Supabase Connector
Sync Supabase tables through a Supabase Auth session, with Row Level Security policies applied during reads.
Evaluating against Fivetran? See how Supaflow handles Supabase pricing, connector quality, and Snowflake deployment side-by-side.
Supaflow vs FivetranLoad Supabase into Snowflake
Dedicated pages for destination-specific setup, buyer questions, and Snowflake sync behavior.
Why Supaflow
All connectors included
Every connector is available on every plan. Pricing does not increase with connector count.
Pay for compute, not rows
Credit-based pricing. Usage scales with your pipelines, not with row counts.
One platform
Ingestion, dbt Core transformation, reverse ETL, and orchestration in a single workspace.
Capabilities
Supabase Auth Sessions
Sign in with email/password or magic link. Supaflow stores the session credentials encrypted, refreshes the session when needed, and reads as the authenticated user.
Application-User Access
Use this connector when warehouse syncs should respect a Supabase Auth user's Row Level Security policies. For centralized replication with an actual database username and password, use the PostgreSQL source instead.
Table Discovery
Discover tables in exposed Supabase schemas through the Supaflow metadata helper, then select the tables you want to sync in your pipeline.
Full Refresh and Incremental Sync
Run full-refresh syncs or incremental syncs on reliable last-modified timestamp fields.
Page Size Control
Tune the number of rows read per request for wide tables, large projects, or expensive Row Level Security policies that need smaller batches.
Supported Objects
Database Objects
Tables
Tables in exposed schemas with SELECT access for the authenticated role.
How It Works
Install the metadata helper
Run the Supaflow metadata helper SQL in the Supabase SQL Editor for each project you connect. The helper lets Supaflow discover schemas, tables, columns, and primary keys without a service role key.
Enter project details
Provide the Supabase Project Reference and a publishable API key or legacy anon key. The source does not require a service-role key; current Supabase secret keys are rejected because they bypass Row Level Security.
Sign in with Supabase Auth
Choose email/password or magic link and authenticate as the Supabase Auth user whose RLS access should define what Supaflow can read.
Test and save
Click Test & Save to validate the Auth session, check the metadata helper, and discover schemas and objects exposed to the authenticated role. Row reads are filtered by the signed-in user session.
Use Cases
RLS-aware analytics syncs
Move application data into your warehouse using the same Supabase Auth visibility model your product relies on.
Tenant-scoped exports
Create sources for specific Supabase Auth users when each user or workspace should sync only the rows allowed by your policies.
Operational reporting
Sync selected application tables for reporting while avoiding broad database credentials or service role keys.
Frequently Asked Questions
How is this different from the PostgreSQL source?
The Supabase source uses a publishable or legacy anon key plus a Supabase Auth session, so reads follow that application user's Row Level Security policies. The PostgreSQL source uses an actual database username and password and can read every selected table and row that database user is permitted to access.
Can I replicate an entire Supabase database?
Yes. Use the PostgreSQL source with a dedicated database user that has CONNECT, schema USAGE, and table SELECT for the intended replication scope. Use this Supabase source instead when an application user's RLS visibility should limit the export. Neither source currently uses WAL CDC.
Which sign-in methods are supported?
Email/password is the default. Magic link is also supported when your Supabase Auth redirect allow list includes the Supaflow callback URL.
Do I need a service role key?
No. Use a publishable key or legacy anon key with the signed-in user session. The source does not require a service-role key, and current Supabase secret keys are rejected because they bypass Row Level Security.
Why does the connector need a metadata helper?
The helper lets Supaflow discover schemas, tables, columns, and primary keys without storing a service role key. Actual row reads still use the signed-in Supabase Auth user session.
What happens when the Supabase Auth token expires?
Supaflow refreshes the session with the saved refresh token before reads. If the refresh token is revoked or expired, reconnect the source.
Does the connector support CDC?
No. The Supabase source supports full refresh and timestamp-based incremental sync. It does not use Postgres logical replication or CDC.
Can I sync Supabase views or foreign tables?
No. The Supabase source discovers and syncs tables only. If you need data from a view, materialize it into a table in your Supabase project.
Can I sync tables without primary keys?
Small full-refresh tables can work within a single page. For large full-refresh tables, keep a primary key so Supaflow can page rows safely and deterministically.
Need a connector we don't support yet?
Build one with AI-powered Connector Dev Skills.
Learn More About the Connector SDK
