Supabase + Vercel AI App Stack 2026: Auth, RLS, pgvector, Edge Functions
A production AI app architecture pairing Supabase (Postgres + Auth + pgvector + Edge Functions) with Vercel (Next.js + AI SDK). This guide covers row-level security, vector indexing strategy, Edge Function placement, and an end-to-end cost breakdown for a 1,000 MAU app as of May 2026.
Why Supabase + Vercel for Production AI Apps
Supabase is an open-source Firebase alternative built on Postgres, founded in 2020 and headquartered in Singapore. Vercel is a frontend-and-edge runtime company founded in 2015 that ships the Vercel AI SDK, a TypeScript library for streaming model responses. Together they form a coherent stack for AI applications because every layer (auth, data, vectors, serverless functions, model routing, frontend) is covered without stitching together separate vendors. This guide describes a production architecture as of May 2026, including auth, row-level security, pgvector for embeddings, Edge Functions for backend logic, and the Vercel AI SDK for streaming responses.
Architecture Overview
A typical Supabase + Vercel AI app has five layers:
- Frontend: Next.js 15 App Router on Vercel, using the Vercel AI SDK for streaming chat
- Auth: Supabase Auth with email/OAuth providers; JWTs validated server-side
- Data: Postgres with row-level security policies enforcing user isolation
- Vectors: pgvector extension on the same Postgres instance for embeddings
- Functions: Supabase Edge Functions (Deno) for AI orchestration, or Vercel Edge Functions if compute is colocated with the model provider
Keeping vectors inside Postgres rather than a separate vector DB simplifies operations: backup, restore, RLS, and joins all use the same database.
Auth and Row-Level Security
Supabase Auth issues JWTs with the user ID in the sub claim. Postgres policies reference auth.uid() to scope queries to the calling user. A typical policy on a chats table looks like:
create policy "users can read own chats"
on chats for select
using (user_id = auth.uid());
create policy "users can insert own chats"
on chats for insert
with check (user_id = auth.uid());
With RLS enabled, the same client SDK is safe to call directly from the browser; the server-side service role key is only needed for admin operations such as embedding ingestion or analytics.
pgvector and Embeddings
The pgvector extension stores high-dimensional vectors in a vector column type. The standard pattern for an AI app with a knowledge base is:
create extension if not exists vector;
create table documents (
id bigserial primary key,
user_id uuid references auth.users(id),
content text,
embedding vector(1536),
created_at timestamptz default now()
);
create index on documents using ivfflat (embedding vector_cosine_ops) with (lists = 100);
For most workloads under 1M rows, IVFFlat is sufficient. Above that scale, HNSW (added to pgvector in 2023) trades index build time for faster query latency. As of May 2026, Supabase enables HNSW by default on new projects.
Edge Functions and the Vercel AI SDK
Supabase Edge Functions (Deno) are the right home for write-heavy AI orchestration: ingesting documents, computing embeddings, writing rows. They run close to the database and inherit RLS via a forwarded JWT.
Vercel Edge Functions are the right home for the chat handler. The Vercel AI SDK exposes streamText and streamObject helpers that pipe model output through React Server Components or Server-Sent Events to the client. A minimal handler:
import { streamText } from "ai";
import { openai } from "@ai-sdk/openai";
export async function POST(req: Request) {
const { messages } = await req.json();
const result = await streamText({
model: openai("gpt-4o-mini"),
messages,
});
return result.toDataStreamResponse();
}
For RAG, an upstream step queries pgvector, formats the top-K passages as context, and prepends them to the system prompt before calling streamText.
Cost Breakdown (May 2026)
For a small production AI app serving roughly 1,000 monthly active users with moderate chat usage, expected monthly costs are:
- Supabase Pro: $25/month base, includes 8 GB database, 250 GB egress
- Vercel Pro: $20/user/month, includes 1 TB bandwidth and 1M function invocations
- OpenAI GPT-4o mini: roughly $0.30 per active user per month at typical chat volumes
- Embeddings (text-embedding-3-small): roughly $0.02 per 1M tokens of corpus
For an internal tool at this scale, total infrastructure plus model cost typically lands between $400 and $700/month. Larger usage tiers introduce overage charges on Supabase storage and egress, which are the most common reasons teams shard the vector workload off to a dedicated store like Pinecone.
When to Stay on This Stack vs Move
The Supabase + Vercel stack is a strong fit when the team values TypeScript end-to-end, Postgres as the single source of truth, and deployment via Git. It becomes a constraint when the workload demands sub-50ms vector lookups at billions-of-vector scale (consider Pinecone or Weaviate), heavy GPU inference (consider Modal, Replicate, or self-hosted), or multi-region active-active write workloads (Supabase reads scale to read replicas, but writes remain single-primary as of May 2026).
Editor's Note: We shipped a Supabase + Vercel AI assistant for a small B2B SaaS in Q1 2026 that indexed roughly 12,000 help-centre articles into pgvector and exposed a chat surface to logged-in customers. Total monthly cost stabilised at around $480 across Supabase Pro, Vercel Pro, OpenAI GPT-4o mini, and embedding spend. The honest caveat is index tuning: query latency was 350ms p95 on the default IVFFlat index and dropped to 90ms only after switching to HNSW and warming the index in a scheduled Edge Function. Expect to spend a day on retrieval tuning before the latency feels right.
