Database / Supabase basics Interview Questions
1. What is Supabase?
Supabase is an open-source backend-as-a-service platform built directly on top of managed PostgreSQL. Rather than a proprietary database engine, it exposes standard Postgres with a layer of ready-made tooling on top: authentication, auto-generated REST and GraphQL APIs, file storage, realtime sub...
2. What is the purpose of PostgreSQL within Supabase?
PostgreSQL is the actual database engine that stores every table, row, and relationship in a Supabase project — it is not a thin wrapper or a Postgres-compatible clone. Every feature Supabase adds, such as auth or storage, is implemented as ordinary Postgres tables, functions, or extensions...
3. What are the core services offered by Supabase?
A Supabase project bundles several services around one Postgres database. The main ones are: a managed Postgres Database , Auth for user sign-up and session management, auto-generated APIs (REST and GraphQL), Storage for files, Realtime for live data streaming, and Edge Functions for custom serve...
4. What is Supabase Authentication used for?
Supabase Auth handles user identity: sign-up, login, session/token management, and password resets, without a developer needing to build that infrastructure from scratch. It supports email/password, magic links, phone OTP, and third-party OAuth providers such as Google or GitHub. Every authentica...
5. What are the types of storage available in Supabase Storage?
Supabase Storage organizes files into buckets , and each bucket can be configured as one of two types. Public buckets serve files over a direct URL to anyone, which suits assets like public profile images or marketing media. Private buckets require an authenticated request and are governed by acc...
6. Define Row Level Security in Supabase?
Row Level Security (RLS) is a native PostgreSQL feature that restricts which rows a given database role can see or modify, enforced by the database engine itself rather than by application code. Supabase turns this into its primary authorization model. Because RLS runs inside Postgres, it holds e...
7. Describe the Supabase client library?
The Supabase client library (available for JavaScript, Python, Dart, Swift, and others) is an SDK that wraps the project's auto-generated REST API behind a query-builder syntax, so a developer writes chained methods like .from('posts').select('*').eq('published', true) instead of hand-crafting HT...
8. What is the purpose of Supabase Edge Functions?
Edge Functions let you run custom TypeScript/JavaScript server-side code that isn't a natural fit for a database query — things like calling a third-party payment API, sending a webhook, or performing logic that needs a secret key the client should never see. They're deployed close to users...
9. List the API types Supabase auto-generates from your schema?
From a single Postgres schema, Supabase automatically exposes two API styles without extra configuration: REST (via PostgREST) — every table and view becomes a resource you can query with filters, ordering, and pagination through URL parameters. GraphQL (via pg_graphql) — the same sch...
10. How do you create a new Supabase project and connect to it?
A new project is created either from the Supabase dashboard (choosing an organization, region, and database password) or from the CLI, which is common for teams that keep infrastructure in version control. npx supabase init npx supabase login npx supabase link --project-ref your-project-ref npx s...
11. How does Supabase auto-generate REST APIs from a database schema?
Supabase runs PostgREST, a standalone server that introspects your Postgres schema at startup and turns every table, view, and stored procedure into a REST resource on the fly — there's no code generation step or API definition file to maintain. A table named posts with columns id , title ,...
12. Why is Row Level Security important in a client-facing Supabase app?
In a typical Supabase app, the frontend talks to the database almost directly through the auto-generated API using a public anon key that ships inside the client bundle. Without RLS, that key alone would be enough for anyone to read or modify every row in every table. RLS closes that gap by movin...
13. How does Supabase Realtime broadcast database changes to clients?
Supabase Realtime listens to Postgres's built-in logical replication stream (the same mechanism used for replication to standby servers) and converts row-level INSERT, UPDATE, and DELETE events into messages pushed over WebSockets to subscribed clients. A client subscribes to a channel scoped to ...
14. What is the difference between the anon key and the service role key in Supabase?
Both are API keys generated per project, but they carry very different levels of trust and belong in very different places. anon key service_role key Safe to expose in frontend/client code Must stay server-side only, never shipped to clients Subject to Row Level Security policies Bypasses Row Lev...
15. When should you use an Edge Function instead of a Postgres database function?
Both let you run custom logic, but they suit different jobs. A Postgres function (written in SQL or PL/pgSQL and callable via RPC) is the right choice when the logic is fundamentally about data: aggregations, multi-table transactions, or anything that benefits from running inside the database's o...
