# Can I use SupaHost for a mobile app?

> Yes. Flutter, Swift, Kotlin and React Native apps use the regular Supabase client libraries with your SupaHost project URL. Notes on sign-in redirects, files and realtime for mobile.

Source: https://supahost.app/kb/mobile-app-database · Updated 2026-11-11

Yes. A SupaHost project is a standard Supabase backend, so the official client libraries for Flutter, Swift, Kotlin and React Native (supabase-js) work unchanged. You give them your project URL and `anon` key, and use Auth, the Data API, Storage, Realtime and Edge Functions from the app, protected by Row Level Security.

## Setting up the client

React Native with Expo:

```ts
import 'react-native-url-polyfill/auto'
import AsyncStorage from '@react-native-async-storage/async-storage'
import { createClient } from '@supabase/supabase-js'

export const supabase = createClient(
  'https://app-one.acme.supahost.space',
  process.env.EXPO_PUBLIC_SUPABASE_ANON_KEY!,
  { auth: { storage: AsyncStorage, autoRefreshToken: true, persistSession: true, detectSessionInUrl: false } }
)
```

Flutter:

```dart
await Supabase.initialize(
  url: 'https://app-one.acme.supahost.space',
  anonKey: const String.fromEnvironment('SUPABASE_ANON_KEY'),
);
final rows = await Supabase.instance.client.from('workouts').select().order('done_at');
```

Never ship the `service_role` key in an app bundle. Anyone can extract it.

## Mobile-specific notes

- **Deep links work.** Add your app's scheme, such as `com.example.fit://callback`, to **Redirect URLs** on the **Auth** tab, or use an https URL that opens your app (iOS Universal Links, Android App Links). Or avoid redirects altogether with codes.
- **Email codes avoid redirects.** Every Auth email includes a one-time code, so users can type it into the app:

  ```ts
  await supabase.auth.signInWithOtp({ email })
  const { data, error } = await supabase.auth.verifyOtp({ email, token: code, type: 'email' })
  ```

- **No phone/SMS sign-in.** Use email, OAuth (Google, Apple and 17 more) or anonymous sign-ins, which suit "try before you sign up" flows.
- **Files.** Uploads can be up to 50 MB each. There are no image transformations, so resize photos on the device before uploading.
- **Realtime in the background.** Phones suspend sockets when the app is backgrounded. Resubscribe when the app returns to the foreground (see [Silent disconnects when the app is in the background](/kb/realtime-background-disconnects)).

## Pricing for mobile apps

SupaHost charges a flat price per instance, with no fees per monthly active user or Realtime connection. As a guide from load tests, Builder handles about 25,000 monthly active users, Pro about 50,000 and Business about 100,000 for a typical app.

## FAQ

### Can I use Sign in with Apple and Google natively?

Both are among the 19 OAuth providers you can enable in the **Auth** tab. The browser-based OAuth flow works with an https redirect that returns to your app.

### Do I need my own backend for a mobile app?

Usually not. RLS secures direct queries, and Edge Functions handle anything that needs secrets, such as payments or push notification providers.

### Does the app need to handle token refresh?

The client libraries refresh the access token for you. Access tokens last an hour by default; you can change that in the **Sign-in & security** card.

## Related

- [Use SupaHost with React Native and Expo](/docs/getting-started/react-native-expo)
- [Use SupaHost with Flutter](/docs/getting-started/flutter)
- [Site URL and redirect URLs](/docs/auth/redirect-urls)
- [Magic links and email OTP](/docs/auth/magic-links-otp)