AI Tool Profile
Supabase Review: Pricing, Self-Hosting, API, and MCP
A hosted development platform built around Postgres, with authentication, storage, realtime, Edge Functions, and related application back-end services.
Before you choose · Build a useful app
Supabase: workflow and access check
Add a backend only when the beginner project needs persistent data.
Review due · Official-source review; no new hands-on test
This review covers the notes below. Earlier prices, tests and Product Facts retain their original dates.
Supabase’s RLS guide says tables in exposed schemas need Row Level Security and appropriate grants. It calls for allow/deny tests for database operations and roles; policies alone do not remove existing grants. Supabase Row Level Security
Check before choosing: Keep the first calculator local. For a database project, test access rules with synthetic data and verify backup, usage and deployment responsibilities.
Return to Build a useful app → · Browse retained reviews and tests
Review scope and source notes
Earlier article text, prices, tests and Product Facts keep their original dates and scope. This check covers only the cited notes here; it does not refresh the whole profile or its machine-readable facts.
Checked by: Codex-assisted official-source review. Task fit is editorial guidance. Test the exact plan, model and route with your own fixture.
Commercial relationship: Not established by this source review. Existing article disclosures still apply.
- Supabase Row Level Security — Secure a table with RLS. Checked 2026-09-20.
Maintenance history
- 2026-09-20 · source recheck · Source recheck
Kingy AI Product Facts
Supabase
Current statusGenerally available
- Company
- SUPABASE PTE. LTD.
- Primary job
- Provide a Postgres-centered backend platform with Auth, generated Data APIs, Edge Functions, Realtime, Storage, and vector support for web, mobile, SaaS, and AI applications.
- Audience
- application developers, SaaS teams, AI product builders, platform teams
- Free plan
- Available
- API
- Available
- MCP
- Available
- Source code
- Open source · Apache-2.0
- Evidence
- Source-backed; review due
- Latest source check
- August 27, 2026
See all tracked product factsPricing, platforms, dependencies, data claims, regions, and timeline
Sources and checks
- Coverage
- 10 of 87 tracked fields currently verified
- Sources
- 8
Source-check dates apply to the tracked facts. Editorial updates elsewhere on this page may have a different date.
Plans and pricing units
- Enterprise Custom pricing
- Free Free
- Pro 25 USD per month + usage
- Team 599 USD per month + usage
Where it runs
- Web
- Available
- Self Hosted
- Available
Developer access
- API access
- Available
Stack and integrations
- Model / provider dependencies
- Not yet reviewed
- Integrations
- Not yet reviewed
Data and regions
- Vendor data-use claim
- Not yet reviewed
- Vendor retention claim
- Not yet reviewed
- Regions
- Not yet reviewed
Launch and latest material update
- Launch
- Not yet reviewed
- Latest material update
- Not yet reviewed
Review history
- Supabase Review: Pricing, Self-Hosting, API, and MCP — Correction published
Kingy published an approved correction to this Product Facts record.
View published revision - Supabase Review: Pricing, Self-Hosting, API, and MCP — Verification refreshed
Kingy reconfirmed the published facts against the cited sources.
View published revision - Supabase Review: Pricing, Self-Hosting, API, and MCP — Verification refreshed
Kingy reconfirmed the published facts against the cited sources.
View published revision - Supabase Review: Pricing, Self-Hosting, API, and MCP — Product Facts updated
Kingy published an approved change to this Product Facts record.
View published revision - Supabase Review: Pricing, Self-Hosting, API, and MCP — Product event recorded
Kingy published an approved update for a sourced product event.
View published revision - Supabase Review: Pricing, Self-Hosting, API, and MCP — Product Facts updated
Kingy published an approved change to this Product Facts record.
View published revision
Kingy verdict
Supabase is a strong Postgres platform for shipping database-backed and AI applications—if you budget for usage and treat security as application work, not a default guarantee.
The managed service combines Postgres, Auth, generated Data APIs, Edge Functions, Realtime, Storage, and vector support. Self-hosting offers more infrastructure control, but it is a different operational product: one project, fewer managed features, and your team owns hardening, backups, scaling, recovery, monitoring, and uptime.
Buyer decision
Should you use Supabase?
Choose managed Supabase when you want one Postgres-centered service for the database, authentication, storage, realtime data, server functions, and generated APIs. It is especially useful when a small team values a unified dashboard and fast application setup more than assembling separate infrastructure components.
