Grafana Agent / Alloy component for scraping Supabase metrics
For Grafana Agent or Alloy, use the `prometheus.scrape` component with the same scrape parameters. Refer to Grafana's integration reference for Supabase manual configuration.
platform
492 notes in this subject, read out of this brain and free to use. This is page 3 of 9.
AWS Managed Prometheus setup for Supabase metrics
To use AWS Managed Prometheus (AMP) with Supabase metrics, deploy the Grafana Agent or AWS Distro for OpenTelemetry (ADOT) in your VPC. Configure the collector to scrape Supabase metrics and then remote-write the scraped metrics into AMP.
Multi-project metric labels for aggregation
Tag or relabel metric series with labels like `project`, `env`, `org`, or `team` to make multi-project views and aggregations easier across different projects and environments.
Import Supabase Grafana dashboard for visualization
Regardless of where Grafana is hosted, import the Supabase Grafana dashboard from https://github.com/supabase/supabase-grafana. For other visualization tools, group metrics by categories (CPU, IO, WAL, replication, connections) and recreate relevant visualizations.
Metrics scrape job configuration with HTTP Basic Auth
To scrape Supabase metrics, configure a scrape job that hits the Metrics API once per minute at the path `/customer/v1/privileged/metrics` over HTTPS on port 443. Use HTTP Basic Auth with username and a Secret API key (starting with `sb_secret_`). The scrape_interval should be 60s. Target format is `<project-ref>.supabase.co:443`. Add a label with the project-ref for identification.
Combine metrics with logs and advisors for right-sizing
Combine Metrics API data with log drains, Query Performance insights, and Advisors to build right-sizing playbooks and optimize resource allocation.
Multi-project scrape job configuration strategy
Create one scrape job per project ref to control sampling individually. For many projects, template scrape jobs using Helm, Terraform, or the Grafana Agent Operator. Use label joins on `project`, `instance_class`, and `org` to aggregate across tenants or environments.
Metrics scrape job YAML configuration example
Example scrape job configuration: ```yaml - job_name: supabase scrape_interval: 60s metrics_path: /customer/v1/privileged/metrics scheme: https basic_auth: username: username password: '<secret API key (sb_secret_...)>' static_configs: - targets: - '<project-ref>.supabase.co:443' labels: project: '<project-ref>' ```
Supabase Metrics API is vendor-agnostic and Prometheus-compatible
The Supabase Metrics API can be ingested by any collector that can scrape a Prometheus text endpoint over HTTPS. It works with AWS Managed Prometheus, Grafana Mimir, VictoriaMetrics, Thanos, and other Prometheus-compatible systems.
Alert rules for Supabase metrics
Start with example alert rules from https://github.com/supabase/supabase-grafana/blob/main/docs/example-alerts.md and adapt thresholds based on your workload sizes. Pipe alerts into PagerDuty, Slack, Opsgenie, or other compatible targets.
Platform status monitoring channels
Supabase provides the following feedback channels for platform status and outages: status page at status.supabase.com, RSS feed at status.supabase.com/history.rss, Atom feed at status.supabase.com/history.atom, and Slack alerts using Slack's built-in RSS functionality with the command `/feed subscribe https://status.supabase.com/history.atom`.
Platform SLA commitment
Supabase publishes an SLA document that details the company's commitment to platform stability.
Supabase hosted platform features
Supabase is a hosted platform that allows you to get started without needing to manage any infrastructure. Each project on Supabase comes with a dedicated Postgres database, auto-generated APIs, auth and user management, edge functions, realtime API, and storage.
Supabase dashboard access
You can visit supabase.com/dashboard and sign in to start creating projects.
Organizations in Supabase
Organizations are a way to group your projects. Each organization can be configured with different team members and billing settings.
Supabase plans available on AWS Marketplace
Supabase offers three plans through AWS Marketplace: Pro Plan (available, self-serve), Team Plan (available, self-serve), and Enterprise Plan (available via AWS Marketplace Private Offer). The Free Plan is not available through AWS Marketplace.
AWS Marketplace purchase benefits for Supabase
Purchasing Supabase through AWS Marketplace can provide simpler billing, faster progress toward AWS spend commitments, and centralized purchasing across all AWS accounts.
Tax handling for AWS Marketplace Supabase purchases
When purchasing Supabase through AWS Marketplace, AWS calculates and applies sales taxes, VAT, GST, service tax, and other indirect taxes based on the location of the AWS account.
Enterprise Plan acquisition through AWS Marketplace
The Enterprise Plan through AWS Marketplace is available via AWS Marketplace Private Offer and requires contacting Supabase for more information.
