How to Use Supabase: The Beginner's Guide (First Project, First Table, Auth, and a Live App)

CodexFuse Team · 2026-10-29T16:50:10.955Z · 12 min read

Learn how to use Supabase step by step: create a free project, build your first table, turn on auth, lock it down with Row Level Security, add storage, and connect your app.

Learning how to use Supabase is the fastest way for a beginner to ship a real app backend — a Postgres database, user authentication, file storage, and live realtime updates — without writing a single line of server code. This Supabase tutorial for beginners follows the exact arc the official docs prescribe: sign up, create a free project, build your first table, turn on auth, lock it down with Row Level Security, add storage, and connect it all to your app. Two truths decide whether you learn it right the first time, and most older guides get both wrong: your publishable API key is public by design — Row Level Security is the lock, not the key — and free projects pause after a week of inactivity, so the pause rule belongs in your first five minutes, not an appendix.

What Is Supabase, Exactly?

Supabase is the open-source Postgres alternative to Firebase: a hosted backend that gives you a database, authentication, file storage, edge functions, and realtime subscriptions out of one dashboard. You click through a web UI instead of provisioning servers, and your app talks to everything through one client library.

Supabase describes itself as "open source from day one" — you can inspect the code, contribute to it, and self-host the whole stack, so you are never locked in and always in control (supabase.com homepage, checked October 29, 2026). That is the one-line difference from Firebase, which is Google's proprietary stack built around the NoSQL Firestore database.

Who is it for? Solo developers who want a backend today, startups that need auth and storage without a DevOps hire, and vibe-coders who let AI tools like Lovable generate the frontend while Supabase handles the data (the no-coder angle is documented in WhaleSync's 2026 no-coder Supabase guide). Row Level Security sits at the heart of Supabase security, and when you write your first policies, you can sanity-check them with CodexFuse's free Supabase RLS policy checker, which reviews pasted SQL for missing RLS, permissive policies, and auth risks without any live connection.

How Do You Use Supabase for the First Time?

Follow these seven steps in order — each one builds on the last, and skipping the security step is what breaks most beginners:

1. Create a free project. Sign up at supabase.com, open the dashboard, and create a new project with a name, a database password, and a region. Provisioning takes roughly 30 seconds (Supabase Next.js quickstart, supabase.com/docs).
2. Build your first table. Open the Table Editor, create a table, and add typed columns. Row Level Security is enabled by default on new tables — leave it on.
3. Turn on authentication. Enable the email provider (or an OAuth provider) in the Auth section. Every request Supabase receives is mapped to an anon role (signed out) or an authenticated role (signed in).
4. Add a Row Level Security policy. A publishable-key API returns nothing until policies exist, so create one policy per operation — for example, letting signed-in users read a table. The exact SQL pattern is in the RLS section below.
5. Create a storage bucket. In Storage, make a bucket for your files and set read/write policies on it, the same way you did for tables.
6. Connect your app. Copy the Project URL and publishable key from the project's Connect dialog and create the client with @supabase/supabase-js — the current snippet is in the connect section below.
7. Try realtime. Subscribe to a channel on your table and watch inserts arrive live in your app. The channel-based syntax is current; the old .on() style from 2025-era guides is outdated.

How Does the Supabase Free Tier Work?

The free tier costs $0 and is generous enough for a real first app: 50,000 monthly active users, a 500 MB database on shared CPU with 500 MB RAM, 5 GB of egress plus 5 GB of cached egress, and 1 GB of file storage with community support (supabase.com/pricing, checked October 29, 2026). You can keep at most two active projects on the free plan.

The catch that belongs in your first five minutes: free projects are paused after one week of inactivity. Build the habit of opening the dashboard regularly while you are developing, and know that a paused project is not a deleted one — but the pricing page states no further resume specifics, so do not treat a free project as permanent infrastructure for anything you cannot afford to interrupt.

Paid plans start at Pro for $25 per month, with Team at $599 per month for organizations (supabase.com/pricing). You do not need either for this guide — everything below runs on the free tier.

How Do the New API Keys Work?

