FastAPI Supabase Starter

FastAPI API skeleton with Supabase JWT validation and user routes

This template connects a FastAPI service to Supabase so clients can send a Supabase-issued JWT and hit protected handlers. It includes SQLAlchemy models, user create / me-style endpoints, CORS, and interactive API docs as described in the README, plus SQLite by default with a path to swap databases.

When it is useful

You are prototyping a Python backend that should trust Supabase Auth, you want a reference layout for JWT parsing and route guards, or you are teaching how a BaaS token reaches a custom API. You still bring your own Supabase project and secrets.

What you can do

Create and fetch user rows using the documented endpoints and a valid access token.
Configure project ID, JWT secret, and database URL from the environment template in the repository.
Manage dependencies with the documented uv workflow and extend routers or models from there.
Follow the README’s security notes on HTTPS, secret handling, and claim validation.

Limits

This is starter plumbing, not a full product: no billing, admin consoles, or multi-region guarantees.
Threat modeling, RLS in Postgres, and key rotation remain your work for anything serious.
Behavior matches what the repository implements; verify against your Supabase settings before production traffic.

Frequently asked questions

What does the FastAPI Supabase Starter include?

A FastAPI service that validates Supabase JWTs (HS256) on protected handlers, plus SQLAlchemy models, POST /user/create and GET /user/me, CORS, Swagger UI, and SQLite by default with a path to swap databases.

Do I need my own Supabase project?

Yes. Set SUPABASE_PROJECT_ID, SUPABASE_JWT_SECRET, and DATABASE_URL from your project settings. Send the access token as Authorization: Bearer <token> when calling protected routes.

How are dependencies managed and how do I run it?

The repository documents a uv workflow (uv venv, uv sync). Start with python main.py; the server listens on localhost:8000 and docs are at /docs.

Is this production-ready as-is?

No. It is starter plumbing for prototyping and teaching JWT route guards. Follow the README notes on HTTPS, secret handling, and claim validation. Threat modeling, Postgres RLS, key rotation, billing, and admin consoles remain your work.