Supabase
Supabase is an open-source backend platform built around a standard PostgreSQL database, adding authentication, file storage, auto-generated APIs and serverless functions on top of it. It is commonly described as an open alternative to Firebase, with the important difference that the underlying database is ordinary Postgres.
What you get
A Supabase project is a hosted PostgreSQL instance plus a set of services wired to it:
- A REST API generated from your schema. Create a table and it is immediately queryable over HTTP, with filtering and pagination, through the PostgREST layer.
- Auth — email and password, magic links, and OAuth providers, with users stored in the database and issued JWTs.
- Storage for files, with the same permission model as the tables.
- Realtime subscriptions that push row changes to connected clients over websockets.
- Edge functions for server-side logic you do not want in the browser.
Because it is real Postgres, you can connect any SQL client, run migrations with standard tooling, and take a normal pg_dump with you if you leave. That portability is the main argument for choosing it over a proprietary document store.
Row Level Security is the whole security model
Supabase clients talk to the database from the browser using a publishable anon key. That key is meant to be public — it is in your JavaScript, and anyone can read it. What stops a visitor reading every row is Row Level Security: policies written in SQL on each table that decide which rows a given authenticated user may select, insert, update or delete.
The misconception here is expensive. Tables are unprotected until you enable RLS and write policies, and a project that ships with RLS disabled has effectively published its database. Nor does the service role key belong in client code; it bypasses every policy and must stay server-side.
How NorthernGo uses it
Every generated app gets a Supabase PostgreSQL database hosted in the EU. App code reaches it through a small wrapper — window.NorthernGoDB.save(collection, data), .get(collection) and .delete(collection, field, value), plus .login(), .register() and .deleteAccount() — rather than through SQL. There is no raw SQL access and no realtime subscription from app code. On published PWAs, save/delete without a network are queued in the SDK and get() can show the last synced list plus pending rows; login still needs a connection. The Supabase guide covers the details.
Frequently asked questions
Is it safe to put the Supabase anon key in client-side code?
Yes, the anon key is designed to be public and identifies the project rather than granting privileges. What actually protects your data is Row Level Security policies on every table. The service role key is the opposite: it bypasses all policies and must never appear in client code.
Build it yourself
NorthernGo turns a plain-text description into a working web app with a database, login and a live URL. Local AI generation runs on your own GPU, is unlimited, and is free on every plan.