Reports not available for self-hosted instances
Supabase Reports are only available for projects hosted on the Supabase Cloud platform and are not available for self-hosted instances.
Report time range availability by plan
Free plan: Last 10, 30, 60 minutes, Last 3 hours, Last 24 hours. Pro plan: Last 10, 30, 60 minutes, Last 3 hours, Last 24 hours, Last 7 days. Team plan: Last 10, 30, 60 minutes, Last 3 hours, Last 24 hours, Last 7 days, Last 14 days, Last 28 days. Enterprise plan: Last 10, 30, 60 minutes, Last 3 hours, Last 24 hours, Last 7 days, Last 14 days, Last 28 days.
Project permissions table by role - Database Configuration
Database Configuration permissions by role: Reset Password: Owner and Admin. Pooling Settings (View): Owner, Admin, Developer, and Read-Only. (Update): Owner and Admin. SSL Configuration (View): Owner, Admin, Developer, and Read-Only. (Update): Owner and Admin. Disk Size Configuration (View): Owner, Admin, Developer, and Read-Only. (Update): Owner and Admin. Network Restrictions (View): Owner, Admin, Developer, and Read-Only. (Create, Delete): Owner and Admin. Network Bans (View): Owner, Admin, Developer, and Read-Only. (Unban): Owner and Admin.
Project permissions table by role - API Configuration
API Configuration permissions by role: API Keys (Read service key, Read anon key): Owner, Admin, and Developer. JWT Secret (View): Owner, Admin, and Developer. (Generate new): Owner and Admin. API settings (View): Owner, Admin, Developer, and Read-Only. (Update): Owner and Admin.
Project permissions table by role - Auth Configuration
Auth Configuration permissions by role: Auth Settings (View): Owner, Admin, Developer, and Read-Only. (Update): Owner and Admin. SMTP Settings (View): Owner, Admin, Developer, and Read-Only. (Update): Owner and Admin. Advanced Settings (View): Owner, Admin, Developer, and Read-Only. (Update): Owner and Admin.
Project permissions table by role - Integrations
Integrations (Project) permissions by role: Authorize GitHub and Add GitHub Repositories: Owner, Admin, Developer, and Read-Only. GitHub Connections (Create, Update, Delete): Owner and Admin. (View): Owner, Admin, Developer, and Read-Only. Vercel Connections (Create, Update, Delete): Owner and Admin. (View): Owner, Admin, Developer, and Read-Only.
Organization member invitations and SAML SSO
Members can be invited to an organization by sending an invite link to their email from the organization's team settings. The invite is valid for 24 hours. Invites sent from a SAML SSO account can only be accepted by another SAML SSO account from the same identity provider, as a security measure to prevent accidental invites to accounts not managed by the enterprise's identity provider.
Project permissions table by role - Data Database
Data (Database) permissions by role: View: Owner, Admin, Developer, and Read-Only. Manage: Owner, Admin, and Developer.
Project permissions table by role - Storage Configuration
Storage Configuration permissions by role: Upload Limit (View): Owner, Admin, Developer, and Read-Only. (Update): Owner and Admin. S3 Access Keys (View): Owner, Admin, and Developer. (Create, Delete): Owner and Admin.
Project permissions table by role - Infrastructure
Infrastructure permissions by role: Read Replicas (List): Owner, Admin, Developer, and Read-Only. (Create, Delete): Owner and Admin. Add-ons (Update): Owner and Admin.
Organization-scoped versus project-scoped roles
Organization members can be assigned roles scoped to the entire organization or to specific projects. Organization-level roles grant corresponding permissions across all current and future projects within the organization. Project-scoped roles (only available on Team and Enterprise plans) restrict access to specific projects only; users cannot view, access, or see other projects within the organization on the Supabase Dashboard.
