# Supabase

> Supabase is an open-source backend platform built around a standard PostgreSQL database, adding authentication, file storage, auto-generated APIs and…

Source: https://northerngo.com/glossary/supabase/
Language: en
Updated: 2026-08-28

---
**Supabase is an open-source backend platform built around a standard PostgreSQL database, adding authentication, file storage, auto-generated APIs and serverless functions on top of it. It is commonly described as an open alternative to Firebase, with the important difference that the underlying database is ordinary Postgres.**

### What you get

A Supabase project is a hosted [PostgreSQL](/glossary/postgresql/) instance plus a set of services wired to it:

- **A REST API generated from your schema.** Create a table and it is immediately queryable over HTTP, with filtering and pagination, through the PostgREST layer.
- **Auth** — email and password, magic links, and OAuth providers, with users stored in the database and issued JWTs.
- **Storage** for files, with the same permission model as the tables.
- **Realtime** subscriptions that push row changes to connected clients over websockets.
- **Edge functions** for server-side logic you do not want in the browser.

Because it is real Postgres, you can connect any SQL client, run migrations with standard tooling, and take a normal `pg_dump` with you if you leave. That portability is the main argument for choosing it over a proprietary document store.

### Row Level Security is the whole security model

Supabase clients talk to the database from the browser using a publishable anon key. That key is meant to be public — it is in your JavaScript, and anyone can read it. What stops a visitor reading every row is Row Level Security: policies written in SQL on each table that decide which rows a given authenticated user may select, insert, update or delete.

The misconception here is expensive. Tables are unprotected until you enable RLS and write policies, and a project that ships with RLS disabled has effectively published its database. Nor does the service role key belong in client code; it bypasses every policy and must stay server-side.

### How NorthernGo uses it

Every generated app gets a Supabase PostgreSQL database hosted in the EU. App code reaches it through a small wrapper — `window.NorthernGoDB.save(collection, data)`, `.get(collection)` and `.delete(collection, field, value)`, plus `.login()`, `.register()` and `.deleteAccount()` — rather than through SQL. There is no raw SQL access and no realtime subscription from app code. On published PWAs, `save`/`delete` without a network are queued in the SDK and `get()` can show the last synced list plus pending rows; login still needs a connection. [The Supabase guide](/resources/connect-supabase/) covers the details.

---

NorthernGo is an AI-powered platform for building production-ready web apps with zero coding. Local AI generation via WebGPU is unlimited and free, and you own all generated source code. https://northerngo.com/