Supabase Auth
Supabase · Ranked #6 of 8 in Authentication & Identity APIs
Open-source Postgres-native auth (GoTrue) bundled with the Supabase backend, with row-level-security integration and a generous 50k-MAU free tier.
Postgres-native auth in an OSS BaaS
Overview
Supabase Auth is the authentication and identity layer of the open-source Supabase backend-as-a-service platform. At its core sits GoTrue (now simply "auth"), an Apache-2.0-licensed Go service that exposes a JWT-based API for sign-ups, logins, and token issuance. What makes it distinctive among auth providers is that it is not a standalone IdP bolted onto a database, it is fused with Postgres. JWT claims issued by Auth are readable inside SQL, so authorization can be enforced at the database layer through Row-Level Security policies rather than in application code. For teams already building on Supabase's Postgres, storage, and edge functions, that integration removes an entire category of glue code and makes Auth effectively "free" to adopt.
The provider is best understood as B2C-first and developer-first. It ships the breadth of consumer auth methods, email/password, magic links, OTP, phone, social OAuth across dozens of providers, anonymous sign-ins, and TOTP/phone MFA with Authenticator Assurance Levels (aal1/aal2) usable inside RLS. Pricing is aggressive: 50,000 MAU on the free tier and 100,000 on Pro at $25/month, with overage at $0.00325 per MAU, which substantially undercuts Auth0 and Okta on raw MAU economics. The same simplicity that wins it praise ("enable the SSO toggle and you're done") is also why it lands so well with indie developers and startups.
Where it weakens is the enterprise/B2B end of the market. Independent CIAM analysis flags no first-class Organizations model, no SCIM provisioning, comparatively immature SAML/OIDC, and no adaptive MFA or bot detection. SSO (SAML 2.0) is gated to Pro and above, and uptime SLAs are reserved for Enterprise contracts (99.9%). Compliance covers SOC 2 Type II and HIPAA but not FedRAMP or PCI DSS, and the architecture is permanently tied to Postgres. For a regulated B2B SaaS needing org-based tenancy, SCIM, and enterprise SSO governance, Supabase Auth is a stretch; for a B2C app already on Supabase, it is one of the strongest value propositions available.
How this score is derived
The APIbenchmarks Index is a weighted sum of four dimensions, each scored on an absolute 0–100 reference scale. See the methodology for every mapping.
| Dimension | Score | Weight | Contribution |
|---|---|---|---|
| Documentation & DXExtensive, well-organized docs covering every auth method, framework-specific server-side guides, and session/refresh-token edge cases, widely praised by reviewers. | 84 | 30% | 25.2 |
| ReliabilityStatus page shows ~99.84% Auth uptime over a trailing 90-day window, but a contractual 99.9% uptime SLA is reserved for Enterprise customers only. | 76 | 25% | 19.0 |
| Ecosystem & SDKsBacked by official v2 SDKs across JS/TS, Flutter/Dart, Swift, Kotlin, Python and C#, a large community, and self-hostable GoTrue under Apache 2.0. | 80 | 25% | 20.0 |
| AccessibilityGenerous free tier (50,000 MAU) and a one-toggle setup make it trivially accessible to indie and startup developers, though enterprise governance features sit behind paid tiers. | 90 | 20% | 18.0 |
| APIbenchmarks Index (ABI) | 82.2 | ||
Table 1. Derivation of the ABI for Supabase Auth. Contribution = score × weight; the index is their sum.
At a glance
- Vendor
- Supabase
- Pricing model
- MAU-based (+ platform fee)
- Free tier
- 50k MAU (Free plan)
- Official SDKs
- 6 languages
Pricing
| Free | $0/mo | 50,000 monthly active users (MAU) included; community support; no uptime SLA. |
| Pro | $25/mo | 100,000 MAU included, then $0.00325 per additional MAU; SSO (SAML 2.0) available; email support. |
| Team | $599/mo | 100,000 MAU included, then $0.00325 per MAU; SSO, audit logs, priority email support & SLAs. |
| Enterprise | Custom | Custom MAU pricing, 99.9% uptime SLA, dedicated support, HIPAA, BYO-cloud options. |
Key features
- •GoTrue JWT-based auth server (open source, Apache 2.0, self-hostable)
- •Email/password, magic link, and one-time password (OTP) sign-in
- •Phone auth via SMS providers
- •Social OAuth with dozens of providers (Google, GitHub, Apple, etc.)
- •Anonymous sign-ins
- •Multi-factor auth: TOTP app authenticator and phone, with Authenticator Assurance Levels (aal1/aal2)
- •SAML 2.0 / OIDC enterprise SSO (Pro+)
- •Row-Level Security integration, JWT claims accessible in Postgres policies
- •Customizable MFA enforcement (all users / new users / opt-in)
- •Server-side auth helpers for Next.js and other SSR frameworks
Official SDKs
Strengths & trade-offs
- +Deep Postgres Row-Level Security integration: JWT claims are usable directly inside SQL policies for DB-layer authorization
- +Very generous free tier (50,000 MAU) and low overage pricing ($0.00325/MAU) versus Auth0/Okta
- +Broad auth methods out of the box: password, magic link, OTP, phone, anonymous, dozens of social OAuth providers, plus TOTP/phone MFA
- +Self-hostable and open source (GoTrue, Apache 2.0), avoids hard vendor lock-in
- +One-toggle setup and strong docs make integration fast for developers
- –B2C-first: no first-class Organizations model and no SCIM provisioning for B2B tenancy
- –SAML/OIDC support is comparatively immature; SSO gated to Pro and above
- –No adaptive/risk-based MFA or bot-detection capabilities
- –Contractual uptime SLA (99.9%) and audit logs reserved for Team/Enterprise tiers
- –Permanently coupled to Postgres, cannot back it with arbitrary databases
- –Compliance lacks FedRAMP and PCI DSS attestation; session/refresh-token edge cases (e.g., cached Set-Cookie under ISR) require care
What developers say
G2 4.7/5 (Supabase, ~47 reviews)
Developers consistently praise Supabase Auth for ease of setup and tight database integration, while noting it feels less mature than dedicated identity providers for complex or enterprise use cases.
“All you need to do is add the passkeys, enable the SSO toggle, and you're done. It's really easy, fast, and straightforward to configure, and very easy to integrate with providers like Google and GitHub.”
Key figures
| Auth service uptime (trailing 90 days) | 99.84% | Supabase Status page ↗ |
| Enterprise uptime SLA | 99.9% | Supabase SLA doc ↗ |
| Included MAU (Free plan) | 50,000 | Supabase pricing page ↗ |
| Included MAU (Pro plan) | 100,000 | Supabase pricing page ↗ |
| Additional MAU overage price | $0.00325 per MAU | Supabase pricing page ↗ |
| Pro plan base price | $25 / month | Supabase pricing page ↗ |
Compare Supabase Auth head to head
Sources
- https://supabase.com/pricing
- https://supabase.com/docs/guides/auth
- https://supabase.com/docs/guides/auth/auth-mfa
- https://status.supabase.com/uptime
- https://supabase.com/sla
- https://github.com/supabase/auth
- https://www.g2.com/products/supabase-supabase/reviews
- https://guptadeepak.com/ciam-compass/vendors/supabase-auth/
- https://supabase.com/blog/client-libraries-v2
Figures last verified 2026-06-27. Spotted an error? corrections@apibenchmarks.com