{
  "schema_version": 2,
  "id": "integrate/redis-data-integration/data-pipelines/prepare-dbs/supabase",
  "title": "Prepare Supabase for RDI",
  "url": "https://redis.io/docs/latest/integrate/redis-data-integration/1.19.1/data-pipelines/prepare-dbs/supabase/",
  "summary": "Prepare a hosted Supabase database to work with RDI",
  "content": "\n[Supabase](https://supabase.com/docs/guides/database/overview) is a hosted\nPostgreSQL platform. RDI can connect to a hosted Supabase project\nthrough any direct PostgreSQL endpoint as long as it is reachable from the RDI\ndeployment and supports logical replication.\n\n\u003e [!NOTE]\n\u003e RDI supports hosted Supabase projects running an\n\u003e [RDI-supported PostgreSQL version](https://redis.io/docs/latest/integrate/redis-data-integration/1.19.1/data-pipelines/prepare-dbs).\n\u003e The integration was validated with RDI 1.19.0 and hosted Supabase PostgreSQL\n\u003e 17.6. For self-hosted Supabase deployments, follow the general\n\u003e [PostgreSQL preparation guide](https://redis.io/docs/latest/integrate/redis-data-integration/1.19.1/data-pipelines/prepare-dbs/postgresql).\n\u003e This page describes Supabase setup for a self-managed RDI deployment. For the\n\u003e managed service, see\n\u003e [Use Supabase with RDI on Redis Cloud](https://redis.io/docs/latest/operate/rc/rdi/supabase).\n\nSupabase differs from a typical self-managed PostgreSQL source in the following\nways:\n\n- You can't edit `postgresql.conf` or `pg_hba.conf` directly. Supabase enables\n  logical replication and manages these settings for you.\n- You must use the direct database endpoint for logical replication because\n  [Supavisor connection pooler endpoints don't support logical replication](https://supabase.com/docs/guides/database/replication/manual-replication-faq#which-connection-string-should-be-used).\n- The direct endpoint uses IPv6 unless you enable the Supabase dedicated IPv4\n  add-on. Enable the add-on if your RDI deployment can't connect over IPv6.\n- Supabase can enforce TLS and provides a CA certificate that RDI can use to\n  validate the database certificate.\n- Supabase Row Level Security (RLS) can restrict the rows visible during the\n  initial snapshot.\n\nThe following checklist summarizes the setup:\n\n```checklist {id=\"supabaselist\"}\n- [ ] [Create or select a Supabase project](#1-create-or-select-a-supabase-project)\n- [ ] [Configure direct network access](#2-configure-direct-network-access)\n- [ ] [Create a dedicated RDI role](#3-create-a-dedicated-rdi-role)\n- [ ] [Grant access to source tables](#4-grant-access-to-source-tables)\n- [ ] [Configure TLS](#5-configure-tls)\n- [ ] [Configure RDI](#6-configure-rdi)\n- [ ] [Monitor replication slots](#7-monitor-replication-slots)\n```\n\n## 1. Create or select a Supabase project\n\nCreate a project in the [Supabase dashboard](https://supabase.com/dashboard)\nor select an existing project. You can find its PostgreSQL version in the\nSupabase dashboard or run the following query in the SQL editor:\n\n```sql\nSELECT version();\n```\n\n## 2. Configure direct network access\n\nFor a public connection, select **Connect** in the Supabase dashboard and copy\nthe **Direct connection** hostname. It has the following form:\n\n```text\ndb.\u003cproject-ref\u003e.supabase.co\n```\n\nYou should generally use port `5432`, but you can use a private hostname or\naddress instead if you have configured private connectivity between the RDI\ndeployment and Supabase.\nDon't use a Supavisor transaction or session pooler connection string because\nthese endpoints don't support logical replication.\n\nSupabase direct connections use IPv6 by default. If your RDI deployment\ndoesn't have IPv6 egress, enable the\n[dedicated IPv4 add-on](https://supabase.com/docs/guides/platform/ipv4-address).\nThe add-on requires a paid Supabase plan.\n\nIf you use the public endpoint and enable\n[Supabase Network Restrictions](https://supabase.com/docs/guides/platform/network-restrictions),\nadd the public egress address of the RDI host or cluster to the allowlist. Use\na `/32` CIDR for an individual IPv4 address. For private connectivity, make\nsure the RDI host or cluster can resolve and route to the private endpoint.