Then you're able to import the library and establish the connection with the database:
import { createClient } from'@supabase/supabase-js'// Create a single supabase client for interacting with your databaseconst supabase = createClient('https://xyzcompany.supabase.co', 'public-anon-key')
UMD
You can use plain <script>s to import supabase-js from CDNs, like:
supabase-js uses the cross-fetch library to make HTTP requests, but an alternative fetch implementation can be provided as an option. This is most useful in environments where cross-fetch is not compatible, for instance Cloudflare Workers:
import { createClient } from'@supabase/supabase-js'// Provide a custom `fetch` implementation as an optionconst supabase = createClient('https://xyzcompany.supabase.co', 'public-anon-key', {
global: {
fetch: (...args) =>fetch(...args),
},
})
Support Policy
This section outlines the scope of support for various runtime environments in Supabase JavaScript client.
Node.js
We only support Node.js versions that are in Active LTS or Maintenance status as defined by the official Node.js release schedule. This means we support versions that are currently receiving long-term support and critical bug fixes.
When a Node.js version reaches end-of-life and is no longer in Active LTS or Maintenance status, Supabase will drop it in a minor release, and this won't be considered a breaking change.
⚠️ Node.js 18 Deprecation Notice
Node.js 18 reached end-of-life on April 30, 2025. As announced in our deprecation notice, support for Node.js 18 was dropped in version 2.79.0.
If you must use Node.js 18, please use version 2.78.0, which is the last version that supported Node.js 18.
Deno
We support Deno versions that are currently receiving active development and security updates. We follow the official Deno release schedule and only support versions from the stable and lts release channels.
When a Deno version reaches end-of-life and is no longer receiving security updates, Supabase will drop it in a minor release, and this won't be considered a breaking change.
Browsers
All modern browsers are supported. We support browsers that provide native fetch API. For Realtime features, browsers must also support native WebSocket API.
Bun
We support Bun runtime environments. Bun provides native fetch support and is compatible with Node.js APIs. Since Bun does not follow a structured release schedule like Node.js or Deno, we support current stable versions of Bun and may drop support for older versions in minor releases without considering it a breaking change.
React Native
We support React Native environments with fetch polyfills provided by the framework. Since React Native does not follow a structured release schedule, we support current stable versions and may drop support for older versions in minor releases without considering it a breaking change.
Cloudflare Workers
We support Cloudflare Workers runtime environments. Cloudflare Workers provides native fetch support. Since Cloudflare Workers does not follow a structured release schedule, we support current stable versions and may drop support for older versions in minor releases without considering it a breaking change.
Important Notes
Experimental features: Features marked as experimental may be removed or changed without notice
Known Build Warnings
UNUSED_EXTERNAL_IMPORT in Vite / Rollup / Nuxt
When bundling your app, you may see warnings like:
"PostgrestError" is imported from external module "@supabase/postgrest-js" but never used in "...supabase-js/dist/index.mjs".
"FunctionRegion", "FunctionsError", "FunctionsFetchError", "FunctionsHttpError" and "FunctionsRelayError" are imported from external module "@supabase/functions-js" but never used in "...".
This is a false positive — your bundle is fine. Here is why it happens:
@supabase/supabase-js re-exports PostgrestError, FunctionsError, and related symbols so you can import them directly from @supabase/supabase-js. However, our build tool merges all imports from the same package into a single import statement in the built output:
// dist/index.mjs (simplified)import { PostgrestClient, PostgrestError } from'@supabase/postgrest-js'// ^ used internally ^ re-exported for you
Your bundler checks which names from that import are used in the code body, and flags PostgrestError as unused because it only appears in an export statement — not called or assigned. The export itself is the usage, but downstream bundlers don't track this correctly. This is a known Rollup/Vite limitation with re-exported external imports.
Nothing is broken. Tree-shaking and bundle size are unaffected.
To suppress the warning:
Vite / Rollup (vite.config.js or rollup.config.js):
Firebase is a comprehensive app development platform by Google that offers a variety of tools including Firestore for database operations, Firebase Auth for authentication, and Firebase Realtime Database for real-time data synchronization. Compared to @supabase/supabase-js, Firebase offers a more extensive suite of services but is not open-source.
Hasura is an open-source engine that provides instant GraphQL APIs on your data. It supports real-time subscriptions and integrates well with existing databases. Compared to @supabase/supabase-js, Hasura focuses on GraphQL APIs and offers more advanced querying capabilities.
Parse is an open-source backend framework that provides a variety of features including a database, user authentication, and real-time notifications. It is similar to @supabase/supabase-js in its open-source nature and feature set but has a different architecture and community support.
The npm package @supabase/supabase-js receives a total of 10,352,894 weekly downloads. As such, @supabase/supabase-js popularity was classified as popular.
We found that @supabase/supabase-js demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.It has 14 open source maintainers collaborating on the project.
Package last updated on 26 Feb 2026
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
The GCVE initiative operated by CIRCL has officially opened its publishing ecosystem, letting organizations issue and share vulnerability identifiers without routing through a central authority.