Releasesby GlyphPasskeys for Supabase Auth in Beta
Supabase Auth now supports passkeys in Beta, enabling passwordless, phishing-resistant sign-in built on WebAuthn using biometrics, device PINs, or hardware security keys.
Temporary token-based database access in Feature Preview
Supabase project owners and admins can now grant temporary database access via Personal Access Tokens. Access is scoped by role with an expiry of up to 90 days, eliminating the need to disclose passwords.
Analytics and Vector become opt-in for self-hosted Supabase
Self-hosted Supabase will make analytics and vector features opt-in starting June 3, 2026. Logs Explorer users must include the logs configuration file in their docker compose invocation.
Support for Postgres 14 ending July 1, 2026
Supabase support for Postgres 14 ends on July 1, 2026. Remaining Postgres 14 projects will be upgraded automatically, while projects using removed extensions like timescaledb, plv8, or pgjwt will be paused.
Supabase Is Now an Official ChatGPT App
Supabase is now available as an official ChatGPT app, allowing users to connect their projects to ChatGPT to manage database infrastructure through natural language commands.
Developer Update - May 2026
The May 2026 developer update introduces custom OAuth/OIDC providers, ISO 27001 certification, the @supabase/server SDK, branching without Git by default, and changes to Data API auto-exposure.
Introducing @supabase/server
Supabase introduced @supabase/server to provide stateless authentication, RLS-scoped clients, and server-side CORS support. The package is designed to reduce boilerplate code for server-side implementations.
Branching Without Git Is Now The Default
Supabase has made branching without Git the default configuration for all projects, simplifying the development workflow for users.
OAuth token endpoint to return HTTP 200 instead of 201
Starting June 1, 2026, Supabase's OAuth token endpoint will return HTTP 200 instead of 201. Developers should update their integrations to check for any 2XX status rather than a hardcoded 201.