guide

Supabase + Vercel AI App Stack 2026: Auth, RLS, pgvector, Edge Functions

A production AI app architecture pairing Supabase (Postgres + Auth + pgvector + Edge Functions) with Vercel (Next.js + AI SDK). This guide covers row-level security, vector indexing strategy, Edge Function placement, and an end-to-end cost breakdown for a 1,000 MAU app as of May 2026.

Why Supabase + Vercel for Production AI Apps

Supabase is an open-source Firebase alternative built on Postgres, founded in 2020 and headquartered in Singapore. Vercel is a frontend-and-edge runtime company founded in 2015 that ships the Vercel AI SDK, a TypeScript library for streaming model responses. Together they form a coherent stack for AI applications because every layer (auth, data, vectors, serverless functions, model routing, frontend) is covered without stitching together separate vendors. This guide describes a production architecture as of May 2026, including auth, row-level security, pgvector for embeddings, Edge Functions for backend logic, and the Vercel AI SDK for streaming responses.

Architecture Overview

A typical Supabase + Vercel AI app has five layers:

  1. Frontend: Next.js 15 App Router on Vercel, using the Vercel AI SDK for streaming chat
  2. Auth: Supabase Auth with email/OAuth providers; JWTs validated server-side
  3. Data: Postgres with row-level security policies enforcing user isolation
  4. Vectors: pgvector extension on the same Postgres instance for embeddings
  5. Functions: Supabase Edge Functions (Deno) for AI orchestration, or Vercel Edge Functions if compute is colocated with the model provider

Keeping vectors inside Postgres rather than a separate vector DB simplifies operations: backup, restore, RLS, and joins all use the same database.

Auth and Row-Level Security

Supabase Auth issues JWTs with the user ID in the sub claim. Postgres policies reference auth.uid() to scope queries to the calling user. A typical policy on a chats table looks like:

create policy "users can read own chats"
  on chats for select
  using (user_id = auth.uid());

create policy "users can insert own chats"
  on chats for insert
  with check (user_id = auth.uid());

With RLS enabled, the same client SDK is safe to call directly from the browser; the server-side service role key is only needed for admin operations such as embedding ingestion or analytics.

pgvector and Embeddings

The pgvector extension stores high-dimensional vectors in a vector column type. The standard pattern for an AI app with a knowledge base is:

create extension if not exists vector;

create table documents (
  id bigserial primary key,
  user_id uuid references auth.users(id),
  content text,
  embedding vector(1536),
  created_at timestamptz default now()
);

create index on documents using ivfflat (embedding vector_cosine_ops) with (lists = 100);

For most workloads under 1M rows, IVFFlat is sufficient. Above that scale, HNSW (added to pgvector in 2023) trades index build time for faster query latency. As of May 2026, Supabase enables HNSW by default on new projects.

Edge Functions and the Vercel AI SDK

Supabase Edge Functions (Deno) are the right home for write-heavy AI orchestration: ingesting documents, computing embeddings, writing rows. They run close to the database and inherit RLS via a forwarded JWT.

Vercel Edge Functions are the right home for the chat handler. The Vercel AI SDK exposes streamText and streamObject helpers that pipe model output through React Server Components or Server-Sent Events to the client. A minimal handler:

import { streamText } from "ai";
import { openai } from "@ai-sdk/openai";

export async function POST(req: Request) {
  const { messages } = await req.json();
  const result = await streamText({
    model: openai("gpt-4o-mini"),
    messages,
  });
  return result.toDataStreamResponse();
}

For RAG, an upstream step queries pgvector, formats the top-K passages as context, and prepends them to the system prompt before calling streamText.

Cost Breakdown (May 2026)

For a small production AI app serving roughly 1,000 monthly active users with moderate chat usage, expected monthly costs are:

  • Supabase Pro: $25/month base, includes 8 GB database, 250 GB egress
  • Vercel Pro: $20/user/month, includes 1 TB bandwidth and 1M function invocations
  • OpenAI GPT-4o mini: roughly $0.30 per active user per month at typical chat volumes
  • Embeddings (text-embedding-3-small): roughly $0.02 per 1M tokens of corpus

For an internal tool at this scale, total infrastructure plus model cost typically lands between $400 and $700/month. Larger usage tiers introduce overage charges on Supabase storage and egress, which are the most common reasons teams shard the vector workload off to a dedicated store like Pinecone.

When to Stay on This Stack vs Move

The Supabase + Vercel stack is a strong fit when the team values TypeScript end-to-end, Postgres as the single source of truth, and deployment via Git. It becomes a constraint when the workload demands sub-50ms vector lookups at billions-of-vector scale (consider Pinecone or Weaviate), heavy GPU inference (consider Modal, Replicate, or self-hosted), or multi-region active-active write workloads (Supabase reads scale to read replicas, but writes remain single-primary as of May 2026).

