Can I use SupaHost for a mobile app?
Yes. Flutter, Swift, Kotlin and React Native apps use the regular Supabase client libraries with your SupaHost project URL. Notes on sign-in redirects, files and realtime for mobile.
Yes. A SupaHost project is a standard Supabase backend, so the official client libraries for Flutter, Swift, Kotlin and React Native (supabase-js) work unchanged. You give them your project URL and anon key, and use Auth, the Data API, Storage, Realtime and Edge Functions from the app, protected by Row Level Security.
Setting up the client
React Native with Expo:
import 'react-native-url-polyfill/auto'
import AsyncStorage from '@react-native-async-storage/async-storage'
import { createClient } from '@supabase/supabase-js'
export const supabase = createClient(
'https://app-one.acme.supahost.space',
process.env.EXPO_PUBLIC_SUPABASE_ANON_KEY!,
{ auth: { storage: AsyncStorage, autoRefreshToken: true, persistSession: true, detectSessionInUrl: false } }
)
Flutter:
await Supabase.initialize(
url: 'https://app-one.acme.supahost.space',
anonKey: const String.fromEnvironment('SUPABASE_ANON_KEY'),
);
final rows = await Supabase.instance.client.from('workouts').select().order('done_at');
Never ship the service_role key in an app bundle. Anyone can extract it.
Mobile-specific notes
Deep links work. Add your app's scheme, such as
com.example.fit://callback, to Redirect URLs on the Auth tab, or use an https URL that opens your app (iOS Universal Links, Android App Links). Or avoid redirects altogether with codes.Email codes avoid redirects. Every Auth email includes a one-time code, so users can type it into the app:
await supabase.auth.signInWithOtp({ email }) const { data, error } = await supabase.auth.verifyOtp({ email, token: code, type: 'email' })No phone/SMS sign-in. Use email, OAuth (Google, Apple and 17 more) or anonymous sign-ins, which suit "try before you sign up" flows.
Files. Uploads can be up to 50 MB each. There are no image transformations, so resize photos on the device before uploading.
Realtime in the background. Phones suspend sockets when the app is backgrounded. Resubscribe when the app returns to the foreground (see Silent disconnects when the app is in the background).
Pricing for mobile apps
SupaHost charges a flat price per instance, with no fees per monthly active user or Realtime connection. As a guide from load tests, Builder handles about 25,000 monthly active users, Pro about 50,000 and Business about 100,000 for a typical app.
FAQ
Can I use Sign in with Apple and Google natively?
Both are among the 19 OAuth providers you can enable in the Auth tab. The browser-based OAuth flow works with an https redirect that returns to your app.
Do I need my own backend for a mobile app?
Usually not. RLS secures direct queries, and Edge Functions handle anything that needs secrets, such as payments or push notification providers.
Does the app need to handle token refresh?
The client libraries refresh the access token for you. Access tokens last an hour by default; you can change that in the Sign-in & security card.