AI Tool Profile
Supabase Review: Pricing, Self-Hosting, API, and MCP
A hosted development platform built around Postgres, with authentication, storage, realtime, Edge Functions, and related application back-end services.
Kingy AI Product Facts
Supabase
Current statusGenerally available
- Company
- SUPABASE PTE. LTD.
- Primary job
- Provide a Postgres-centered backend platform with Auth, generated Data APIs, Edge Functions, Realtime, Storage, and vector support for web, mobile, SaaS, and AI applications.
- Audience
- application developers, SaaS teams, AI product builders, platform teams
- Free plan
- Available
- API
- Available
- MCP
- Available
- Source code
- Open source · Apache-2.0
- Evidence
- Source-backed; review due
- Coverage
- 26 of 83 core fields reviewed
- Sources
- 8
- Latest source check
- August 27, 2026
See all tracked product factsPricing, platforms, dependencies, data claims, regions, and timeline
Plans and pricing units
- Enterprise Custom pricing
- Free 0 · USD
- Pro 25 USD per month + usage
- Team 599 USD per month + usage
Where it runs
- Web
- Available
- Self Hosted
- Available
Stack and integrations
- Model / provider dependencies
- Not yet reviewed
- Integrations
- Not yet reviewed
Data and regions
- Vendor data-use claim
- Not yet reviewed
- Vendor retention claim
- Not yet reviewed
- Regions
- Not yet reviewed
Launch and latest material update
- Launch
- Not yet reviewed
- Latest material update
- Not yet reviewed
Review history
- Supabase Review: Pricing, Self-Hosting, API, and MCP — Verification refreshed
Kingy reconfirmed the published facts against the cited sources.
View published revision - Supabase Review: Pricing, Self-Hosting, API, and MCP — Product Facts updated
Kingy published an approved change to this Product Facts record.
View published revision - Supabase Review: Pricing, Self-Hosting, API, and MCP — Product event recorded
Kingy published an approved update for a sourced product event.
View published revision - Supabase Review: Pricing, Self-Hosting, API, and MCP — Product Facts updated
Kingy published an approved change to this Product Facts record.
View published revision
Kingy verdict
Supabase is a strong Postgres platform for shipping database-backed and AI applications—if you budget for usage and treat security as application work, not a default guarantee.
The managed service combines Postgres, Auth, generated Data APIs, Edge Functions, Realtime, Storage, and vector support. Self-hosting offers more infrastructure control, but it is a different operational product: one project, fewer managed features, and your team owns hardening, backups, scaling, recovery, monitoring, and uptime.
Buyer decision
Should you use Supabase?
Choose managed Supabase when you want one Postgres-centered service for the database, authentication, storage, realtime data, server functions, and generated APIs. It is especially useful when a small team values a unified dashboard and fast application setup more than assembling separate infrastructure components.
Strong fit
Early-stage SaaS, AI products, agent backends, prototypes that must become real products, mobile or web apps that need Auth and storage, and teams that already understand relational data and SQL.
Look elsewhere—or plan carefully
Workloads that need fixed all-in pricing, teams unable to operate Postgres safely, buyers expecting managed and self-hosted editions to be feature-equivalent, or applications that cannot tolerate usage-based database, egress, realtime, storage, and compute charges.
What it costs
Managed pricing starts simply; usage and compute make the real bill
The signed-out USD page checked 2026-08-25 showed Free at $0 per month, Pro from $25 per month, Team from $599 per month, and Enterprise as custom pricing. These are starting plan prices—not all-in project costs.
Free · $0/month
Includes two active projects, 50,000 monthly active users, 500 MB database size, 5 GB egress, 5 GB cached egress, and 1 GB file storage. Free projects pause after one week of inactivity.
Pro · from $25/month
Includes 100,000 monthly active users, 8 GB disk per project, 250 GB egress, 250 GB cached egress, 100 GB file storage, and $10 per month in compute credits. Additional projects start from $10 per month.
Team · from $599/month
Adds organization controls and compliance-oriented features including dashboard SSO, project-scoped and read-only access, SOC 2 and ISO 27001, priority email support and SLAs, and longer log and backup retention.
Enterprise · custom
Adds negotiated support, uptime SLAs, BYO Cloud support, private support channels, and custom security requirements. Exact entitlements depend on the agreement.
Buying rule: Model the plan, one compute instance per project, expected database growth, MAU, egress, cached egress, storage, realtime usage, functions, backups, and add-ons. Taxes and account-specific terms can also change the final bill.
Managed cloud versus self-hosted
They share a product family, not operational parity
Managed Supabase is hosted and operated by Supabase. The documented self-hosted distribution runs as one project and is recommended through Docker, but it omits managed branching, advanced metrics beyond logs, managed backups and point-in-time recovery, analytics and vector buckets, ETL, and the platform management API.
Managed cloud
Supabase operates the platform and sells plan allowances, compute, usage, support, and compliance capabilities. This is the lower-operations path, but it introduces variable usage costs and managed-service terms.
Self-hosted
Your team provisions servers, hardens and updates services, configures and maintains Postgres, designs high availability, performs backups and disaster recovery, and owns monitoring and uptime. Community support is the default. Infrastructure and engineering labor mean “self-hosted” is not the same as “free.”
