Glossary
The product's terms in plain English, with an anchor for every entry and notes on the pairs that are easiest to confuse.
How to read this glossary
Definitions are written for someone using the manager for the first time. Where a term has a precise meaning in the code, the definition follows the code rather than the marketing. Each entry is anchored so other pages can link to it directly.
The terms are grouped by their first letter. If you are looking for a task rather than a definition, start with the feature tour or the quick start.
Terms
A
- Admin account
- A manager account that signs in to the dashboard. It is separate from a managed project's own auth users and can reach admin settings.
- Anon key
- A project's public API key. It is safe to ship in a browser only because row-level security decides what the key can read and write.
- API docs
- The generated OpenAPI reference for a project, built from its live schema and rendered with Swagger UI and client snippets.
- Auth user
- An account in a managed project's own GoTrue service. Auth users sign in to the project, not to the manager.
B
- Backup
- A SQL dump of a project database, written under the project's supabase/backups directory and listed by the manager.
- Base domain
- The parent domain used by the subdomain proxy, so a project resolves as slug.base-domain.
- Bucket
- A storage container in a project. Its visibility is a bucket-wide setting; its policies govern operations.
C
- Check constraint
- A database rule that rejects rows which do not satisfy a boolean expression.
- CSRF token
- A per-session token required on cookie-authenticated state changes, so another site cannot act with the user's session.
- Catalog
- The set of system tables that describes a Postgres database's schemas, tables, columns, indexes and constraints.
- Container
- One Docker process in a project's stack, such as Postgres, the gateway or Studio. A project is running when its containers are.
D
- Database link
- The 16-character identifier in a front-door URL that resolves a request to one project.
- Database port
- The host port assigned to a project's Postgres service inside its reserved block.
- Docker
- The container runtime that runs each project's Supabase stack. The manager interface runs without it; projects do not.
E
- Edge function
- A small function served by the project's edge runtime. The manager can edit, deploy and invoke it from the Functions page.
- Edge inspector
- The debugging endpoint for a project's edge runtime, at the final offset in each port block.
- Edge runtime
- The service that executes a project's edge functions, with its own host port in the block.
- Environment file
- The git-ignored .env file created by setup, holding the manager's configuration and generated keys.
F
- Front door
- The single path-routed entry point on port 6000 that forwards requests to a project's Kong gateway or Studio.
G
- Gateway
- The Kong proxy in front of a project's services. It owns the REST, auth, storage, realtime, functions and related paths.
- GoTrue
- The authentication service in a Supabase stack. Its users are the project's auth users.
H
- Health check
- A live probe of a project's services. A failed probe produces an unknown state rather than a fabricated healthy one.
- Host routing
- Resolving a project from the HTTP Host header through the subdomain proxy on port 9000.
- Health
- The observed state of a service. The manager reports a service as unknown when a health probe fails rather than assuming it is well.
I
- Inbucket
- The mail catcher in a Supabase stack, useful for testing sign-up and recovery emails locally.
J
- JWT
- A signed JSON Web Token. The manager uses one for its session cookie; projects use them for API keys and auth sessions.
- JWT verification
- A function setting that decides whether a caller must present a valid project JWT before the function runs.
L
- Log source
- One of six services a project's log explorer can query: gateway, auth, database, storage, realtime and functions.
- Lock
- A database state in which a file cannot be read or written safely. The manager database is rewritten whole, so copying it while running can produce an inconsistent copy.
M
- Manager database
- The SQLite database that holds projects, users, settings, port allocations and encrypted vault rows.
- Migration
- A versioned SQL change stored in a project's supabase/migrations directory and applied through the CLI.
- Manager port
- The port that serves the dashboard, the management API and the WebSocket, bound to loopback by default.
O
- Observability
- Traffic views for API, database, auth, storage, realtime and edge-function requests over a selected time range.
P
- Path routing
- Resolving a project from the first URL segment through the front door on port 6000.
- PgBouncer
- A connection pooler. One shared pooler listens on 6432; each project also has a project-local pooler port.
- Policy
- A row-level security rule attached to a table, combining a command, a role and USING or WITH CHECK expressions.
- Port band
- The 60000 range from which every project's 11-port block is allocated.
- Port block
- The 11 contiguous host ports owned by one project, from gateway through edge inspector.
- Port offset
- The fixed position of a service within a block: api 0, db 1, shadow 2, studio 3, and so on to edge_inspector 10.
- Port slot
- The multiplier in the allocation formula. Slot n yields the block starting at 60000 + 11n.
- Postgres
- The database engine inside every Supabase project. Its data lives in the project's Docker volumes.
- postgres-meta
- The service that exposes a project's Postgres catalog to the Studio and the manager's explorer.
- Preflight
- The checks run before a project start: path, Docker and port ownership.
- Project
- A local Supabase folder registered with the manager, with its own status, port block and workbench.
- Publication
- The Postgres publication that decides which table changes the realtime service delivers.
- Proxy
- A service that forwards a request to another service. The manager has a front door, a subdomain proxy and a shared pooler.
- Publication
- The Postgres publication that decides which table changes the realtime service delivers; a table outside it produces no change events.
R
- Realtime
- The service that streams database changes and broadcast messages over WebSocket channels.
- RLS
- Row-level security: Postgres policies that filter rows per role and per operation.
- RLS test
- A sandbox that runs a probe query as a chosen role to show what that role would receive.
- Role
- A Postgres identity used for permissions. The SQL editor can run a query as a selected role.
S
- Service health
- Per-service status for gateway, Postgres, Studio, auth, storage, realtime, mail and edge runtime.
- Service-role key
- A project key that bypasses row-level security. It is a server credential and must never ship to a browser.
- Session
- A signed manager login or a project auth login. Manager sessions live in an httpOnly cookie.
- Stack
- One project's running set of Supabase containers, started and stopped through the Supabase CLI.
- Storage object
- A file stored in a bucket, addressable by a signed or public URL according to the bucket and its policies.
- Studio
- The Supabase Studio interface for a project. The front door sends non-gateway paths to it.
- Subdomain proxy
- The host-routed entry point on port 9000 that resolves a project from its subdomain.
- Schema
- A namespace inside Postgres that groups tables and other objects. Supabase projects ship several, including public, auth and storage.
T
- Template
- A saved project description that can create a matching project and be exported or imported.
V
- Vault
- The encrypted store for project and edge-function secrets, keyed by VAULT_MASTER_KEY.
- Vault master key
- The key that encrypts stored secrets. Losing it makes vault rows unreadable; rotating it needs the previous key retained.
- View
- A saved query that behaves like a table for reading. Views appear in the database explorer beside tables.
W
- Webhook
- A database trigger target that sends an HTTP request when a table changes.
- Wrapper package
- The backend workspace packages/supabase-wrapper, which owns the API, proxy, lifecycle, allocator and database.
Terms that are easy to confuse
Front door versus subdomain proxy. Both are entry points and both apply the same access policy. The front door routes by path on port 6000; the subdomain proxy routes by host on port 9000.
Manager account versus auth user. A manager account signs in to the dashboard. An auth user signs in to one managed project. They are separate stores with separate passwords and separate sessions.
Port band versus port block. The band is the whole 60000 range. A block is the 11 ports one project owns inside it.
Anon key versus service-role key. Both are project keys. The anon key is subject to row-level security and is safe for a browser; the service-role key bypasses it and belongs on a server.
Template versus backup. A template captures configuration and migrations for a new project. A backup captures a database's data for restoring the existing project.