Supabase
Supabase is an open-source platform that offers a Postgres database, Authentication, APIs, Edge Functions, Realtime subscriptions, Storage, and Vector embeddings for project development.
What detecting Supabase tells you about a site
Supabase is an open-source backend-as-a-service — a managed Postgres database with auto-generated REST/GraphQL APIs, auth and storage. You detect it client-side: requests to a *.supabase.co project host, the supabase-js SDK in the bundle, an apikey/Authorization: Bearer anon-key pattern on those calls, and sb-*-auth-token cookies/localStorage from its auth layer. Spotting it tells you a team — often a startup or solo builder — that skipped writing a backend and let Supabase handle the database, auth and storage so they could ship a front end fast.
Supabase in a real-world stack
When you find Supabase, it rarely travels alone. Postgres at the core (with row-level security), commonly behind a Next.js, SvelteKit or React Native front end.
About
Supabase is an open-source platform that offers a Postgres database, Authentication, APIs, Edge Functions, Realtime subscriptions, Storage, and Vector embeddings for project development.
Categories: Development
Quick facts
How we detect Supabase
Sourcemap Explorer carries 8 fingerprint signals for Supabase, spread across 3 channels — javascript global, script src url and dom selector. The exact patterns are listed below, and you can replay each one in Chrome DevTools to confirm a match by hand.
Each signal alone is rarely conclusive — Sourcemap Explorer cross-references all of them and weights by confidence. You can reproduce any of these checks yourself in Chrome DevTools.
Window-level global the technology installs on page. Reproducible by typing the path into the DevTools console.
window.__NUXT__.config.public.SUPABASE_URL
window.__NUXT__.config.public.supabase
window.createClient = supabase\.
window.supabase.AuthAdminApi
window.supabase.storageKey
Script URL pattern. Typically a CDN host or chunk path that ships with the technology.
cdn\.supabase\.com
\.supabase\.co/
A DOM selector that only this technology's pages render. Verified at runtime by the content script.
a[href*='supabase.com'] > img[src*='/supabase-logo-wordmark\-\-dark.png']
Implies
When Supabaseis detected, Sourcemap Explorer also marks the following technologies as present (Wappalyzer's implies graph).
FAQ
How do I check if a website is using Supabase?
Open the page in Chrome, click the Sourcemap Explorer toolbar icon, and read the Stack tab. Supabase's specific fingerprints here are javascript global, script src url and dom selector, and the popup flags Supabase whenever any combination of them is found. The same checks can be reproduced manually in DevTools — see the "How we detect" section above.
What Supabase version can Sourcemap Explorer detect?
Supabase ships as a hosted development rather than a bundled npm package, so version-specific detection isn't always possible. Where the platform leaks a version in response headers (`X-Powered-By`, `Server`, generator meta tags) we surface it; otherwise we report presence only.
Is Supabase open source?
Yes, Supabase is open source. The license details are listed on the official site (https://supabase.com), and the codebase typically lives on a public source-control host.
How much does Supabase cost?
Supabase's pricing model is documented as: freemium, payg, recurring. Detection is independent of the pricing tier — Sourcemap Explorer flags the technology by its fingerprints, regardless of which paid plan a site is on. See the official site for the current pricing page.
Where can I read more about Supabase?
Official site: https://supabase.com. For Sourcemap Explorer's detection guide, see the deep-dive link below or the related guides in the cross-link section.
Detected by Sourcemap Explorer
Open the popup on any page running Supabaseand you'll see the exact version pulled from the bundled package.json when sourcemaps are exposed.