Supabase

The unified C# client for Supabase. One client composes Auth, Database, Storage, Realtime, and Edge Functions, so you configure your project once and reach every service from a single object.

Part of the Supabase C# SDK. To use a single service on its own, reference its package instead — see Individual services.

Installation

dotnet add package Supabase

Targets .NET Standard 2.1, so it runs on .NET Core / .NET 5+, Xamarin, MAUI, and Unity. See the wiki for platform-specific guides.

Getting started

Create a project in the Supabase dashboard and grab your project URL and API key from Settings → API — a publishable key (sb_publishable_…) for client-side use, or the legacy public (anon) key. Then initialize the client:

using Supabase;

var url = Environment.GetEnvironmentVariable("SUPABASE_URL");
var key = Environment.GetEnvironmentVariable("SUPABASE_KEY");

var options = new SupabaseOptions
{
    AutoRefreshToken = true,
    AutoConnectRealtime = true
};

var supabase = new Client(url, key, options);
await supabase.InitializeAsync();

InitializeAsync() wires up the child clients and, if a session has been persisted, restores and refreshes it. Once it returns, reach each service from the client:

// Auth
var session = await supabase.Auth.SignIn("user@example.com", "password");

// Database (models derive from BaseModel — see the Postgrest package)
var response = await supabase.From<Movie>().Get();
var movies = response.Models;

// Call a Postgres function
await supabase.Rpc("some_rpc", new { some_arg = "value" });

// Storage
await supabase.Storage.From("avatars").Upload("./local.png", "me.png");

// Realtime
var channel = supabase.Realtime.Channel("movies");
await channel.Subscribe();

// Edge Functions
await supabase.Functions.Invoke("hello-world");

Configuration

Pass a SupabaseOptions to the constructor:

Session persistence

By default the client does not persist the auth session, so the user is signed out when the process ends. Provide a SessionHandler to save, load, and destroy the session — for example to a file or to the platform's secure storage. See Authorization with Gotrue in the wiki for a worked example.

A note on keys: some APIs (user administration, bypassing RLS, etc.) require an elevated key rather than the public/publishable one. Never expose an elevated key in client-side code, and use a separate client instance for service and user contexts.

New API keys (publishable / secret)

Supabase is replacing the legacy JWT-based anon and service_role keys with opaque keys, deprecating the legacy keys by the end of 2026. The SDK supports both:

Pass either as the key argument; no other code changes are required. Because the new keys are not JWTs, they must travel on the apikey header only — the SDK detects the sb_publishable_ / sb_secret_ prefixes and, on the Edge Functions path, stops sending the key as an Authorization: Bearer token when there is no user session (the Functions gateway would otherwise reject it as an invalid JWT). Legacy JWT keys are unaffected. See the Supabase guide on migrating to the new API keys.

Observability (OpenTelemetry)

The clients emit traces and metrics through System.Diagnostics, so you can wire them into OpenTelemetry (or any ActivityListener / MeterListener) without taking a dependency on the OpenTelemetry packages. Emission is zero-cost while nothing is listening, so it is always on and stays silent until you subscribe.

Register every instrumented source at once with SupabaseDiagnostics.SourceNames — each client shares one name between its ActivitySource and its Meter, so the same list works for tracing and metrics:

using OpenTelemetry.Metrics;
using OpenTelemetry.Trace;
using Supabase;

// Requires OpenTelemetry.Extensions.Hosting and an exporter package (e.g. OTLP) in your app.
builder.Services.AddOpenTelemetry()
    .WithTracing(tracing => tracing
        .AddSource(SupabaseDiagnostics.SourceNames.ToArray())
        .AddOtlpExporter())
    .WithMetrics(metrics => metrics
        .AddMeter(SupabaseDiagnostics.SourceNames.ToArray())
        .AddOtlpExporter());

This covers the Auth, Postgrest, Functions, and Storage clients. Realtime is not yet instrumented, so no websocket telemetry is emitted. URLs are recorded without their query string, and no token, credential, or payload is placed in a tag. Each service package's README documents the specific spans and metrics it produces.

Individual services

Each service is also published as a standalone package, useful when you only need one:

Documentation

• Getting Started
• Supabase C# reference
• Generated API docs
• Examples
• Troubleshooting · Discussions

Contributing

Contributions are welcome. See the repository root for how to build and test the SDK.

License

MIT