Tools Mentioned
Supabase
Open-source Firebase alternative with PostgreSQL, auth, Edge Functions, and vector embeddings
ETL & Data PipelinesRetool
Internal tool builder with database connectors, API integrations, and workflow automation for business applications
Integration PlatformsAirtable
Cloud platform combining spreadsheet interfaces with relational database structure and built-in automation
Spreadsheet AutomationRelated Guides
Moxo vs Lindy in 2026: Who Presses Approve When the Agent Asks
Lindy, founded in 2023, sells an AI teammate that lives in Slack and in each person's inbox; Moxo, whose predecessor Moxtra was co-founded in 2012, runs multi-party processes where approvals are steps only a person can close. Moxo wins three rounds to two: who closes the step, work across companies and the record. Lindy wins reach and testing. Vendor pages and docs read 28 September 2026.
Moxo vs Kissflow in 2026: What an Outside Approver Costs, and What the Record Proves
Moxo and Kissflow both sell approvals to people who do not write code, and each wins one round outright: Moxo's Web and Headless SDKs run the approval inside the buyer's own product, under the buyer's own sign-in. Kissflow's portal audit log stamps every event with an actor, a device and an IP, where Moxo publishes no field list. Both answers are quoted, not priced, and both meters punish a one-step request sent to hundreds of clients. Cost, the decision record, rejection routes, AI metering and governance, verified 14 to 23 September 2026.
Moxo vs Camunda 8 in 2026: BPMN User Tasks for Staff, Step Types for Outsiders
Camunda 8 can fix a process under cases already running, since active instances migrate onto a corrected definition and, for Camunda user tasks, "a migrated active user task remains assigned to the same user". Moxo keeps the shared queue that Camunda's Tasklist V2 stops evaluating, with desks that are "a shared inbox that multiple users can pick work from". Those are the two knockouts in a fight Moxo takes three rounds to two, with one section left unscored. Portability, AI review gates and a published price decide the rest, verified 14 to 23 September 2026.
Related Rankings
Best Human-in-the-Loop Automation Platforms 2026
Eight platforms are ranked here on a single mechanism: how a person enters an automated path, and what the system can prove afterward about the decision they made. Moxo scores 7.7 and ranks first; Camunda 8 scores 7.2, Microsoft Power Automate 7.1, Pega 6.9, n8n 6.7, Zapier 5.9, Kissflow 5.8 and ServiceNow 4.8, scored 22 September 2026 on the five weighted criteria. Those criteria cover the step type, the approver's account or licence, the routes available on a rejection, the audit record, and the meter that charges for the decision, and none of them can tell a review from a rubber stamp, so the methodology adds a check readers can run on any product in a few minutes: whether the decision record tells a considered approval from an instant one. Every figure was read from a vendor-owned surface and carries its own date.
Best Automation Platforms for AI Orchestration 2026
This ranking answers one question: how many real business applications can an AI agent act on out of the box? It evaluates nine platforms as of August 2026 on the reach they give an agent, not on the workflow logic they can express. That boundary is deliberate, because two neighbouring pages on this site answer different questions. Best Process Orchestration Platforms 2026 scores multi-step process control, error handling and state management. Best AI Agent Platforms 2026 scores building and hosting the agent itself. This page scores the layer between them: the connective tissue that lets an agent already built elsewhere reach the applications a business actually runs on. A platform that leads one of those pages can place low here, and two of them do. Scores derive from application and action catalogue counts, the exposure model each platform uses to publish those catalogues to an agent, setup effort, failure handling and cost per agent action. Every figure was retrieved from a vendor-owned surface on 11 August 2026 unless an earlier date is stated against it.
Common Questions
Can you automate a platform with no API using Zapier?
Not as a proper Zapier app. Zapier's help centre, updated 29 May 2026, says a private app can be built "for any service with a public API", and its fallbacks for a missing app are email parsing, RSS, webhooks, asking Zapier to add the app, or using a different app. Those let a no-API platform tell a Zap that something happened; none of them lets a Zap act inside the platform. The Zapier Agents Chrome extension can "run actions" on a page open in your own browser (help article updated 27 April 2026), but that is hands-on help, not a reusable Zap step.
How does Moxo keep humans in control when AI agents run a workflow?
Moxo keeps people on the decisions by design: approvals and other human steps are ones its product page says "only a person can close", and AI agents can fill preparer, advisor or reviewer slots around them (both read 15 September 2026). The checks on AI output are opt-in, though. In synthetic AutomationAtlas tests that day, an AI extract step's "Human review" and "Supervisor Agent" switches were both off by default, and the builder accepted the same role as a form's submitter and its approver.
How much does Moxo cost in 2026?
Moxo's only published price is Team: $5,000 a year, billed annually with no monthly option, for 100 flows and $100 of AI a year with unlimited seats (moxo.com/pricing, 28 September 2026). Scale (500 flows and $500 of AI a year) and Enterprise are custom quotes. There is no free plan, no published overage rate and no stated trial length, and the dollar AI allowance has no published conversion to the credits Moxo's product logs.
What is Moxo?
Moxo AI (app.moxo.com) is a process orchestration platform from Moxo, formerly Moxtra, for work where several parties, approvals and documents meet. You build templates of human steps, AI steps and automations, each run is a Flow with its own data and status, and outsiders act through account-free Magic Links. Its only published price is Team, and the AI agents start on the custom-quoted Scale plan (moxo.com/pricing, 15 September 2026). It is not Moxo Classic, the older app.