Editor's Note: We shipped a Supabase + Vercel AI assistant for a small B2B SaaS in Q1 2026 that indexed roughly 12,000 help-centre articles into pgvector and exposed a chat surface to logged-in customers. Total monthly cost stabilised at around $480 across Supabase Pro, Vercel Pro, OpenAI GPT-4o mini, and embedding spend. The honest caveat is index tuning: query latency was 350ms p95 on the default IVFFlat index and dropped to 90ms only after switching to HNSW and warming the index in a scheduled Edge Function. Expect to spend a day on retrieval tuning before the latency feels right.

Written & reviewed by Rafal Fila · Last updated:

Tools Mentioned

Related Guides

guide

Client Portals vs Workflow Orchestration Platforms: What Changes When External Parties Act Inside a Process

What changes when a client or supplier has to act inside your process, not just watch it? This guide compares four client portals with four orchestration platforms on how outsiders get in, whether you pay for them and what the audit log records, from vendor sources read 14 and 15 September 2026.

comparison

Moxo vs Zapier in 2026: Human Approval Steps, External Participants and Pricing

Moxo and Zapier both put a person in front of an automated decision, from opposite ends: Moxo builds the process out of human steps and attaches AI, while Zapier pauses an automation for a reviewer through its Human in the Loop app. This guide compares approvers, rejection, AI approval, audit logs, governance and pricing, verified 14 and 15 September 2026.

comparison

Keystroke vs n8n in 2026: Agent-Built TypeScript vs the Visual Canvas

Keystroke, launched in July 2026 by Y Combinator W24 company Sprint Labs, is a code-first automation platform where AI coding agents write workflows as TypeScript in the user's repository. n8n, founded in 2019, is the most widely deployed source-available visual workflow platform, with 200,000+ users and a $2.5 billion valuation. This comparison covers the agent-authored versus canvas building models, durable execution, licensing (Elastic License 2.0 vs the Sustainable Use License), verified July 2026 pricing including Keystroke's usage metering, and the maturity gap between a days-old platform and an established ecosystem.

Related Rankings

Best Automation Platforms for AI Orchestration 2026

This ranking answers one question: how many real business applications can an AI agent act on out of the box? It evaluates nine platforms as of August 2026 on the reach they give an agent, not on the workflow logic they can express. That boundary is deliberate, because two neighbouring pages on this site answer different questions. Best Process Orchestration Platforms 2026 scores multi-step process control, error handling and state management. Best AI Agent Platforms 2026 scores building and hosting the agent itself. This page scores the layer between them: the connective tissue that lets an agent already built elsewhere reach the applications a business actually runs on. A platform that leads one of those pages can place low here, and two of them do. Scores derive from application and action catalogue counts, the exposure model each platform uses to publish those catalogues to an agent, setup effort, failure handling and cost per agent action. Every figure was retrieved from a vendor-owned surface on 11 August 2026 unless an earlier date is stated against it.

Best Durable Workflow Engines for Production in 2026

A ranked list of the best durable workflow engines for production deployments in 2026. Durable workflow engines persist execution state to a database so that long-running workflows survive process restarts, deployments, and infrastructure failures. The ranking covers Temporal, Prefect, Apache Airflow, Camunda, Windmill, and n8n. Tools were evaluated on production reliability, developer experience, scalability, open-source health, and documentation quality. The shortlist intentionally mixes code-first engines (Temporal, Prefect, Airflow) with hybrid visual platforms (Camunda, Windmill, n8n) to reflect how production teams actually choose workflow engines in 2026.

Common Questions

Can you automate a platform with no API using Zapier?

Not as a proper Zapier app. Zapier's help centre, updated 29 May 2026, says a private app can be built "for any service with a public API", and its fallbacks for a missing app are email parsing, RSS, webhooks, asking Zapier to add the app, or using a different app. Those let a no-API platform tell a Zap that something happened; none of them lets a Zap act inside the platform. The Zapier Agents Chrome extension can "run actions" on a page open in your own browser (help article updated 27 April 2026), but that is hands-on help, not a reusable Zap step.

How does Moxo keep humans in control when AI agents run a workflow?

Moxo keeps people on the decisions by design: approvals and other human steps are ones its product page says "only a person can close", and AI agents can fill preparer, advisor or reviewer slots around them (both read 15 September 2026). The checks on AI output are opt-in, though. In synthetic AutomationAtlas tests that day, an AI extract step's "Human review" and "Supervisor Agent" switches were both off by default, and the builder accepted the same role as a form's submitter and its approver.

What is Moxo?

Moxo AI (app.moxo.com) is a process orchestration platform from Moxo, formerly Moxtra, for work where several parties, approvals and documents meet. You build templates of human steps, AI steps and automations, each run is a Flow with its own data and status, and outsiders act through account-free Magic Links. Its only published price is Team, and the AI agents start on the custom-quoted Scale plan (moxo.com/pricing, 15 September 2026). It is not Moxo Classic, the older app.

How much does Moxo cost in 2026?

Moxo's only published price is Team: $500 a month in the monthly view or $5,000 a year in the yearly view, for 100 flows and $100 of AI a year with unlimited seats (moxo.com/pricing, 15 September 2026). Scale (500 flows and $500 of AI a year) and Enterprise are custom quotes. There is no free plan, no published overage rate and no stated trial length, and the dollar AI allowance has no published conversion to the credits Moxo's product logs.