{"post":{"slug":"how-to-set-up-supabase-2026","title":"How to set up Supabase in 2026","excerpt":"Supabase is a Postgres-backed BaaS with auth, storage, and realtime built in. This guide covers project setup, Row Level Security, and the JS client in 2026.","category":"code","date":"April 18, 2026","author":"ByteLedger Team","content":"<span class=\"dropcap\">S</span>upabase is the fastest way to get a production Postgres database with auth, file storage, and realtime — without managing infrastructure. In 2026, the platform has matured considerably: the CLI handles migrations, the JS client is on v3, and type generation is first-class. This guide covers project setup through production-ready patterns.\n\n## What changed in 2026\n\n- **supabase-js v3** drops the legacy `GoTrueClient` in favour of a unified `SupabaseClient`; session refresh is automatic.\n- **Supabase CLI v2** handles local dev with Docker Compose, migrations, seeding, and type generation in one tool.\n- **Edge Functions are GA** — Deno-based serverless functions co-located with your project; useful for webhooks and server-side auth flows.\n- **pgvector is built-in** — every Supabase project ships with the pgvector extension available; enable it with one SQL command.\n\n## Project and CLI setup\n\n```bash\nnpm install -g supabase\nsupabase login\nsupabase init   # creates supabase/ directory\nsupabase start  # spins up local Postgres + Auth + Studio\n```\n\n`supabase start` pulls Docker images the first time (~1 min). After that it's fast. You get a local API URL and `anon` key printed to stdout.\n\nInstall the client library:\n\n```bash\nnpm install @supabase/supabase-js\n```\n\nInitialize:\n\n```js\nimport { createClient } from '@supabase/supabase-js';\n\nexport const supabase = createClient(\n  process.env.SUPABASE_URL,\n  process.env.SUPABASE_ANON_KEY,\n);\n```\n\n## Creating a table with RLS\n\n```sql\n-- supabase/migrations/20260601_create_notes.sql\ncreate table notes (\n  id uuid primary key default gen_random_uuid(),\n  user_id uuid references auth.users not null,\n  body text not null,\n  created_at timestamptz default now()\n);\n\nalter table notes enable row level security;\n\ncreate policy \"Users can manage their own notes\"\n  on notes\n  for all\n  using (auth.uid() = user_id)\n  with check (auth.uid() = user_id);\n```\n\nApply locally: `supabase db push`. Apply to remote: `supabase db push --db-url <remote-connection-string>`.\n\n## Querying with the typed client\n\nGenerate types:\n\n```bash\nsupabase gen types typescript --local > src/database.types.ts\n```\n\nUse them:\n\n```ts\nimport { createClient } from '@supabase/supabase-js';\nimport type { Database } from './database.types';\n\nconst supabase = createClient<Database>(url, anonKey);\n\n// Fully typed: data is Note[]\nconst { data, error } = await supabase\n  .from('notes')\n  .select('id, body, created_at')\n  .order('created_at', { ascending: false });\n```\n\nTypeScript errors at compile time if you reference a column that doesn't exist.\n\n## Authentication\n\n```js\n// Sign up\nconst { data, error } = await supabase.auth.signUp({\n  email: 'user@example.com',\n  password: 'secure-password',\n});\n\n// Sign in\nconst { data: session } = await supabase.auth.signInWithPassword({\n  email: 'user@example.com',\n  password: 'secure-password',\n});\n\n// OAuth (Google, GitHub, etc.)\nawait supabase.auth.signInWithOAuth({ provider: 'github' });\n```\n\nThe client stores and auto-refreshes the JWT in `localStorage` (browser) or memory (Node).\n\n## Feature comparison\n\n| Feature | Supabase | Firebase |\n|---|---|---|\n| Database | Postgres (full SQL) | Firestore (NoSQL) |\n| Auth providers | 20+ OAuth + email/SMS | 10+ OAuth + email/SMS |\n| Realtime | Postgres changes (CDC) | Firestore listeners |\n| Storage | S3-compatible | GCS-backed |\n| Functions | Deno Edge Functions | Cloud Functions (Node) |\n| Type gen | Built-in CLI | Manual or community tools |\n| Self-host | Yes (Docker) | No |\n\n## How to start\n\n1. Create a project at [supabase.com](https://supabase.com) — free tier is generous for dev.\n2. `supabase init` and `supabase link --project-ref <ref>` to connect CLI to the remote.\n3. Write migrations in `supabase/migrations/`. Enable RLS on every table.\n4. `supabase gen types typescript` after each schema change.\n5. Use `SUPABASE_ANON_KEY` client-side; `SUPABASE_SERVICE_ROLE_KEY` only in server code.\n\n## Common mistakes\n\n**Forgetting to enable RLS.** New tables are open to all authenticated users by default. Enable RLS immediately and write policies before you expose the table.\n\n**Using the service-role key in the browser.** It bypasses every RLS policy. Keep it strictly server-side.\n\n**Direct schema edits in the dashboard.** Any changes not in a migration file will be overwritten on the next `db push`. Always use migrations.\n\n**Not handling `error` from queries.** Supabase returns `{ data, error }` — check `error !== null` before using `data`.\n\n## What to skip\n\n- **Custom auth from scratch** — Supabase Auth handles email, magic links, OAuth, and SMS OTP. Use it.\n- **Building your own realtime layer** — Supabase Realtime exposes Postgres change streams; subscribe to `supabase.channel()`.\n- **Fetching entire tables** — always use `.select()` with explicit columns and add `.limit()` to avoid expensive full scans.\n\n## FAQ\n\n**Is Supabase free to start?