing a static Postgres password is undesirable.

    Prerequisites:

    • SSL enforcement on incoming connections must be enabled.
    • The project must be running Postgres version 17.6.1.081 or higher.

    Important Notes:

    • Temporary access is disabled by default.
    • It only applies to Postgres and Supavisor connections; HTTP APIs (PostgREST, Storage, Auth) remain independent.
    • It is not compatible with the IPv6 Transaction pooler (PgBouncer).

  11. Overview of Supabase Vector Indexes

    Vector indexes organize embeddings within a bucket using consistent dimensions and distance metrics to enable similarity searches. An index is defined by four key properties: a unique Index Name, the Dimension (size of the vector embeddings), the Distance Metric (the method for calculating similarity), and the Data Type (currently only float32 is supported). Note that this feature is in alpha and may undergo breaking changes.

  12. Overview of Supabase Auth Server (GoTrue)

    The Supabase Auth Server, known as GoTrue, is an open-source, Golang-based JSON Web Token (JWT) API used for managing user registration and authentication in JAM projects. It is based on OAuth2 and JWT, handling user signup, authentication, and custom user data.