Organization permissions table by role
Organization permissions matrix: Organization Management (Update, Delete): Owner only. OpenAI Telemetry Configuration (Update): Owner only. Organization Members (List): Owner, Administrator, Developer, Read-Only. Owner role (Add, Remove): Owner only. Administrator role (Add, Remove): Owner and Administrator. Developer role (Add, Remove): Owner and Administrator. Owner Project-Scoped role (Add, Remove): Owner only. Administrator Project-Scoped role (Add, Remove): Owner and Administrator. Developer Project-Scoped role (Add, Remove): Owner and Administrator. Invite (Revoke, Resend): Owner and Administrator. Invite (Accept): Owner, Administrator, Developer, Read-Only. Invoices (List): Owner, Administrator, Developer, Read-Only. Billing Email (View): Owner, Administrator, Developer, Read-Only. (Update): Owner and Administrator. Subscription (View): Owner, Administrator, Developer, Read-Only. (Update): Owner and Administrator. Billing Address (View): Owner, Administrator, Developer, Read-Only. (Update): Owner and Administrator. Tax Codes (View): Owner, Administrator, Developer, Read-Only. (Update): Owner and Administrator. Payment Methods (View): Owner, Administrator, Developer, Read-Only. (Update): Owner and Administrator. Usage (View): Owner, Administrator, Developer, Read-Only. Authorize GitHub and Add GitHub Repositories (Integrations): Owner and Administrator. GitHub Connections (Create, Update, Delete): Owner and Administrator. (View): Owner, Administrator, Developer, Read-Only. Vercel Connections (Create, Update, Delete): Owner and Administrator. (View): Owner, Administrator, Developer, Read-Only. OAuth Apps (Create, Update, Delete): Owner and Administrator. (List): Owner, Administrator, Developer, Read-Only. View Audit logs: Owner, Administrator, Developer, Read-Only. SOC2 Type 2 Report and Security Questionnaire (Download): Owner, Administrator, Developer, Read-Only.
Project permissions table by role - Logs and Analytics start
Logs & Analytics Queries permissions by role: Create: Owner, Admin, and Developer (note: this section continues in part 2 of the source).
Project permissions table by role - Project Management
Project Management permissions by role: Transfer: Owner only. Create: Owner and Admin. Delete: Owner and Admin. Update (Name): Owner and Admin. Pause: Owner and Admin. Restore: Owner and Admin. Restart: Owner, Admin, and Developer.
Organization ownership transfer requirements
Each Supabase organization must have at least one owner. To leave an organization, if you are the only owner, you must first invite another user as Owner and they must accept the invitation, or promote an existing organization member to Owner. Other owners can relinquish ownership and leave by clicking Leave team in the organization's team settings.
Project permissions table by role - Database backups
Database permissions by role: Scheduled Backups (View): Owner, Admin, Developer, and Read-Only. (Download, Restore): Owner, Admin, and Developer. Physical backups PITR (View): Owner, Admin, Developer, and Read-Only. (Restore): Owner, Admin, and Developer.
Project permissions table by role - Custom Domains
Custom Domains permissions by role: View: Owner, Admin, Developer, and Read-Only. Update: Owner and Admin.
Supabase organization roles and permissions
Supabase provides four organizational roles: Owner (full access to everything), Administrator (full access except updating organization settings, transferring projects outside the organization, and adding new owners), Developer (read-only access to organization resources, content access to project resources, but cannot change any project settings), and Read-Only (read-only access to organization and project resources). Read-Only role is only available on Team and Enterprise plans. When you first create an account, a default organization is created and you are assigned as Owner.
Project permissions table by role - Reports
Reports (Custom Report) permissions by role: Create, Update, Delete: Owner, Admin, and Developer. View, List: Owner, Admin, Developer, and Read-Only.
Project permissions table by role - SQL Editor
SQL Editor permissions by role: Queries (Create, Update, Delete, View, List): Owner, Admin, Developer, and Read-Only. Queries (Run): Owner, Admin, Developer, and Read-Only (footnote [^7] applies).
Organization-based billing structure
Supabase bills separately for each organization. Different plans cannot be mixed within a single organization. For example, you cannot have both a Pro Plan project and a Free Plan project in the same organization. To have projects on different plans, you must create separate organizations.
Monthly costs structure for paid plans
Monthly costs for paid plans include a fixed subscription fee based on the chosen plan and variable usage fees that are billed based on consumption beyond included quotas.
Variable usage quotas and overage billing
Each subscription plan includes a built-in quota for selected usage items such as Egress, Storage Size, and Edge Function Invocations. This quota represents your free usage allowance. Only usage beyond the quota is billed as overage. For usage items without a quota such as Compute or Custom Domains, you are charged for your entire usage. The quota is applied to your entire organization independent of how many projects you launch.
Paid plan benefits across organization
Upgrading to a paid plan (Pro, Team, or Enterprise) provides additional features and higher usage quotas for all projects within that organization. No projects in a paid plan organization will be paused.
