Set up Supabase

Supabase holds your app's data and handles sign-in. It is a real Postgres database, which is why apps built on it can grow.

1. Create a project

Sign up at supabase.com and create a project. Pick the region closest to your users. Save the database password in a password manager; you will rarely need it, but you cannot see it again.

2. Know your two keys

• The public (anon or publishable) key is safe in your app's front end. It can only do what your security rules allow.
• The secret (service role) key bypasses every rule. Never put it in your app's front end, never paste it into a chat, and never commit it to GitHub.

3. Turn on row-level security

Row-level security (RLS) decides who can read and change each row. Every table that holds user data needs it on, with policies such as "users can read and edit only their own rows". A table without RLS is open to anyone with your public key. Ask Claude to review your policies before launch.

4. Set up sign-in emails

Under Authentication, set your site URL and redirect URLs to your app's address, and customize the confirmation and reset emails. Update these again when you connect a custom domain.

5. Upgrade before launch

Free projects pause after a week without activity. Move to Pro before real customers rely on the app. Pro also keeps daily backups.