Supabase Auth

Why it's ranked here

The versioning contract is the reason to trust this over a hand rolled auth service: patch releases promise no column type changes, no dropped indexes, no removed REST endpoints, and minor releases hold the REST API, token structure and configuration steady. The build backs that up with a security scanner, a static analyser and a vulnerability checker wired into the release test target, plus race enabled tests. The maintainers are also blunt about the limits: they say running an authentication server in production is hard and point you at their hosted service, and they offer no Go API stability at all.

What's good

Operational detail is handled rather than assumed. A config watcher rebuilds the API in place when files change, so rate limiters and mail template caches survive a reload without a restart. The listener sets socket reuse, letting a new process take over the port. Shutdown drains in-flight requests for up to a minute. Header read timeouts are set explicitly to blunt slow request attacks. Traces and metrics export over OpenTelemetry, with a Prometheus option. The container image ships static binaries and runs as a non-root user.

Tradeoffs

Postgres is the only supported dialect, so this is not a drop-in for another store. The configuration surface is very large: the shipped example lists over a hundred settings across mail, SMS, captcha, SAML and a dozen OAuth providers, and getting one redirect allow list wrong is a real security hole. The dependency tree pulls SAML, WebAuthn and Ethereum crypto libraries into every build regardless of what you enable. The project states it is not meant to be used as a Go library, and it owns its database schema: you are told not to modify or read it directly.

How to use it well

Reach for this if you self-host Supabase, or if you want an identity service whose tokens feed Postgres row level security directly. It fits a stack that already runs Postgres and can put a TLS terminating proxy in front, which the documentation requires. Budget real time for a configuration review before launch. It does not give you sign-in screens, an admin dashboard beyond two command line user operations, or authorization logic past roles and claims inside the token. Pair it with a client library for the front end and your own policy layer in the database.

Observed

Language

Go, single module github.com/supabase/auth

Database

Postgres only, driver must be postgres

Interfaces

HTTP REST API plus a CLI binary with serve, migrate, admin and version subcommands

Configuration

Environment variables prefixed GOTRUE_, or an env file, with env taking precedence

Schema handling

Migrations embedded in the binary and applied automatically on start

Build targets

Static CGO-free binaries for linux amd64, linux arm64 and darwin arm64

Container

Multi-stage Dockerfile on alpine, final image runs as a non-root user

Observability

OpenTelemetry traces and metrics, plus a Prometheus exporter

Build-time checks

gosec, staticcheck and govulncheck are Makefile targets in release-test

Tests

go test run with the race detector and a coverage script

Lineage

Originally forked from Netlify's GoTrue, now diverged