Production Checklist

After developing your project and deciding it's production ready, you should run through this checklist to ensure that your project:

• Is secure
• Won't falter under the expected load
• Remains available whilst in production

Security#

The security checklist covers Row Level Security, SSL and network restrictions, account and organization access, Auth settings, and threat review. For the full list, see Production security checklist.

Performance#

• Ensure that you have suitable indices to cater to your common query patterns
  • Learn more about indexes in Postgres.
  • pg_stat_statements can help you identify hot or slow queries.
• Perform load testing (preferably on a staging env)
  • Tools like k6 can simulate traffic from many different users.
• Upgrade your database if you require more resources. If you need anything beyond what is listed in the compute and disk table, contact enterprise@supabase.io.
• If you are expecting a surge in traffic (for a big launch) and are on a Team or Enterprise Plan, contact support with more details about your launch and we'll help keep an eye on your project.
• If you expect your database size to be > 4 GB, enable the Point in Time Recovery (PITR) add-on in the Settings > Add-ons section of the dashboard.

Availability#

• Use your own SMTP credentials so that you have full control over the deliverability of your transactional auth emails in the Authentication > Emails > SMTP Settings section of the dashboard.
  • You can grab SMTP credentials from any major email provider such as SendGrid, AWS SES, etc. Read our SMTP guide for more setup details.
  • The default rate limit for auth emails when using a custom SMTP provider is 30 new users per hour. If you are doing a major public announcement, you will likely require more than this.
• We may pause applications on the Free Plan that exhibit low activity in a 7-day period to save on server resources.
  • You can restore paused projects from the Supabase dashboard.
  • Upgrade to Pro to guarantee that we won't pause your project for inactivity.
• Database backups are not available for download for Free Plan projects.
  • Read the Database Backups guide for more options and retention details.
  • If you need a lower recovery point objective (RPO), enable Point-in-Time Recovery (PITR). PITR allows you to back up a project at shorter intervals. This provides users an option to restore to any chosen point in time with second-level granularity.
• Supabase Projects use disks that offer 99.8-99.9% durability by default.
  • Use Read Replicas if you require availability resilience to a disk failure event
  • Use PITR if you require durability resilience to a disk failure event
• Upgrading to the Supabase Pro Plan gives you access to our support team.

Deployment#

• Connect your GitHub repository and enable Deploy to production in the integration settings to automate deployments from your main branch (set up the integration)
  • This ensures schema changes are deployed consistently and avoids manual supabase db push --remote from a local machine
• If you're on the Pro Plan, consider enabling branching to test migrations in a preview environment before they reach production

Rate limiting, resource allocation, & abuse prevention#

• Supabase employs a number of safeguards against bursts of incoming traffic to prevent abuse and help maximize stability across the platform
  • If you're on a Team or Enterprise Plan and expect high load events, such as production launches, heavy load testing, or prolonged high resource usage, open a ticket via the support form for help. Provide at least 2 weeks notice.

Auth rate limits#

• The table below shows the rate limit quotas on the following authentication endpoints. You can configure the authentication rate limits for your project in the Authentication > Rate Limits section of the dashboard.

Realtime limits#

• Review the Realtime limits.
• If you need limits increased, contact support.

Abuse prevention#

• Supabase provides CAPTCHA protection on the signup, sign-in and password reset endpoints. Read the Auth CAPTCHA guide for more details on how to protect against abuse using this method.

Email link validity#

• When working with enterprise systems, email scanners may scan and make a GET request to the reset password link or sign-up link in your email. Since links in Supabase Auth are single-use, a user who opens an email post-scan to click on a link will receive an error. To get around this problem, consider altering the email template to replace the original magic link with a link to a domain you control. The domain can present the user with a "Sign-in" button, which redirects the user to the original magic link URL when clicked.
• When using a custom SMTP service, some services might have link tracking enabled which may overwrite or deform the email confirmation links sent by Supabase Auth. To prevent this from happening, we recommend that you disable link tracking when using a custom SMTP service.