# Supabase Authentication: A Comprehensive Guide for Your MVP

[Marek Cermak](https://www.strv.com/blog/authors/marekcermak)  
Go Platform Engineering Manager

---

Consider a rather common scenario: you have a mobile app with a backend API that offers basic user management. You need some endpoints hidden behind authentication, such as listing a user's private information. It's crucial that other users cannot access these resources. So, for that, you need the user to register and send an authenticated and authorized request to the backend.

You can either implement the authentication yourself (*not* recommended) or use an authentication provider. And there are various authentication providers: Auth0 is recognized for its top security (but also top pricing); Firebase Authentication is often treated as the go-to solution when starting a project from scratch (which is the case for us so far). Or there is the Firebase alternative — [Supabase](https://supabase.com/).

When evaluating Supabase Authentication compared to Firebase Authentication, one key differentiator is that Supabase uses a PostgreSQL database while Firebase keeps your authentication records hidden from you, accessible only via API or SDK. Supabase Auth stores authentication records in a separate auth schema within PostgreSQL. This gives you full control over your auth records and allows you to use a familiar and powerful relational database for both your API and authentication needs.

In this guide, I’ll explain why Supabase Authentication might be a great choice for you. Especially if you’re building an MVP.

## Is Supabase a Safe Choice?

Among the first things that any startup has to resolve when it comes to the selection of technologies is whether the technology is (in no particular order):  
- Stable  
- Secure  
- Well-maintained  
- Well-documented  
- Ideally widely adopted  
- Suitable for the existing tech stack

For these reasons, a relatively new technology like Supabase might be susceptible to doubt when it comes to the above-mentioned concerns. But the stats tell a different story.

Supabase [has reached General Availability this year](https://supabase.com/ga) with over 1 million managed databases and over 2,500 new databases launched daily.

If you’re still feeling uncomfortable, 36% of the last [Y Combinator](https://www.ycombinator.com/) batch of companies used Supabase to launch their startup.

According to the [official statistics](https://supabase.com/ga), Supabase is currently in the Top 125 GitHub Ranking repos. Supabase’s rapidly growing open-source community proves an interest from the ranks of developers.

Companies like [Udio](https://www.udio.com/), [Krea](https://www.krea.ai/), [Humata](https://www.humata.ai/), [Chatbase](https://www.chatbase.co/?gad_source=1&gclid=Cj0KCQiA-5a9BhCBARIsACwMkJ77V96Rme1qEYbEe1IIq-8vX9TqNghv1eHQX4HKWRq5deNjjYa9BqwaAkjTEALw_wcB), [Pika](https://pika.art/login), [Quivr](https://www.quivr.com/), [Mendable](https://www.mendable.ai/), [Markprompt](https://www.markprompt.com/) and [MDN search by Mozilla](https://developer.mozilla.org/) have all started on Supabase.

That all leads me to the conclusion that with its launch of GA, developers supporting its development and the proven track record of companies that managed to effectively scale using this technology, Supabase is a valid choice for your startup. In the following text, we’ll focus on Supabase’s core offering — **Supabase Authentication**.

## Authentication Setup

To onboard some users to your app, you first have to let them register. Since your backend likely contains a user domain entity, you may have to create a user record in your database upon registration. Supabase offers multiple ways to achieve this, depending on your setup. Let’s first review the common steps.

The common initial setup steps include:  
1. **Set Up Supabase**: Sign up on the [Supabase website](https://supabase.com/) and create a new project. Access the dashboard to manage your database and authentication settings. You’re good to go in a couple of minutes.  
2. **Configure Authentication**: Supabase supports various methods, including email/password and OAuth providers (Google, GitHub). Configure these in the Auth section of the dashboard.  
3. **Create a User Table**: In your database, create a table to store user info. You can reuse fields from the auth schema, such as email and phone. Supabase has a migration CLI, but you can use any tool you prefer, e.g., [tern](https://github.com/jackc/tern).

Now, the typical workflow with external auth providers like Supabase or Firebase involves the client (mobile/web) sending an authenticated request with a JWT token in the Authorization header to your backend. Your backend then parses, validates, and extracts user info (like user ID) from the JWT, maps it to your database user record, and resolves authorization based on roles or access rights. If successful, access is granted.

Validation of the Supabase-issued JWT is lightweight compared to Firebase’s ID token validation. Firebase requires specific libraries and more complex validation steps. Supabase generates an immutable signature key used to sign JWT tokens, so your backend can simply use this key for validation. This simplicity means your backend isn't dependent on third-party libraries; however, if you need to rotate the key, you must update your backend accordingly.

