Deploy Supabase Auth

Deploy and Host self hosted Supabase Auth (Open-Source Backend) on Railway

This template deploys self hosted Supabase Auth via GoTrue. Email signup is on and autoconfirm on (no SMTP), so anyone can sign up. For production set SMTP vars, disable autoconfirm, add OAuth env vars, and use RLS with auth.uid(). Keep service_role key server-side.

About Hosting Supabase Auth open-source software on Railway (self hosted Supabase template)

This template runs the self-hosted Supabase stack on Railway, including supabase/gotrue v2.196.0 for auth, Postgres 17.6.1.136 for users and RLS, PostgREST, Realtime, Storage, Edge Runtime, and Studio.

Why Deploy Supabase Auth, the Firebase Auth alternative on Railway (Railway Free Trial)

Firebase Auth is convenient until you need Postgres, raw SQL, or predictable pricing at scale; self-hosting Supabase Auth puts GoTrue on your own database, so you own the user table and can tune email flows.

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Supabase Auth on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

Railway vs Other Hosting Providers and VPS for Supabase Auth self hosting

Railway wires the auth service to the gateway and db; these providers leave that wiring to you.

Railway removes the VPS setup steps.

Common Use Cases for hosted Supabase Auth

• SaaS password and magic link login: Turn on real email delivery with GOTRUE_SMTP_HOST and GOTRUE_MAILER_AUTOCONFIRM=false so signups confirm before data access.
• Developer tool GitHub OAuth: Add GOTRUE_EXTERNAL_GITHUB_ENABLED=true plus client ID, then let developers sign in with their GitHub account and map identity to RLS policies.
• Invite-only internal admin: Set GOTRUE_DISABLE_SIGNUP=true and send email invites through the auth service, so only approved staff create accounts.
• Per-user row security: Write RLS policies using auth.uid() on your Postgres tables, so each user's token limits rows to their own tenant or profile.
• Firebase Auth migration: Move existing Firebase Auth users by exporting and importing them into the auth.users table, then switch supabase-js calls to this self-hosted endpoint.

Dependencies for Supabase Auth Docker hosted on Railway

Auth is not standalone. No auth volume is needed; users live in Postgres. The only persistent storage volumes belong to db, storage, and studio.

Deployment Dependencies for Managed Supabase Auth Service (Backend as a Service)

The template ships nine services, but auth only needs the db service, the gateway route, and a shared GOTRUE_JWT_SECRET. By default GOTRUE_MAILER_AUTOCONFIRM is true because no SMTP is configured, so anyone can sign up without confirming.

Implementation Details for Supabase Auth (Using Supabase official docker image)

Auth uses the official supabase/gotrue image and is configured only through auth service environment variables. Studio does not manage provider or email settings, so you edit variables and redeploy. Row level security uses auth.uid(), which requires the JWT secret to match across services.

How does Supabase Auth compare against other backend as a service platforms

Supabase Auth vs Firebase Auth (Google's Auth Service)

• Postgres vs NoSQL: Users live in the Postgres auth schema, so RLS with auth.uid() works directly. Firebase keeps auth data separate from Firestore.
• Open source: Apache-2.0 and self-hostable on Railway, no vendor lock-in. Firebase is proprietary Google infrastructure.
• Firebase wins: First-party mobile SDKs and Google Sign-In integration are smoother out of the box.

Supabase Auth vs Auth0 (Okta's Identity Platform)

• Hosting model: Auth0 is paid SaaS per active user; self-hosted Supabase Auth has flat infrastructure costs.
• Database integration: Auth sits on Postgres, making row-level security per user natural. Auth0 needs separate token bridging to your database.
• Auth0 wins: Enterprise SSO federation, organizations, and compliance certifications are more mature.

Supabase Auth vs Clerk (React Auth SaaS)

• Backend coupling: Clerk is frontend-first for React and Next.js; Supabase Auth is backend-first with Postgres and RLS.
• Self-hosting: Clerk is closed cloud-only; Supabase Auth is open-source and runs on your own Railway project.
• Clerk wins: Prebuilt React components and session management are more polished than lower-level supabase-js calls.

Supabase Auth vs Keycloak (Open-Source Identity Server)

• Footprint: Keycloak is a heavy Java identity server with its own admin console; Supabase Auth is a lightweight Go service that starts fast.
• Scope: Keycloak handles SAML, LDAP, and complex federation; Supabase Auth covers common email, password, and OAuth flows plus Postgres RLS.
• Keycloak wins: More protocols and enterprise identity brokering out of the box.