Supabase now issues two key types: a Publishable key (starting with sb_publishable_…) for anything shipped to clients — browsers, mobile apps, CLI scripts — and a Secret key (starting with sb_secret_…) for servers, edge functions, and cron jobs, which bypasses Row Level Security. The old anon and service_role JWTs are now labeled legacy; both systems still work side by side until you deactivate the legacy keys under Settings > API Keys (Supabase API keys guide, supabase.com/docs, checked October 29, 2026).

Find your keys in the project's Connect dialog or under Settings > API Keys — there is no separate Settings > API page anymore. New keys travel on the apikey header rather than Authorization: Bearer, and secret keys are actively blocked in browsers (an HTTP 401 via User-Agent matching). Internalize the 2026 mental model: the publishable key is meant to be public, and Row Level Security is the actual lock on your data.

One more 2026 detail from the same docs page: realtime connections made with public keys last at most 24 hours unless you upgrade them to user-level authentication.

How Does Supabase Auth Work?

Supabase Auth handles signup, login, sessions, and password resets for you; your app never stores a password. Every database request is mapped to the anon role when signed out or the authenticated role when signed in, and auth.uid() inside a policy gives you the requesting user's ID for per-user rules (Supabase docs).

Start with the email provider, add an OAuth provider when you need one-click login, and write your RLS policies against the two roles: public sample data gets an anon policy, user data gets an authenticated policy scoped with auth.uid().

What Is Row Level Security, and Why Is It on From the Start?

Row Level Security is a set of Postgres rules that act like a WHERE clause on every query — and Supabase enables it by default on new tables because a publishable-key API returns nothing until policies exist (Supabase RLS guide, supabase.com/docs). That empty-result silence is the number-one "my app shows no data" beginner bug, and it is always the missing policy.

The recommended first-table pattern is one policy per operation. Here is the exact pattern from the docs for letting signed-in users read a table:

create policy "Authenticated can read employees"
on public.employees for select
to authenticated
using (true);

For public sample data, the same shape with to anon using (true) opens reads to everyone. For per-user data, replace using (true) with a check against auth.uid() so each user only sees their own rows. Keep policies tight from day one — a policy that is permissive "just while developing" has a way of shipping.

How Do You Store Files With Supabase Storage?

Create a bucket, upload files, and control who can read or write them with RLS policies — buckets come in three flavors: Files for everyday images, videos, and documents; Analytics for Apache Iceberg tables and data lakes; and Vector for embeddings and similarity search (Supabase storage guide, supabase.com/docs).

Storage is S3-compatible with a global CDN across 285+ cities, built-in image optimization for resizing and compression, and resumable uploads via the TUS protocol. The free tier includes 1 GB of storage with a 50 MB maximum upload size (storage guide and supabase.com/pricing, checked October 29, 2026).

How Do You Connect an App? (The Current Snippet)

Copy the Project URL and publishable key from your project's Connect dialog, then create the client with @supabase/supabase-js. For Next.js, the official quickstart installs @supabase/supabase-js plus @supabase/ssr and pre-creates browser and server helpers — that is still the current approach, with no newer replacement (Supabase Next.js quickstart, supabase.com/docs). The vanilla snippet:

import { createClient } from '@supabase/supabase-js'

const supabase = createClient(
  'https://xyzcompany.supabase.co',
  'your-publishable-key'
)

Note the publishable key — not the legacy anon key. Older community guides, including a widely-shared 2025 dev.to tutorial, still show the legacy anon JWT and the old realtime syntax; do not copy key handling from them. Supabase's 2026 docs also ship Agent Skills and an MCP server so AI coding agents can work with your project — worth knowing if you build with AI tools.

How Does Realtime Work in 2026?

Realtime is channel-based: open a named channel, attach a postgres_changes listener, and subscribe. The channel name can be any string except 'realtime' (Supabase postgres-changes guide and JavaScript subscribe reference, supabase.com/docs):

const channel = supabase
  .channel('todos-changes')
  .on('postgres_changes',
    { event: 'INSERT', schema: 'public', table: 'todos' },
    (payload) => {
      console.log('New row:', payload.new)
    }
  )
  .subscribe()

The config accepts INSERT, UPDATE, DELETE, or *, plus a server-side filter such as id=eq.1. Two requirements beginners miss: the table must be added to the supabase_realtime publication, and receiving old record values needs replica identity full on the table.

