Supabase Review: The Self-Hosted Firebase Alternative in 2026

An honest deep-dive on Supabase — Postgres backend, auth, realtime, and self-hosting, including the 2026 Envoy gateway change and how it compares to Firebase.

In August 2026, self-hosted Supabase made its biggest infrastructure change in years: the default API gateway moved from Kong to Envoy. Kong's open-source line has effectively frozen, so the self-hosted stack now ships with Envoy as the default and Kong as an opt-in override for migration. It is a breaking change for anyone who relied on Kong's built-in HTTPS listener or a customized kong.yml.

That change is the occasion for a full review. Supabase is the most popular open-source Firebase alternative, and the question most developers ask is whether it holds up as a Postgres backend, an auth provider, and a self-hosted stack. This review covers what Supabase is, what changed in 2026, how each core feature behaves, how pricing compares to Firebase, and who should — and should not — adopt it.

What Supabase Is

Supabase is an open-source backend-as-a-service built on Postgres. Where Firebase gives you a NoSQL document store, Supabase gives you a real SQL database with a generated REST and GraphQL API on top. The project is maintained by Supabase Inc., sits at roughly 108,000 GitHub stars, and is licensed under Apache-2.0 — so the whole stack is self-hostable and inspectable.

The core building blocks map one-to-one to Firebase's, which is what makes it a credible migration target:

Database: Postgres, not a proprietary NoSQL store.
Auth: email/password, OAuth, magic links, and JWTs, backed by a auth.users table you can query directly.
Realtime: a Postgres-backed change stream for live updates.
Storage: S3-backed file storage with signed URLs.
Edge Functions: Deno-based serverless functions deployed globally.

The headline difference from Firebase is that everything runs on your own Postgres. Your data is a normal database you can inspect, join, and migrate, rather than a vendor-specific document format.

What Changed in 2026

The Envoy migration is the big one. Through 2025, self-hosted Supabase used Kong as its API gateway. Kong's OSS line stalled at version 3.9.1, and Supabase announced in July 2026 that Envoy would become the default, with Kong kept only as a compatibility override.

What that means in practice:

The default gateway now listens on plain HTTP on port 8000; Kong's :8443 HTTPS listener is gone from the default.
You terminate TLS with the shipped Caddy or Nginx overrides, which is the recommended production path.
Custom kong.yml config must be migrated to versioned YAML under volumes/api/envoy/.
If you have scripts or monitoring that reference the kong service name, they need to change.

For most self-hosters, the practical effect is positive: Envoy is config-as-code with no plugin runtime, and it removes a dependency on a frozen OSS line. But it is a real breaking change, and anyone running a customized gateway should read the migration guide before pulling the new compose files.

Feature Breakdown

Auth

Supabase's auth is one of its strongest pieces. It handles email/password, passwordless magic links, OTP, and a long list of social OAuth providers (Google, GitHub, and more) out of the box. Sessions are managed with JWTs, and the users live in a normal auth.users table, which makes it easy to join user data with your application tables.

Where it falls short: deeply custom auth flows — per-tenant SSO, complex SAML federation, or fine-grained role hierarchies — require Supabase Auth's enterprise features or a dedicated identity provider. Supabase Auth is simpler than Auth0 or Keycloak, but it is not a full enterprise IAM.

Database and APIs

Because the database is Postgres, you get SQL, joins, constraints, and migrations through the standard Postgres tooling. Supabase auto-generates a REST API via PostgREST and a GraphQL endpoint, plus client libraries for JavaScript, Dart/Flutter, and other platforms.

This is the biggest philosophical difference from Firebase. Firebase's query model is its own NoSQL DSL; Supabase's is SQL. If your team already knows SQL, Supabase removes a whole class of lock-in. If you are deep in Firebase's document model, the mental shift is real.

Realtime

Realtime subscriptions are implemented as Postgres change streams. You subscribe to table changes (INSERT/UPDATE/DELETE) and get pushed updates over WebSockets. It is a clean model — your "realtime" data is just rows in a table — but it is more limited than Firebase's first-class client-side sync with offline persistence. You will build more of that yourself.

Storage and Edge Functions

Storage is S3-compatible with signed URLs, which works well for user uploads. Edge Functions are Deno-based and deploy globally, though they are a younger surface than Firebase's mature Cloud Functions ecosystem.

Self-Hosting

Self-hosting is where Supabase earns its keep for privacy-minded teams. The official Docker Compose setup runs the whole stack — Postgres, auth, storage, realtime, and the gateway — on your own infrastructure. You own the data, and there is no per-seat vendor fee. The trade-off is operational: you run and upgrade a multi-container stack, and 2026 has brought several breaking changes you must track.

Pricing Comparison

The value equation differs by what you care about. Firebase's pay-as-you-go can be cheap at low usage but scales with traffic in ways that are hard to predict. Supabase's $25/month Pro tier is predictable, and the self-hosted option caps your infrastructure cost at whatever your server costs. The hidden cost of Supabase is operational time if you self-host.

Who Is Supabase For?

For teams that already know SQL: Supabase is the natural pick. You keep a real Postgres database, avoid a proprietary query model, and can migrate out if you ever want to.

For self-hosters: If data ownership or cost control matters more than a fully managed experience, Supabase's Apache-2.0 stack is one of the best-supported self-host options in this space. Expect to manage the stack and track breaking changes like the Envoy migration.

For Firebase switchers: The migration is real but not free. Auth, database, and storage map cleanly; realtime and offline sync do not. Budget time to rebuild client-side sync logic.

For teams that want zero ops: The managed Supabase cloud is a reasonable middle ground, but Firebase's fully managed model still wins if you want to never touch infrastructure.

Verdict

Supabase is a credible, actively maintained Firebase alternative, and in 2026 it is arguably the default open-source choice for a Postgres-backed backend. The strengths are real: SQL instead of a vendor store, first-class auth, a self-hostable Apache-2.0 stack, and predictable pricing.

The trade-offs are equally real. Realtime and offline sync are thinner than Firebase's, auth is not a full enterprise IAM, and self-hosting means owning the operational burden — including breaking changes like the Envoy gateway switch. None of these are dealbreakers; they are the cost of the control you get in return.

If your team values SQL, data ownership, and self-hosting, start with Supabase's free tier and deploy the self-hosted stack on a test box before committing. If you need Firebase's exact client-side sync semantics or a zero-ops cloud, Firebase remains the smoother path.

Browse the full set of open-source Firebase alternatives, or see other options in the backend and BaaS category and its self-hosted listings.

OpenElse Editorial — OpenElse is a curated directory of open-source and self-hostable alternatives to developer SaaS, from Notion and Auth0 to Firebase and GitHub Copilot.