How to use Supabase Auth (the OSS Firebase alternative)?

1. Log into Studio with username supabase and your DASHBOARD_PASSWORD.
2. Pick an SMTP provider and set GOTRUE_SMTP_HOST, GOTRUE_SMTP_PORT, GOTRUE_SMTP_USER, and GOTRUE_SMTP_PASS on the auth service.
3. Set GOTRUE_MAILER_AUTOCONFIRM=false and GOTRUE_SITE_URL to your app URL.
4. Add your app URLs to GOTRUE_URI_ALLOW_LIST.
5. Create a GitHub OAuth app with callback https://your-domain/auth/v1/callback, then set GOTRUE_EXTERNAL_GITHUB_ENABLED=true, GOTRUE_EXTERNAL_GITHUB_CLIENT_ID, GOTRUE_EXTERNAL_GITHUB_SECRET, and GOTRUE_EXTERNAL_GITHUB_REDIRECT_URI.
6. Redeploy auth.
7. Call supabase.auth.signInWithOAuth from supabase-js and protect tables with RLS using auth.uid().

How to self host Supabase Auth on other VPS Services (Supabase self hosting guide)

Clone the Repository

On a VPS with Docker and 4 GB RAM or more, clone the upstream stack shallowly:

git clone --depth 1 https://github.com/supabase/supabase
cd supabase/docker

Install Dependencies

Docker Engine and Docker Compose v2 are all you need. Pull the images before you edit secrets so you see what is actually there:

docker compose pull

Configure Environment Variables

Copy .env.example to .env and change every secret, especially JWT_SECRET, POSTGRES_PASSWORD, DASHBOARD_PASSWORD. The auth service runs supabase/gotrue v2.196.0 with email signup on and GOTRUE_MAILER_AUTOCONFIRM=true by default.

Start the Supabase Auth Application

docker compose up -d

Then open the gateway domain and log into Studio with supabase and DASHBOARD_PASSWORD. Railway handles this multi-service compose setup, secret generation, persistent volumes, and deploy logs for you.

Official Pricing of Supabase Auth (Supabase pricing)

Supabase Auth is Apache-2.0 open source, so self-hosting the auth service costs nothing for the software itself. You pay only for infrastructure, like your Railway services. On Railway, a small self-hosted stack typically runs about 20-40 USD per month at light use.

Supabase Auth cloud vs self hosted comparison (Pricing, features, costs, and more)

Self-hosting Supabase Auth on Railway trades a predictable monthly bill for more setup work, but you keep the same GoTrue engine and Postgres auth schema. The main differences are cost control, provider configuration, and who owns the SMTP and OAuth credentials.

Monthly cost of self hosting Supabase Auth on Railway

Expect roughly 20-40 USD/mo for all nine services at light use, and more as Postgres grows. Railway's 5 USD trial covers early testing. Supabase Cloud starts free, then Pro from 25 USD/mo per org, but self-hosting avoids per-project and compute credit pricing.

System Requirements for Hosting Supabase Auth on a VPS

Upstream Supabase recommends at least 4 GB RAM for a full self-host. Start with small instances and scale the db volume and RAM as user counts climb.

Frequently Asked Questions (FAQs)

Why are users confirmed without receiving an email?

Because GOTRUE_MAILER_AUTOCONFIRM defaults to true when no SMTP is configured. This skips confirmation for testing; set it to false and add SMTP variables for production.

Why does my OAuth redirect fail?

The callback must be https://your-domain/auth/v1/callback, and your provider's redirect URI must match exactly. Also set API_EXTERNAL_URL to your public domain and add allowed URLs to GOTRUE_URI_ALLOW_LIST.

Can I enable providers in the Studio dashboard?

No. Self-hosted Studio does not manage auth provider settings. Add GOTRUE_EXTERNAL_PROVIDER_ENABLED, _CLIENT_ID, _SECRET, and _REDIRECT_URI variables on the auth service and redeploy.

How do I make signup invite-only?

Set GOTRUE_DISABLE_SIGNUP=true. Existing users can still log in, but new public signups are blocked; you can create users via the admin API or service_role key.

Which SMTP providers work with GoTrue?

Any provider that supports SMTP works, including Postmark, SendGrid, Mailgun, or Amazon SES. Configure GOTRUE_SMTP_HOST, _PORT, _USER, _PASS, and _ADMIN_EMAIL, then disable autoconfirm.

Where are users stored?

Users live in the auth schema of the db service, specifically auth.users. RLS policies reference auth.uid() to scope data per user.