Supabase vs Firebase: Which Should a Beginner Pick?

Pick Supabase if you want open-source Postgres you can inspect, contribute to, and self-host; pick Firebase if you are already deep in Google's ecosystem and prefer its NoSQL Firestore model (supabase.com homepage). The honest comparison:

The self-hosted column is real: if you outgrow the hosted free tier and want the database on your own machine, the VPS path is one weekend of work — see the cluster links in the next section.

Where Do You Go After the First Project?

You have three natural next steps, and they are not mutually exclusive. First, vibe-code the frontend: connect an AI app builder to your Supabase project as its backend — our Lovable beginner's guide walks the exact prompt-to-deploy flow. Second, self-host the backend when you want full control: our 2026 guide to the best VPS for n8n covers RAM tiers and real prices that apply equally to a Supabase Docker deploy. Third, if servers are not your job, read the managed VPS hosting guide and let someone else handle the 3 a.m. pages.

Whichever branch you take, keep the two truths from the top of this guide: the publishable key is public by design and RLS is the lock, and the free tier's one-week pause clock is always ticking on idle projects.

Sources

• Supabase Next.js quickstart — project creation, Table Editor, RLS default, @supabase/ssr, Agent Skills and MCP server: https://supabase.com/docs/guides/getting-started/quickstarts/nextjs (fetched October 29, 2026)
• Supabase JavaScript client initialization — publishable-key createClient snippet: https://supabase.com/docs/reference/javascript/initializing (fetched October 29, 2026)
• Supabase API keys guide — publishable vs secret keys, legacy anon/service_role, Connect dialog, 24-hour realtime limit: https://supabase.com/docs/guides/getting-started/api-keys (fetched October 29, 2026)
• Supabase realtime postgres-changes guide — channel-based syntax, publication requirement: https://supabase.com/docs/guides/realtime/postgres-changes (fetched October 29, 2026)
• Supabase Row Level Security guide — policies as WHERE clauses, anon/authenticated roles: https://supabase.com/docs/guides/database/postgres/row-level-security (fetched October 29, 2026)
• Supabase storage guide — bucket types, S3 compatibility, 285+ city CDN, TUS uploads: https://supabase.com/docs/guides/storage (fetched October 29, 2026)
• Supabase pricing — free tier limits, pause policy, Pro $25/mo, Team $599/mo: https://supabase.com/pricing (fetched October 29, 2026)
• Supabase homepage — "open source from day one" positioning: https://supabase.com (fetched October 29, 2026)
• WhaleSync, "No-Coder's Guide to Supabase (2026)" — vibe-coding and Supabase vs Airtable/Neon angle: https://www.whalesync.com/blog/no-coder-guide-to-supabase (fetched October 29, 2026)

Frequently asked questions

Is Supabase really free?

Yes — the free tier costs $0 and includes 50,000 monthly active users, a 500 MB database, 5 GB of egress plus 5 GB of cached egress, and 1 GB of file storage (supabase.com/pricing, October 2026). The limits that matter: at most two active projects, and projects pause after one week of inactivity.

What is the publishable key, and is it safe to expose?

The publishable key (sb_publishable_…) is designed to live in browsers and mobile apps — exposing it is expected. What protects your data is Row Level Security: with RLS enabled and no policies, a publishable-key API returns nothing. Never expose the secret key (sb_secret_…); it bypasses RLS and is blocked in browsers.

Does Supabase pause free projects?

Yes. Free projects pause after one week of inactivity, and you can keep at most two active projects on the free plan (supabase.com/pricing). Open the dashboard regularly while developing, and do not treat a free project as permanent infrastructure for anything you cannot afford to interrupt.

What is the difference between Supabase and Firebase?

Supabase is the open-source Postgres alternative: a full backend you can inspect, contribute to, and self-host, with no lock-in. Firebase is Google's proprietary stack built around the NoSQL Firestore database. Choose Supabase for open-source Postgres, Firebase if you are committed to Google's ecosystem.

Can I use Supabase without writing backend code?

Yes — that is the point. Tables, auth providers, storage buckets, and policies are all managed through the dashboard UI, and your frontend talks to them through one client library. Vibe-coders commonly pair an AI frontend builder like Lovable with Supabase as the backend.