Supabase Complete Course — Roadmap

Phase 1: Foundations

• 1.1 What is Supabase — BaaS concept, Postgres-first architecture, why "just Postgres" matters
• 1.2 The 8 core pillars overview — Database, Auth, Storage, Realtime, Edge Functions, Data APIs, Vector/AI, Studio
• 1.3 Current platform state (2026) — new API key system, pg_graphql opt-in, recent major features
• 1.4 Next.js App Router project setup — installing packages, environment keys, browser vs server clients
• 1.5 Supabase CLI basics — local development, linking a project, running Supabase on your machine

Phase 2: Database (Postgres)

• 2.1 Schema design fundamentals — tables, columns, data types, constraints
• 2.2 Primary keys, foreign keys, and relationships (one-to-many, many-to-many)
• 2.3 Table Editor vs SQL Editor — when to use which
• 2.4 Database migrations — versioning your schema with the CLI
• 2.5 Row Level Security (RLS) — policies, auth.uid(), enabling/disabling, common mistakes
• 2.6 RLS patterns — ownership-based access, role-based access, public vs private data
• 2.7 Database functions and triggers — automating logic inside Postgres
• 2.8 Views and materialized views
• 2.9 Indexes and query performance basics
• 2.10 Connections and pooling — direct connection vs Supavisor (transaction/session mode) vs PgBouncer, choosing the right mode for serverless vs long-lived servers

Phase 3: Data API / Querying from Code

• 3.1 Query builder basics — select, filters (eq, gt, like, etc.), sorting, pagination
• 3.2 Insert, update, delete operations
• 3.3 Relational joins and nested queries
• 3.4 Error handling and typed responses with generated TypeScript types

Phase 4: Authentication

• 4.1 Auth fundamentals — sessions, JWTs, cookies, how Supabase Auth actually works
• 4.2 Email/password auth in Next.js App Router — signup, login, logout, email verification
• 4.3 Magic links and OTP (passwordless auth)
• 4.4 OAuth login (Google, GitHub, etc.) + middleware for protected routes
• 4.5 Multi-factor authentication (MFA)
• 4.6 User profiles — extending auth.users with a public profiles table
• 4.7 Custom claims and role-based access control (RBAC) at the auth level

Phase 5: Storage

• 5.1 Buckets — public vs private, creating and managing them
• 5.2 Upload/download files from Next.js (client and server)
• 5.3 Storage RLS policies — controlling who can access what
• 5.4 Image transformations (resizing, optimization) on the fly

Phase 6: Realtime

• 6.1 Postgres Changes — subscribing to inserts/updates/deletes
• 6.2 Broadcast — low-latency messaging between clients
• 6.3 Presence — tracking online users in a shared space

Phase 7: Edge Functions

• 7.1 Writing Edge Functions (Deno) — structure and local testing
• 7.2 Deploying and calling Edge Functions from Next.js
• 7.3 Common use cases — webhooks, secret API calls, background jobs

Phase 8: AI / Vector Features

• 8.1 pgvector basics — storing embeddings in Postgres
• 8.2 Building semantic search
• 8.3 Basic RAG (Retrieval-Augmented Generation) pipeline with Supabase + an LLM

Phase 9: Architecture, Production & Scaling

• 9.1 Auto-generated TypeScript types — keeping frontend types in sync with the database
• 9.2 Database webhooks — triggering external actions on data changes
• 9.3 Scheduled jobs with pg_cron
• 9.4 Backups, point-in-time recovery, and database branching
• 9.5 Multi-tenancy patterns — shared schema with RLS vs schema-per-tenant vs project-per-tenant
• 9.6 Logs, monitoring, and the Unified Logs dashboard
• 9.7 Security checklist before going to production (RLS audit, key rotation, rate limits, exposed service_role/secret key risks)
• 9.8 Deployment — connecting Supabase + Next.js to Vercel, environment management
• 9.9 Shared responsibility model & choosing when to self-host vs use Supabase Cloud