Build the app on sample data, connect a backend with one click, and the AI creates the tables, the access rules and the sign-in screens in a real Expo app.
By hand you install supabase-js, keep the session in device storage, set the project URL and public key, and turn on row level security for each table. In Fastshot you build the app, connect a backend from the chat card, and the AI does all of it. You do not need your own Supabase account.
Last updated: November 4, 2026
Supabase is a backend platform built on Postgres. It turns your database into a REST API and protects the rows with row level security, so a React Native app can query it directly with no server of your own in between.
The app carries two public values, the project URL and a publishable key. Anyone holding them can call your database, so the rules live in the database: every table gets row level security and policies that say who can read or write which rows. A secret key never goes into the app.
The usual setup in Expo is a handful of steps. Install supabase-js and a session store, create one shared client, read the two values from EXPO_PUBLIC variables, and start and stop token refresh as the app moves to the background and back. Then you write SQL for each table and policy, and build the sign-in screens.
Fastshot writes those pieces from your description. If you want the bigger picture on accounts and data, read the lesson add a backend to your app. If you are still comparing databases, see Supabase vs Firebase.
A first version runs on sample data. After you connect the backend, the same screens read and write real data.
Email and password, Google and Apple sign-in, and a password reset flow. After an email sign-up the screen says to check the mailbox, and the session comes back when the user reopens the app.
One table for each kind of record your app keeps, with an owner column, defaults and foreign keys. The SQL is saved as migrations in the project, so later edits know what exists.
Policies for select, insert, update and delete tied to the signed-in user. One user can read and change their own rows, and a second user is turned away.
Buckets for profile photos, post images or receipts, with a folder for each user and policies on who can write there.
For a chat, a feed or a shared list, the table joins the realtime publication, so a new row from one phone appears on another without a reload.
When something must not run in the app, such as a call that needs a secret, the AI writes an Edge Function, deploys it and keeps its secrets on the server.
Build on sample data first. After the connection, use prompts like these.
Build a habit tracker with a list of habits and a daily check-in.
Connect a backend.
Add email, Google and Apple sign-in. Each user sees only their own habits.
Save every check-in to the database with the date.
Let users upload an avatar from their photo library.
Show a weekly streak that updates on all of my devices.Describe the app and let the first version run on sample data kept on the device. A Sample data label sits above the preview. Every screen works, and you can shape the app before any backend exists.
When the app feels right, click Sample data above the preview, open the Backend tab, or ask the AI to connect a backend. A connect card appears in the chat.
Create it from the card. Fastshot provisions and manages the Supabase project for the app, so you do not sign up at Supabase.
The AI replaces the on-device store with tables, adds access rules and real sign-in where records belong to a person, and points the same screens at the backend. The label switches to Live data.
Create an account in the preview, save a record, reload and see it come back. New accounts start empty, because sample records are not copied. Content the app ships with, like categories, is already in the database.
Build the app to your phone, then publish to the App Store and Google Play with your Apple Developer ($99 a year) and Google Play ($25 one-time) accounts. Sign-in works the same way in the installed app.
The left column follows the Expo and Supabase guides. The right shows what the AI does for the same task.
| Task | By hand in Expo | With Fastshot |
|---|---|---|
| Create the project | Sign up at Supabase, create a project, choose a region | Click create on the connect card in the chat |
| Client and session | Install supabase-js and a session store, write lib/supabase.ts | One shared client for auth, queries, storage and realtime |
| URL and key | Add EXPO_PUBLIC_SUPABASE_URL and the publishable key to .env | Set when the backend connects |
| Tables and security | Write SQL in the dashboard, enable RLS, add each policy | Migrations saved in the project, with RLS policies per table |
| Sign-in | Build the screens, handle email confirmation, wire Google and Apple | Generated screens for email, Google and Apple |
| Proof it works | Write a test screen that queries a table | The AI signs up, saves a record and reads it back after a reload |
A prompt like the one above leads to tables of this shape. Names change with your app.
| Table | Key columns | Who can read and write |
|---|---|---|
| profiles | id (the user), display_name, avatar_url | The owner of the row |
| habits | id, user_id, name, color, created_at | The owner of the row |
| habit_logs | id, habit_id, user_id, done_on | The owner of the row |
| avatars (storage bucket) | One folder per user ID | Each user manages their own folder |
Community apps on Fastshot whose prompts name Supabase for accounts and data.
An AI copilot for small business owners in Africa that manages clients, sales and products from a phone. See Songma in the gallery.
An investment tracker that reads its holdings from a Supabase assets table. See Wealthsphere in the gallery.
A friendship app with email and social sign-in through Supabase Auth. See Vibezone in the gallery.
Yes. The supabase-js client runs in React Native, and Expo documents a setup for it with a Postgres database and sign-in. You need a place to keep the session on the device and one shared client for the whole app.
The project URL and the publishable key are meant to ship in the app. What protects your data is row level security on every table. The secret key and the database password never go into the app, and Fastshot keeps them on the server.
Store the session on the device and refresh the token while the app is open. The generated sign-in code does this, so a user who signed in yesterday opens the app straight to their data.
No. The connect card creates a Supabase backend that Fastshot manages for your app. You never open the Supabase dashboard to set up tables or policies, because the AI does it from your prompts.
It stays on the device and is not copied. New accounts start empty. Content the app ships with, such as a list of categories, goes into the database so every user sees it.
Yes. After the backend is connected, ask for "Google sign-in" or "Apple sign-in" and the AI adds the buttons and the session handling next to email sign-in.
Skip the connect card. The app keeps its data on the device with local storage, and every screen still works. You can connect a backend later, and the same screens move onto it.
Supabase stores data in Postgres tables that you can query with SQL, and row level security keeps each row private. If you want a side-by-side view, read Supabase vs Firebase.
Compare builders that include a backend, sign-in and storage.
Weigh Postgres tables against a document database for your mobile app.
Bring users back to the app once accounts and data are in place.
Launch a first version on sample data, then add the backend when it is worth it.
Alternatives
AI & Industry
Start on sample data, connect a backend from the chat and test real sign-in on your phone.