Supabase Provider

Overview

Use this preset to provision an OTA server on Supabase. For a new app, start with Choose infrastructure. Provision the provider resources here, then connect your app with the verified URL and key.

Prerequisites

You need the following resources and access. An AI agent can prepare missing resources through its available provider tools.

• Node.js: The CLI requires 20.19+. Agent setup uses a client-key helper that requires Node 22.18+ or Node 24+; prepare it before provisioning resources.
• Supabase CLI (terminal setup): Install it via npx supabase.
• Supabase Account: Sign up at Supabase if you don't have one.

Docker or OrbStack is needed only when you choose to run Supabase locally; the managed remote init flow does not require a local container runtime.

Step 1: Install required packages

Complete Install packages in the React Native project before running init or an agent scaffold. Install the CLI, React Native SDK, and the build adapter that matches your app, then install this provider:

npm install @hot-updater/supabase --save-dev

An agent can perform these steps after inspecting the app's package manager and build configuration.

Step 2: Configure Supabase

Choose how to set up Supabase:

$hot-updater Set up infrastructure on Supabase for this project.

After setup, review the local configuration. Interactive init writes the settings below to .env.hotupdater; an agent merges the needed settings into your project. Project and function selections are persisted for deterministic reruns. Personal access tokens and database passwords are included only when needed and when you consent to persistence; project-creation inputs appear only when a project is created.

HOT_UPDATER_SUPABASE_PROJECT_ID=your-project-id
HOT_UPDATER_SUPABASE_FUNCTION_NAME=hot-updater-v1
HOT_UPDATER_SUPABASE_SERVICE_ROLE_KEY=your-service-role-or-secret-key
HOT_UPDATER_SUPABASE_BUCKET_NAME=your-bucket-name
HOT_UPDATER_SUPABASE_URL=https://your-project-id.supabase.co
HOT_UPDATER_API_KEY=your-api-key
# Conditional credentials/create-only values may include:
SUPABASE_ACCESS_TOKEN=your-personal-access-token
HOT_UPDATER_SUPABASE_DB_PASSWORD=your-database-password
HOT_UPDATER_SUPABASE_PROJECT_NAME=your-new-project-name
HOT_UPDATER_SUPABASE_ORGANIZATION_SLUG=your-organization-slug
HOT_UPDATER_SUPABASE_REGION=your-region

Managed init reuses HOT_UPDATER_API_KEY when supplied or creates an API key, registers it in Postgres, and persists the plaintext value locally. Send this API key in the app's x-api-key request header. To list, add, or revoke keys later, run hot-updater api-key from the app directory.

Optional: Bundle signing

Managed Supabase init does not create or enable a signing key. After provisioning the OTA infrastructure, configure local PEM, AWS KMS, or Google Cloud KMS signing, embed its public key in a native release, and only then deploy signed bundles. Storage and database selection does not constrain the signer. KMS signing runs directly in the protected deploy job; no Edge Function proxy is required. A compatible signing service can also be used through remoteSigning.

Step 3: Add HotUpdater to your project

After provisioning, record these outputs for Set up your app:

Use the actual URL returned by deployment. Configure the SDK and native bundle loader through Set up your app, using the selected build adapter and the same update strategy as hot-updater.config.ts. Only the client API key belongs in the mobile app's build-time configuration; provider credentials stay in the deploy environment.

Generated configuration and operations

Init generates hot-updater.config.ts with your Supabase storage and database, and plugins: the server plugins the managed Edge Function runs, apiKeys(), insights(), and remoteConfig(), imported from hot-updater/plugins. The CLI and the Console reach your Supabase project through these settings and run the same plugins as the Edge Function. The managed Edge Function runs these official plugins only; to run other server plugins, use a custom server.

On a rerun, init updates storage, database, and plugins in the existing file and keeps your other settings, including a wrapped build such as withSentry(bare()). When it cannot edit hot-updater.config.ts, such as a config that a function returns, it leaves the file unchanged and prints the storage, database, and plugins lines to add.

import { bare } from "@hot-updater/bare";
import { supabaseDatabase, supabaseStorage } from "@hot-updater/supabase";
import { apiKeys, insights, remoteConfig } from "hot-updater/plugins";
import { defineConfig } from "hot-updater";
import { existsSync } from "node:fs";

if (existsSync(".env.hotupdater")) {
  process.loadEnvFile(".env.hotupdater");
}

export default defineConfig({
  build: bare({ enableHermes: true }),
  storage: supabaseStorage({
    supabaseUrl: process.env.HOT_UPDATER_SUPABASE_URL!,
    supabaseServiceRoleKey: process.env.HOT_UPDATER_SUPABASE_SERVICE_ROLE_KEY!,
    bucketName: process.env.HOT_UPDATER_SUPABASE_BUCKET_NAME!,
  }),
  database: supabaseDatabase({
    supabaseUrl: process.env.HOT_UPDATER_SUPABASE_URL!,
    supabaseServiceRoleKey: process.env.HOT_UPDATER_SUPABASE_SERVICE_ROLE_KEY!,
  }),
  plugins: [apiKeys(), insights(), remoteConfig()],
  updateStrategy: "appVersion", // or "fingerprint"
});

The generated Supabase migrations enable Row Level Security on Hot Updater tables and keep direct table/function access limited to the service role used by the CLI and deployed Edge Function.

Step 4: If you use Expo, add the config plugin

Follow the Expo path in Set up your app. It applies the config plugin and generates the native integration. For DOM components, continue with Expo DOM components.

Step 5: Add native code

For Bare or Rock, follow the Android and iOS instructions in Set up your app. Keep the integration appropriate to your React Native version and rebuild the native app after changing it.

Upgrade infrastructure

With the Hot Updater skill attached, ask your agent:

$hot-updater Upgrade this project's existing Supabase server infrastructure.

The agent discovers the existing deployment, uses hot-updater agent infra upgrade, and reads the applicable version files before changing resources. It applies pending changes and verifies the server with doctor. See Upgrade an existing server for the workflow or Doctor for terminal instructions.

For server templates to apply with your own deployment tooling, use hot-updater infra scaffold --provider supabase. See Infrastructure Templates.

Verifying the setup

1. Confirm the selected Supabase resources and the deployed client base URL.

2. From the React Native project, check the server and native integration:

   npx hot-updater doctor --server-base-url <client-base-url> --json

   Doctor checks the public /version endpoint. It does not prove an authenticated update download or application.

3. Complete Test an OTA update on a release build. Verify that the app downloads and runs the changed code, then survives a restart.

An agent should report the selected resources, verified URL, configuration file paths and verification result. Report a missing access, billing or native-build prerequisite explicitly instead of marking an untested installation complete.

Host the Console

Host the console on Vercel, Netlify, or Docker/Node and connect to the existing Supabase project over HTTPS. See the console hosting matrix and Vercel deployment guide.