Usage quotas and pricing table for all plans
Variable usage items and their quotas by plan are as follows: | Usage Item | Free | Pro/Team | Enterprise | |---|---|---|---| | Egress | 5 GB | 250 GB included, then $0.09 per GB | Custom | | Database Size | 500 MB per project | 8 GB disk per project included, then $0.125 per GB | Custom | | Monthly Active Users | 50,000 MAU | 100,000 MAU included, then $0.00325 per MAU | Custom | | Monthly Active Third-Party Users | 50,000 MAU | 100,000 MAU included, then $0.00325 per MAU | Custom | | Monthly Active SSO Users | Unavailable | 50 MAU included, then $0.015 per MAU | Custom | | Storage Size | 1 GB | 100 GB included, then $0.021 per GB | Custom | | Storage Images Transformed | Unavailable | 100 included, then $5 per 1000 | Custom | | Edge Function Invocations | 500,000 | 2 million included, then $2 per million | Custom | | Realtime Message Count | 2 million | 5 million included, then $2.5 per million | Custom | | Realtime Peak Connections | 200 | 500 included, then $10 per 1000 | Custom |
Project add-ons available
Individual projects can be enhanced with various add-ons including: Compute (up to 64 cores and 256 GB RAM), Read Replicas, Disk (extra IOPS/throughput or high-performance SSD), Log Drains, Custom Domains, PITR (point-in-time recovery), IPv4 (dedicated IPv4 address), Advanced MFA, and Pipelines (data replication from Supabase Postgres to destination systems). These add-ons are charged in addition to the organization's subscription plan.
Supabase subscription plans available
Supabase offers four subscription plans: Free, Pro, Team, and Enterprise. Each organization has its own subscription plan, payment method, billing cycle, and invoices.
Free Plan project limit
The Free Plan allows two free projects total. The project limit applies across all organizations where you are an Owner or Administrator. You could have two Free Plan organizations with one project each, or one Free Plan organization with two projects. Paused projects do not count towards the free project limit.
Monitor usage and costs
Usage can be monitored on the organization's usage page. The Upcoming Invoice section of the organization's billing page shows current spending and provides an estimate of total costs for the billing cycle based on usage.
Spend Cap limitations
The Spend Cap does not allow for fine-grained cost control, such as setting budgets for specific usage items or receiving notifications when certain costs are reached. More flexible cost control features are planned for the future.
How to configure Spend Cap
The Spend Cap can be configured when creating an organization on the Pro Plan or at any time in the Cost Control section of the organization's billing page.
Spend Cap behavior when disabled
When the Spend Cap is off, projects continue to operate after exceeding the quota for a usage item. Any additional usage is charged based on the item's cost per unit as outlined on the pricing page. Monitoring usage and costs on the organization's usage page is recommended.
Spend Cap behavior when enabled
When the Spend Cap is on, after exceeding the quota for a usage item, further usage of that item is disallowed until the next billing cycle. Users are not charged for over-usage, but services will be restricted according to the Fair Use Policy if the quota is consistently exceeded.
Usage items covered by Spend Cap
The following usage items are covered by the Spend Cap: Disk Size, Egress, Edge Function Invocations, Logs Ingest, Logs Query, Monthly Active Users, Monthly Active SSO Users, Monthly Active Third Party Users, Realtime Messages, Realtime Peak Connections, Storage Image Transformations, and Storage Size.
Spend Cap feature availability
The Spend Cap feature is available only with the Pro Plan. It is not available on the Free Plan, and you will not be charged while using the Free Plan.
Usage items not covered by Spend Cap
The following usage items are not covered by the Spend Cap because they are predictable and explicitly opted into by the user: Compute, Branching Compute, Read Replica Compute, Custom Domain, Additionally provisioned Disk IOPS, Additionally provisioned Disk Throughput, IPv4 address, Log Drain Hours, Log Drain Events, Multi-Factor Authentication Phone, and Point-in-Time-Recovery.
How to top up credits
To top up credits: (1) Go to the organization's billing page and navigate to the Credit Balance section. (2) Click the Top Up button. (3) Choose the amount. (4) Choose a payment method or add a new payment method. (5) Click Top Up.
Credit balance reduces future invoices
Each organization has a credit balance. Credits are applied to future invoices to reduce the amount due. As long as the credit balance is greater than $0, credits will be used before charging the payment method on file. The credit balance can be found on the organization's billing page.
Credit top-up limits and terms
The maximum credit top-up amount is $2,000 per transaction. Credits do not expire and are non-refundable. Credits are granted on the pre-tax amount; any applicable taxes added at checkout are not credited. For larger credit packages over $2,000, users should contact the growth team.
Invoice for credit top-up purchase
When a credit top-up payment is confirmed, a matching invoice is generated that can be accessed through the organization's invoices page.
Annual subscription not officially supported; use credit top-up instead
Supabase does not officially support annual plans. However, you can do a credit top-up to avoid monthly payments.