Strong fit
Early-stage SaaS, AI products, agent backends, prototypes that must become real products, mobile or web apps that need Auth and storage, and teams that already understand relational data and SQL.
Look elsewhere—or plan carefully
Workloads that need fixed all-in pricing, teams unable to operate Postgres safely, buyers expecting managed and self-hosted editions to be feature-equivalent, or applications that cannot tolerate usage-based database, egress, realtime, storage, and compute charges.
What it costs
Managed pricing starts simply; usage and compute make the real bill
The signed-out USD page checked 2026-08-25 showed Free at $0 per month, Pro from $25 per month, Team from $599 per month, and Enterprise as custom pricing. These are starting plan prices—not all-in project costs.
Free · $0/month
Includes two active projects, 50,000 monthly active users, 500 MB database size, 5 GB egress, 5 GB cached egress, and 1 GB file storage. Free projects pause after one week of inactivity.
Pro · from $25/month
Includes 100,000 monthly active users, 8 GB disk per project, 250 GB egress, 250 GB cached egress, 100 GB file storage, and $10 per month in compute credits. Additional projects start from $10 per month.
Team · from $599/month
Adds organization controls and compliance-oriented features including dashboard SSO, project-scoped and read-only access, SOC 2 and ISO 27001, priority email support and SLAs, and longer log and backup retention.
Enterprise · custom
Adds negotiated support, uptime SLAs, BYO Cloud support, private support channels, and custom security requirements. Exact entitlements depend on the agreement.
Buying rule: Model the plan, one compute instance per project, expected database growth, MAU, egress, cached egress, storage, realtime usage, functions, backups, and add-ons. Taxes and account-specific terms can also change the final bill.
Managed cloud versus self-hosted
They share a product family, not operational parity
Managed Supabase is hosted and operated by Supabase. The documented self-hosted distribution runs as one project and is recommended through Docker, but it omits managed branching, advanced metrics beyond logs, managed backups and point-in-time recovery, analytics and vector buckets, ETL, and the platform management API.
Managed cloud
Supabase operates the platform and sells plan allowances, compute, usage, support, and compliance capabilities. This is the lower-operations path, but it introduces variable usage costs and managed-service terms.
Self-hosted
Your team provisions servers, hardens and updates services, configures and maintains Postgres, designs high availability, performs backups and disaster recovery, and owns monitoring and uptime. Community support is the default. Infrastructure and engineering labor mean “self-hosted” is not the same as “free.”
Important: The Supabase CLI local stack is for development and testing. Supabase says it is not hardened for production and must not be exposed to external traffic.
Security boundary
RLS, grants, policies, tests, and key placement are your responsibility
Supabase generates a REST API directly from the database schema. That speed is useful, but exposed tables require deliberate authorization. Supabase says to enable Row Level Security on every table in an exposed schema, set grants and policies for the intended roles, and test both allowed and denied operations.
Publishable keys
Publishable keys can appear in browser, mobile, desktop, CLI, and other public components because they identify the application—not the user. They are safe only when database grants and RLS correctly restrict what the anon and authenticated roles can do.
Secret keys
Secret keys belong only in secured backend components. They have elevated access through the service_role, bypass RLS, and must never be placed in public code, browser apps, URLs, chat, or unsanitized logs.
Kingy rule: “The key is public” does not mean “the data is public.” Public-key safety depends on correct Postgres permissions and tested RLS policies.
AI-agent access
Supabase has an official MCP server—with meaningful safety boundaries
The official MCP integration can connect AI coding tools to Supabase projects for documentation, account, database, debugging, development, functions, and branching workflows. The hosted endpoint supports project scoping, feature-group restriction, and a read-only mode.
Useful controls
Scope the connection to one development project, enable only required feature groups, prefer read-only mode, retain manual approval of tool calls, and review SQL or schema changes before execution.
Production warning
Supabase says to connect a production project only when the task requires production evidence. Scope the MCP server to that project, enable read-only mode, restrict feature groups, use the narrowest data query, and exclude secrets or unrelated personal data from prompts and reports. Read-only mode applies to SQL execution; it is one control, not a general safety or credential guarantee, and untrusted data can still influence agent actions.
