DOCUMENTATION
suparbase helps you synchronize database schemas and data between your Supabase environments (development, staging, production).
Terminal
git clone https://github.com/your-repo/supabase-syncer.git
cd supabase-syncerTerminal
npm install
# or
yarn installTerminal
cp .env.example .env.local
# Edit .env.local with your settingsTerminal
npm run dev
# Open http://localhost:3000Create a .env.local file with the following variables:
.env.local
# Required: 32-character encryption key for storing database URLs
ENCRYPTION_KEY=your_32_character_secret_key_here
# Required: Session secret (minimum 32 characters)
SESSION_SECRET=your_session_secret_minimum_32_chars
# Optional: Admin password hash (bcrypt)
# If not set, default password "admin123" will work
ADMIN_PASSWORD_HASH=$2a$10$...your_bcrypt_hash...
# Optional: Your own database for persistent storage
# If not set, connections are stored in memory (reset on restart)
DATABASE_URL=postgresql://user:pass@host:5432/dbname
# Optional: Redis for background job processing
# If not set, sync jobs run in real-time (blocking)
REDIS_URL=redis://localhost:6379Tip: Generate a secure encryption key with: openssl rand -hex 16
Note: Without DATABASE_URL, connections are stored in memory and will be lost when the server restarts.
Before syncing, you need to add your database connections.
Go to Connections
Click "Manage Connections" from the dashboard
Add a Connection
Enter a name, select environment (production/development), and paste your PostgreSQL URL
Test Connection
The system automatically tests the connection and shows available tables
postgresql://username:password@host:port/databaseFor Supabase: Go to Settings → Database → Connection string
Schema Sync compares table structures between databases and generates migration scripts to make them match.
For production databases, you'll need to type the connection name to confirm execution.
Data Sync copies rows between databases. It supports one-way sync with dry-run preview.
Copy data from source to target (UPSERT)
Coming soon - bidirectional with conflict detection
id, created_at, updated_at columnspublic schema onlysuparbase implements enterprise-grade security with a perfect 10/10 security score. All features are production-ready and designed to protect your data.
Comprehensive security audit passed with perfect score
All state-changing operations require CSRF token validation and origin checking
Redis-based rate limiting prevents abuse and ensures fair usage across all users
Activity timeout, session tracking, and "sign out all devices" functionality
Real-time security event logging and alerting for suspicious activity
CSP, HSTS, X-Frame-Options, and other security headers on all responses
Learn More About Security
Read our comprehensive for details on all security features.
Database URLs are encrypted with AES-256-GCM before storage
Extra confirmation required when modifying production databases
See exactly what will change before any data is modified
Automatic detection of breaking changes and type mismatches
Large databases may take longer. The system uses estimated row counts for performance. If it's still slow, check your database connection latency.
admin123 if ADMIN_PASSWORD_HASH is not setsuparbase provides a comprehensive REST API for programmatic access. All API endpoints require authentication and include CSRF protection, rate limiting, and comprehensive error handling.
/api/connectionsList all database connections for the authenticated user
Example Response
// Response
{
"success": true,
"connections": [
{
"id": "uuid",
"name": "Production DB",
"environment": "production",
"createdAt": "2024-01-01T00:00:00Z"
}
]
}/api/connectionsCreate a new database connection
Example Request/Response
// Request Body
{
"name": "My Database",
"databaseUrl": "postgresql://user:pass@host:5432/db",
"environment": "development"
}
// Response
{
"success": true,
"connection": {
"id": "uuid",
"name": "My Database",
...
}
}/api/connections/[id]/schemaGet full schema for a connection
/api/connections/[id]/executeExecute SQL on a connection (requires confirmation for production)
Production databases require typing the connection name to confirm execution
/api/syncCreate a new sync job
Example Request
// Request Body
{
"sourceConnectionId": "uuid",
"targetConnectionId": "uuid",
"direction": "one_way",
"tables": [
{
"tableName": "users",
"enabled": true,
"conflictStrategy": "last_write_wins"
}
],
"dryRun": false
}/api/sync/validateValidate schema compatibility between two connections
/api/sync/generate-migrationGenerate SQL migration script
/api/sync/[id]/metricsGet real-time sync metrics (Server-Sent Events)
All API requests require:
JavaScript Example
// Example: Including CSRF token
fetch('/api/connections', {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'X-CSRF-Token': csrfToken, // Get from /api/csrf
},
credentials: 'include',
body: JSON.stringify({ ... })
})Rate Limits:
Rate limit headers are included in all responses: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset
All errors follow a consistent format with error codes:
Error Response
// Error Response Format
{
"success": false,
"error": "Human-readable message",
"code": "E1001", // Error code (E1xxx = Auth, E2xxx = Authz, etc.)
"requestId": "req_abc123",
"recovery": "Suggested action"
}Error Code Ranges:
Common Status Codes:
Login and add your first database connection