\n\n## 3. Create a dedicated RDI role\n\nIn the Supabase SQL editor, create a dedicated login for RDI. Replace the\nexample name and password with your own values:\n\n```sql\nCREATE ROLE rdi_replication\n  WITH LOGIN REPLICATION PASSWORD '\u003cstrong-password\u003e';\n```\n\n\u003e [!WARNING]\n\u003e Don't use the Supabase `postgres` administrator account for the RDI connection.\n\u003e The RDI role's credentials provide continuous access to captured data, so grant\n\u003e the role only the permissions it needs.\n\n## 4. Grant access to source tables\n\nThe RDI role needs to connect to the database and read every table included in\nthe initial snapshot. For example:\n\n```sql\nGRANT CONNECT ON DATABASE postgres TO rdi_replication;\n\nGRANT USAGE ON SCHEMA public TO rdi_replication;\nGRANT SELECT ON ALL TABLES IN SCHEMA public TO rdi_replication;\n\nALTER DEFAULT PRIVILEGES IN SCHEMA public\n  GRANT SELECT ON TABLES TO rdi_replication;\n```\n\nRepeat the schema grants for every schema you want RDI to capture.\n\nIf RLS is enabled on a source table, the initial snapshot only contains rows\nvisible to the RDI role. To capture all rows, define appropriate RLS policies\nfor the role or grant `BYPASSRLS`:\n\n```sql\nALTER ROLE rdi_replication BYPASSRLS;\n```\n\n`BYPASSRLS` applies to every table in the database. Grant it only to a\ndedicated RDI role and protect that role's credentials.\n\n### Create a publication\n\nBy default, RDI uses the PostgreSQL `pgoutput` logical decoding plug-in, a\npublication named `dbz_publication`, and a replication slot named `debezium`.\nThese defaults work with Supabase if the RDI role has permission to create the\npublication and manage its source tables.\n\nIt is recommended that a database administrator create a publication\ncontaining only the tables RDI should capture:\n\n```sql\nCREATE PUBLICATION rdi_publication\n  FOR TABLE public.customers, public.orders;\n```\n\nCreating the publication explicitly avoids granting table ownership or broad\npublication-creation permissions to the RDI role and limits the publication's\ntable scope.\n\n## 5. Configure TLS\n\nIn the Supabase dashboard, go to\n[**Database settings** \u003e **SSL configuration**](https://supabase.com/docs/guides/platform/ssl-enforcement):\n\n1. Enable **Enforce SSL on incoming connections**.\n1. Download the Supabase CA certificate.\n\nStore the database username, password, and CA certificate as RDI secrets:\n\n```bash\nredis-di set-secret SOURCE_DB_USERNAME rdi_replication\nredis-di set-secret SOURCE_DB_PASSWORD '\u003cstrong-password\u003e'\nredis-di set-secret SOURCE_DB_CACERT /path/to/prod-ca-2021.crt\n```\n\nRDI verifies that the direct endpoint hostname matches the certificate.\n\n## 6. Configure RDI\n\nAdd a PostgreSQL source to `config.yaml`. Replace the project reference and\ntable names with your values:\n\n```yaml\nsources:\n  supabase:\n    type: cdc\n    connection:\n      type: postgresql\n      host: db.\u003cproject-ref\u003e.supabase.co\n      port: 5432\n      database: postgres\n      user: ${SOURCE_DB_USERNAME}\n      password: ${SOURCE_DB_PASSWORD}\n    schemas:\n      - public\n    tables:\n      public.customers: {}\n      public.orders: {}\n    advanced:\n      source:\n        plugin.name: pgoutput\n        publication.name: rdi_publication\n        publication.autocreate.mode: disabled\n        slot.name: rdi_supabase\n```\n\nUse a unique replication slot name for each active pipeline that connects to\nthe project.\n\n## 7. Monitor replication slots\n\nRDI creates a logical replication slot that retains write-ahead log (WAL)\nrecords while the pipeline is stopped or disconnected. Use a query like the\nfollowing to monitor inactive slots and retained WAL to prevent unexpected\nstorage growth:\n\n```sql\nSELECT\n  slot_name,\n  active,\n  restart_lsn,\n  confirmed_flush_lsn\nFROM pg_replication_slots;\n```\n\n[Supabase requires logical replication slots to be removed](https://supabase.com/docs/guides/platform/upgrading)\nbefore a PostgreSQL major-version upgrade. Before upgrading:\n\n1. Stop the RDI pipeline.\n1. Record the pipeline configuration and slot name.\n1. Drop the RDI replication slot.\n1. Upgrade the Supabase project.\n1. Reset and start the RDI pipeline to create a new slot and initial snapshot.\n\nAllow time for the new initial snapshot to complete, and monitor the pipeline\nuntil pending records return to zero.\n",
  "tags": ["docs","integrate","rs","rdi"],
  "last_updated": "2026-09-19T17:55:58-07:00"
}