Important: The Supabase CLI local stack is for development and testing. Supabase says it is not hardened for production and must not be exposed to external traffic.
Security boundary
RLS, grants, policies, tests, and key placement are your responsibility
Supabase generates a REST API directly from the database schema. That speed is useful, but exposed tables require deliberate authorization. Supabase says to enable Row Level Security on every table in an exposed schema, set grants and policies for the intended roles, and test both allowed and denied operations.
Publishable keys
Publishable keys can appear in browser, mobile, desktop, CLI, and other public components because they identify the application—not the user. They are safe only when database grants and RLS correctly restrict what the anon and authenticated roles can do.
Secret keys
Secret keys belong only in secured backend components. They have elevated access through the service_role, bypass RLS, and must never be placed in public code, browser apps, URLs, chat, or unsanitized logs.
Kingy rule: “The key is public” does not mean “the data is public.” Public-key safety depends on correct Postgres permissions and tested RLS policies.
AI-agent access
Supabase has an official MCP server—with meaningful safety boundaries
The official MCP integration can connect AI coding tools to Supabase projects for documentation, account, database, debugging, development, functions, and branching workflows. The hosted endpoint supports project scoping, feature-group restriction, and a read-only mode.
Useful controls
Scope the connection to one development project, enable only required feature groups, prefer read-only mode, retain manual approval of tool calls, and review SQL or schema changes before execution.
Production warning
Supabase explicitly recommends not connecting the MCP server to production data. It is designed for development and testing, and agent output can still be influenced by untrusted data or overly broad permissions.
Kingy testing and commercial disclosure
What Kingy built—and who paid
Hands-on evidence adds workflow context. Sponsorship or supplied access never changes product facts, evidence strength, ranking, or revision history.
Hands-on Kingy evidence
I Built an AI SaaS with Supabase in 12 Minutes
Kingy retained an 11-minute 58-second build showing an AI SaaS workflow with Supabase. It supports the adoption and workflow judgment on this page; it is not a benchmark, security audit, long-term reliability test, or proof that every project will take twelve minutes.
- Relationship
- Paid sponsorship
- Access
- Supplied access or credits
- Affiliate status
- Vendor tracking link only; no affiliate commission
- Editorial control
- Kingy retained full control of conclusions and opinions
- Coverage began
- July 10, 2026
- Video published
- July 17, 2026
What changed
Latest verified changes to this Kingy record
These entries describe evidence and editorial changes. A source-check date does not imply Supabase changed the product that day.
-
Pricing and platform facts rechecked
Reconfirmed managed plan starting prices, core Pro allowances, compute-credit treatment, platform modules, contracting entity, and self-hosting differences against current official pages.
-
Security and MCP guidance added
Added source-bound buyer guidance for generated Data APIs, RLS and grants, publishable versus secret keys, official MCP access, project scoping, read-only mode, and the production-data warning.
-
Original testing and disclosure bound
Bound the retained Kingy SaaS build to its exact paid-sponsorship, supplied-access, non-affiliate, and independent-editorial disclosure.
Quick answers
Supabase questions buyers ask
How much does Supabase cost?
The signed-out USD page checked 2026-08-25 showed Free at $0 monthly, Pro from $25, Team from $599, and custom Enterprise pricing. Compute, usage overages, projects, backups, add-ons, and taxes can increase the total.
Is self-hosted Supabase free?
There is no managed-plan fee for the self-hosted distribution, but you still pay for infrastructure and the people responsible for security, Postgres maintenance, backups, recovery, scaling, monitoring, and uptime.
Is self-hosted Supabase the same as managed Supabase?
No. The official guide documents one project, fewer managed features, community support, and a different operating-responsibility model.
Can I expose a Supabase publishable key?
Yes, it is designed for public application components—but it does not secure data by itself. Use least-privilege grants and tested RLS policies for every exposed table.
Can I use the Supabase MCP server with production data?
Supabase recommends that you do not. Use a development project, scope it narrowly, enable read-only mode where possible, restrict feature groups, and manually review tool calls.
What did Kingy actually test?
Kingy built an AI SaaS workflow in an 11-minute 58-second sponsored video. That supports workflow context, not security, scale, uptime, or performance claims.
Primary evidence
Official sources and freshness
Every material factual section links to the official page supporting it. Kingy retains the observation clock, response hash, locator, and excerpt; raw public response bytes were not retained in the repository.
- Supabase product overviewChecked 2026-08-25
- Supabase pricing and feesChecked 2026-08-25
- Supabase self-hosting guideChecked 2026-08-25
- Supabase Terms of ServiceChecked 2026-08-25
- Supabase Row Level Security guideChecked 2026-08-25
- Understanding Supabase API keysChecked 2026-08-25
- Supabase Data REST APIChecked 2026-08-25
- Supabase MCP ServerChecked 2026-08-25
How this living record is maintained
Kingy appends reviewed revisions instead of silently replacing earlier values. Source checks, material editorial reviews, original publication, and page-modification dates stay separate.
The Kingy Brief
Follow The Kingy Brief.
One consequential launch, one pricing, limit, or shutdown change, one hands-on test, one exact prompt or Test Pack, and one try / watch / skip verdict.
Free · Choose your subjects · Double opt-in · Unsubscribe anytime
Tool Links
Related Kingy Links
Launch History
No structured launch records are linked to this tool yet.