**\nThe free tier includes 500 MB database, 1 GB storage, and 50,000 monthly active users. Paid plans start at ~$25/mo.\n\n**Can I run Supabase self-hosted?**\nYes — the full stack is open source on GitHub. The CLI's `supabase start` is effectively a local self-hosted instance.\n\n**How do I run migrations in CI/CD?**\nUse `supabase db push --db-url $PROD_DB_URL` in your pipeline, or integrate with GitHub Actions using the official action.\n\n**Does Supabase support full-text search?**\nYes — use Postgres `tsvector` and `tsquery` natively, or enable the `pg_trgm` extension for fuzzy search. See [how to add full-text search in 2026](/blog/how-to-add-full-text-search-2026).\n\n## Where to go next\n\n- [How to set up Firebase in 2026](/blog/how-to-set-up-firebase-2026)\n- [How to add authentication to an app in 2026](/blog/how-to-add-authentication-to-an-app-2026)\n- [How to write a database migration in 2026](/blog/how-to-write-a-database-migration-2026)","hue":308,"metaTitle":"How to Set Up Supabase in 2026 (Auth, RLS, Types)","metaDescription":"Set up Supabase in 2026 with the CLI, supabase-js v3, Row Level Security, TypeScript types, and migrations. Production-ready patterns from day one.","keywords":["how to set up supabase 2026","supabase tutorial 2026","supabase row level security","supabase js v3","supabase typescript types","supabase cli migrations","supabase auth setup","supabase postgres 2026","supabase realtime","supabase rls policies"],"tldr":["**Enable Row Level Security (RLS) on every table before it goes public** — Supabase exposes tables via a REST API; without RLS, any authenticated user can read everything.","**Use the `supabase-js` v3 client** — it ships with auto-refreshing sessions, typed query builders, and realtime subscriptions out of the box.","**Generate TypeScript types from your schema** — `supabase gen types typescript` gives you fully typed query results with zero manual work.","**Migrations go in `supabase/migrations/`** — use the Supabase CLI to create and apply SQL migrations; never edit the cloud schema by hand.","**Skip:** using the service-role key client-side — it bypasses RLS entirely; it belongs only in server-side code with tight access controls."],"readTime":"4 min read","wordCount":848},"related":[{"slug":"how-to-set-up-a-database-2026","title":"How to set up a database in 2026: the practical guide","excerpt":"Choosing and setting up a database is the first real architecture decision in any new project. Here is the 2026-correct path without wasted effort.","category":"code","date":"April 3, 2026","author":"ByteLedger Team","readTime":"5 min read","hue":321},{"slug":"how-to-set-up-firebase-2026","title":"How to set up Firebase in 2026","excerpt":"Firebase in 2026 means Modular SDK v10+, Firestore Security Rules, and App Check. This guide covers project init, Firestore, Auth, and production hardening.","category":"code","date":"February 26, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":309},{"slug":"neon-vs-supabase-2026","title":"Neon vs Supabase in 2026: Postgres-as-a-service compared","excerpt":"Branching, edge compatibility, pricing, and DX — the honest 2026 comparison of Neon and Supabase, with the project type each one wins.","category":"code","date":"February 9, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":180}],"sameCategory":[{"slug":"bazel-build-explained-2026","title":"Bazel Explained: What Hermetic Builds Actually Cost","excerpt":"Bazel delivers reproducible, precisely cached builds and demands that you describe everything. Here is what you get, what it costs, and who should say no.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":145},{"slug":"graphql-federation-2026","title":"GraphQL Federation: One Graph, Many Teams","excerpt":"Federation composes independently-owned subgraphs into a single API. Here is what it solves, the operational cost it adds, and when a simpler gateway is enough.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":300},{"slug":"hermetic-builds-explained-2026","title":"Hermetic Builds Explained: Same Inputs, Same Output","excerpt":"A hermetic build depends only on declared inputs. Here is what that property gives you, the common leaks that break it, and how to move toward it incrementally.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":130},{"slug":"monorepo-tooling-compared-2026","title":"Monorepo Tooling Compared: What You Actually Need","excerpt":"Monorepo tools solve task orchestration and caching, not repository layout. Here is what each tier provides and how to tell when you have outgrown the simple option.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":150}],"newer":{"slug":"how-to-set-up-redis-caching-2026","title":"How to set up Redis caching in 2026","excerpt":"Redis caching cuts database load and API latency dramatically. This guide covers cache-aside, TTL strategy, invalidation, and Upstash for serverless in 2026.","category":"code","date":"April 18, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":312},"older":{"slug":"how-to-set-up-time-machine-2026","title":"How to set up Time Machine in 2026: backup your Mac the right way","excerpt":"Time Machine is the easiest reliable Mac backup system available, and most people never configure it properly. Here is how to set it up and actually trust it in 2026.","category":"tech","date":"April 18, 2026","author":"ByteLedger Team","readTime":"5 min read","hue":246}}