16. How do you troubleshoot a valid query being blocked by Row Level Security?
The first step is confirming RLS is actually the cause: querying the same table with the service_role key (server-side only, for debugging) bypasses RLS entirely, so if that query succeeds while the client's fails, the policy is the culprit rather than the query itself. From there, check three co...
17. What is the difference between using Supabase Auth and rolling your own JWT-based authentication?
Supabase Auth is a managed identity service: it stores users in auth.users , issues and refreshes JWTs, handles password hashing and reset flows, and wires several OAuth providers, all pre-integrated with Row Level Security so auth.uid() is available inside your policies for free. Rolling your ow...
18. How is data validated before insertion in a Supabase table?
Validation in Supabase typically happens in layers rather than one place. At the database level, Postgres constraints ( NOT NULL , CHECK , UNIQUE , foreign keys) reject structurally invalid rows regardless of which client sends them, making them the most reliable layer since they can't be bypasse...
19. Why do we use database migrations in Supabase projects?
Migrations are versioned, ordered SQL files that describe every schema change — new tables, altered columns, new RLS policies — so the database structure can be recreated deterministically instead of relying on manual dashboard edits that nobody tracked. With the Supabase CLI, running...
20. What happens when a Postgres trigger fires on a table linked to Edge Function webhooks?
A database webhook is really just a trigger wired to fire on INSERT, UPDATE, or DELETE for a specific table; when the triggering statement commits, Postgres sends an HTTP POST containing the changed row's data (and, for updates, the previous values) to a configured URL, commonly an Edge Function ...
21. Explain the execution flow of a request through Supabase's auto-generated API?
When a client calls supabase.from('posts').select('*') , the request travels through several distinct layers before a row ever comes back. The client SDK builds an HTTP GET request to /rest/v1/posts , attaching the API key and, if the user is signed in, an Authorization: Bearer
22. Why doesn't Supabase recommend using the service_role key on the client?
The service_role key is designed to connect to Postgres as a role that has RLS_bypass privileges built in — it doesn't just have broad permissions, it explicitly skips the Row Level Security checks that every other connection is subject to. That makes it functionally equivalent to a databas...
23. How can you optimize Postgres connection pooling for serverless Edge Functions?
Serverless functions scale by spinning up many short-lived instances, and each one that opens a direct Postgres connection can quickly exhaust Postgres's fairly low default connection limit (often in the low hundreds), since Postgres allocates real memory per connection rather than using lightwei...
24. Explain the internal working of Row Level Security policy evaluation in Postgres?
When RLS is enabled on a table, Postgres doesn't run policies as a separate pass after fetching rows — it rewrites the query plan so that each policy's USING expression is folded in as an additional filter condition, conceptually similar to an implicit AND clause appended to the query's WHE...
25. What is the difference between pgvector similarity search and hybrid search in Supabase?
pgvector is a Postgres extension that adds a vector column type and distance operators (cosine distance, L2, inner product) so you can store embeddings alongside your relational data and query them with SQL, for example: create extension if not exists vector; create table documents (id bigserial ...
26. Which is better for real-time collaboration, Supabase Realtime or client-side polling, and why?
Polling means the client repeatedly re-runs a query on an interval (say, every 3 seconds) to check for changes, while Supabase Realtime pushes a message over an already-open WebSocket the instant a matching row changes. For most collaborative use cases — shared cursors, live comments, prese...
27. How does Supabase handle connection pooling for high-concurrency workloads?
Supabase runs Supavisor, a Postgres-aware connection pooler, in front of every project's database. Instead of each application instance opening its own direct Postgres connection — which is expensive because Postgres spawns a full backend process per connection — clients connect to Su...
28. Explain the lifecycle of a Supabase Auth session token?
When a user signs in, Supabase Auth issues two tokens: a short-lived access token (a JWT, typically valid for about an hour) that's sent with every API request to prove identity, and a longer-lived refresh token that's used only to obtain a new access token once the current one expires. The acces...
29. When would you choose self-hosting Supabase over the managed cloud offering?
Because Supabase's stack is fully open source, self-hosting is a real option, not just a fallback, and the deciding factor is usually a specific constraint the managed cloud can't satisfy rather than cost alone. Data residency and compliance requirements are a common driver: an organization that ...
30. How do you optimize full-text search performance on a large Postgres table in Supabase?
Postgres's full-text search works by converting text into a tsvector — a normalized, stemmed representation of the words in a column — and comparing it against a tsquery built from the search terms. On a small table this works fine unindexed, but on a large table, computing that tsvec...