Kingy testing and commercial disclosure
What Kingy built—and who paid
Hands-on evidence adds workflow context. Sponsorship or supplied access never changes product facts, evidence strength, ranking, or revision history.
Hands-on Kingy evidence
I Built an AI SaaS with Supabase in 12 Minutes
Kingy retained an 11-minute 58-second build showing an AI SaaS workflow with Supabase. It supports the adoption and workflow judgment on this page; it is not a benchmark, security audit, long-term reliability test, or proof that every project will take twelve minutes.
- Relationship
- Paid sponsorship
- Access
- Supplied access or credits
- Affiliate status
- Vendor tracking link only; no affiliate commission
- Editorial control
- Kingy retained full control of conclusions and opinions
- Coverage began
- July 10, 2026
- Video published
- July 17, 2026
What changed
Latest verified changes to this Kingy record
These entries describe evidence and editorial changes. A source-check date does not imply Supabase changed the product that day.
-
Pricing and platform facts rechecked
Reconfirmed managed plan starting prices, core Pro allowances, compute-credit treatment, platform modules, contracting entity, and self-hosting differences against current official pages.
-
Security and MCP guidance added
Added source-bound buyer guidance for generated Data APIs, RLS and grants, publishable versus secret keys, official MCP access, project scoping, read-only mode, and the production-data warning.
-
Original testing and disclosure bound
Bound the retained Kingy SaaS build to its exact paid-sponsorship, supplied-access, non-affiliate, and independent-editorial disclosure.
Quick answers
Supabase questions buyers ask
How much does Supabase cost?
The signed-out USD page checked 2026-08-25 showed Free at $0 monthly, Pro from $25, Team from $599, and custom Enterprise pricing. Compute, usage overages, projects, backups, add-ons, and taxes can increase the total.
Is self-hosted Supabase free?
There is no managed-plan fee for the self-hosted distribution, but you still pay for infrastructure and the people responsible for security, Postgres maintenance, backups, recovery, scaling, monitoring, and uptime.
Is self-hosted Supabase the same as managed Supabase?
No. The official guide documents one project, fewer managed features, community support, and a different operating-responsibility model.
Can I expose a Supabase publishable key?
Yes, it is designed for public application components—but it does not secure data by itself. Use least-privilege grants and tested RLS policies for every exposed table.
Can I use the Supabase MCP server with production data?
Only when the task requires production evidence. Scope the server to that project, enable read-only mode, restrict feature groups, use the narrowest data query, exclude secrets and unrelated personal data, and manually review tool calls. Read-only mode limits SQL execution; it does not replace narrow permissions or human review.
What did Kingy actually test?
Kingy built an AI SaaS workflow in an 11-minute 58-second sponsored video. That supports workflow context, not security, scale, uptime, or performance claims.
Primary evidence
Official sources and freshness
Every material factual section links to the official page supporting it. Kingy retains the observation clock, response hash, locator, and excerpt. Later October 8 source rechecks retained raw public response bytes without changing the original August 25 source dates shown below.
- Supabase product overviewChecked 2026-08-25
- Supabase pricing and feesChecked 2026-08-25
- Supabase self-hosting guideChecked 2026-08-25
- Supabase Terms of ServiceChecked 2026-08-25
- Supabase Row Level Security guideChecked 2026-08-25
- Understanding Supabase API keysChecked 2026-08-25
- Supabase Data REST APIChecked 2026-08-25
- Supabase MCP ServerChecked 2026-08-25
How this living record is maintained
Kingy appends reviewed revisions instead of silently replacing earlier values. Source checks, material editorial reviews, original publication, and page-modification dates stay separate.
The Kingy Brief
Get The Kingy Brief.
AI changes, original tests and one practical thing to try. Fridays at 09:00 Vancouver time.
Free · Double opt-in · Unsubscribe anytime
Sign up for The Kingy Brief on Beehiiv.
Signup help and newsletter schedule
Signup form provided by Beehiiv. After submitting, check your inbox for "Confirm your subscription to The Kingy Brief" and open its confirmation link. Check Spam or Promotions if you cannot find it.
Fridays at 09:00 Vancouver time: source-checked AI changes, original tests and one practical thing to try. We skip a week when there is not enough verified material. Free. Unsubscribe anytime.
Tool Links
Related Kingy Links
Launch History
No structured launch records are linked to this tool yet.