Once authentication is set, you need to create the user record in your database. This depends on your app's architecture and which primary database it uses.

## Option 1: Using Supabase as Your Backend Database

Supabase hosts PostgreSQL on AWS, offering a scalable, performant database. Unless you have specific needs (like advanced analytics), Supabase is likely a good fit. It also has a generous free tier, useful considering [database runtime costs on cloud providers](https://www.strv.com/blog/case-study-sizing-up-cloud-run-vs-heroku).

Assuming you use Supabase as your backend, the setup is straightforward. You don’t even need your backend to know about Supabase specifics.

First, create a function to create a new user record:  

```sql
CREATE OR REPLACE FUNCTION create_user() RETURNS trigger
LANGUAGE plpgsql AS
$$
BEGIN
  INSERT INTO public.users(id, auth_id, created_at, updated_at)
  VALUES (gen_random_uuid(), new.id, new.created_at, new.updated_at);
  RETURN new;
END;
$$;
```

Then, set up a trigger on the `auth.users` table to execute this function after insert:  

```sql
CREATE OR REPLACE TRIGGER after_user_signup_trigger
AFTER INSERT ON auth.users
FOR EACH ROW
EXECUTE FUNCTION create_user();
```

The flow: when a new auth record is inserted, the trigger creates a corresponding user record in your custom `users` table.

## Option 2: Using a Different Database

If you need another database (e.g., TimescaleDB for time-series or MongoDB), the setup differs. While you can use Supabase Edge functions as webhooks for auth events, I recommend sticking with client-server communication to avoid edge case issues (this applies to Option 1 too).

You split sign-in and sign-up into two steps:  
1. User registers in Supabase and obtains a signed JWT token.  
2. Your backend registers the user using this token.

The process is often made idempotent*: the client calls sign-up regardless of existing registration; the backend checks if the user exists and skips creation if so. The backend can also send back info indicating whether a new user was created, aiding UX.

*Idempotent means multiple calls produce the same effect as one.

## Phone and Email Verification

A tip to save time: with Option 1, you can simplify backend logic using Supabase’s default phone and email verification, which occurs automatically when updating user fields via SDK.

This requires connecting to an SMS provider like [Twilio](https://twilio.com/en-us), [Vonage](https://www.vonage.com/), [MessageBird](https://bird.com/en-us/), etc. Once connected, Supabase handles verification during authentication and phone/email updates.

Similarly, connect an SMTP server for emails—popular options include [SendGrid](https://sendgrid.com/en-us) and [Resend](https://resend.com/docs/send-with-smtp). SendGrid offers richer features; Resend is more developer-friendly.

On the backend, referencing Supabase’s auth schema directly ensures verified phone/email are always available without duplicating fields.

## Bonus: Authentication Hooks

While still in BETA, [Authentication Hooks](https://supabase.com/docs/guides/auth/auth-hooks#using-hooks) can be a powerful addition. They allow custom claims, dynamic email/SMS content, and other custom logic. Since Supabase relies on PostgreSQL, hooks can be SQL functions or HTTP callbacks, offering flexible customization.

## Conclusion

Supabase is a great alternative to Firebase—often superior in many ways. Its core products, Authentication and Database, are mature, scalable, and actively used by many companies. It’s suitable for small MVPs and scalable for larger projects. Native PostgreSQL support is especially useful for minimal products, and features like phone/email verification or auth hooks can speed up development and reduce engineering load.

## FAQs

### I can’t decide whether to use Firebase or Supabase for Authentication. What do I do?

Decide based on your current setup. If you already use Firebase, stick with it unless you’re experimenting. If you plan to leverage other Supabase products, consider giving it a try.

### Can I use Supabase as my backend database without using Supabase Authentication?

Yes. You can benefit from the database's capabilities without activating the auth service.

### Can I migrate from Firebase to Supabase? How hard is it?

Yes, Supabase offers tools for migration from Firebase Auth and Firestore. Migrations can be complex—assess the specifics of your environment carefully.

### I am already using Firebase Authentication. Should I migrate to Supabase Authentication?

It depends on your needs. Evaluate the benefits versus migration effort.

### What if I decide to drop Supabase in the future?

If you’re not relying on the auth schema described in Option 1, migration to another PostgreSQL-based system is straightforward since Supabase uses native PostgreSQL.

---

Don't miss anything