Deploy a Supabase-Powered Website or Web App to Production

Review the Project Before Deploying

Use your AI coding assistant to identify exactly how the project uses Supabase before deploying it.

Production Deployment Review

Identifies the framework, package manager, build and start commands, output directory, runtime version and production environment variables, reports exactly which Supabase features the project uses, checks that no secret key is exposed in frontend code and that client-exposed tables have Row Level Security, runs the production build, and returns a short production deployment checklist.

Review this project specifically for production deployment with Supabase. Identify: - the framework and project type - the package manager - the production build command - the start command if required - the build output directory - the required Node.js/runtime version - every environment variable required in production — names only - how Supabase is used: database, authentication, storage, realtime, Edge Functions, or other features - which Supabase credentials are used in client-side code - whether any Supabase secret/server key is required on the backend - whether authentication uses redirect URLs, OAuth, email confirmation, or password reset flows - any other APIs or external services that need the final production domain Check that no Supabase secret key, legacy `service_role` key, or other private credential is exposed in frontend code. Check whether tables exposed to the client have appropriate Row Level Security policies. Run the production build and fix only genuine deployment blockers. Do not redesign the project or make unrelated changes. Give me a short production deployment checklist when finished.

NOTE

Supabase's current publishable key is designed for client-side use, while secret keys must remain on trusted server-side code because they can bypass Row Level Security.

Push the Production-Ready Project

Push the production-ready project to GitHub, then confirm the repository is safe to deploy from.

The repository contains the latest code

No private .env files are included

No secret credentials are included

You'll use this repository for deployment and future updates.

Get Hostinger Web App Hosting

This tutorial uses Hostinger to run the production website or web app.

Get Hostinger Web App Hosting

Deploy your Supabase-powered project from GitHub and keep future updates connected.

USED IN THIS TUTORIAL

https://www.hostg.xyz/SHJyP

Import the Repository and Deploy

In Hostinger:

Websites Add Website Deploy Web App

Choose Import Git Repository Connect GitHub and select your project Review the detected build and runtime settings Start the deployment

Hostinger supports GitHub-based Web App deployments with automatic builds and future redeployments.

Connect Your Existing Supabase Project

Open the deployed Web App dashboard in Hostinger and connect the existing Supabase project.

If available for your setup, use:

Database Connect Supabase

Sign in to Supabase Select the existing project Authorize the connection

Hostinger can retrieve the required Supabase environment variables and apply them to the Web App without changing your application code.

If your project requires additional environment variables, add them securely in Hostinger.

IMPORTANT

Never place Supabase secret keys or legacy service_role keys in browser-exposed variables.

Check the Temporary Live URL

Open the temporary live URL and test the Supabase-powered features.

Main pages and routes

Sign up and login

Database reads and writes

User-specific data access

Storage uploads if used

Realtime features if used

Forms and APIs

Server-side features if used

NOTE

If something fails, check the production environment variables, Supabase policies, and deployment/runtime logs before changing the application.

Connect Your Production Domain

Once the temporary deployment works, connect your production domain in Hostinger.

Update the Supabase URL Configuration

Then in Supabase, open:

Authentication URL Configuration

Set the production domain as the Site URL, then add any required production redirect URLs for authentication flows.

NOTE

Supabase uses the Site URL as the default redirect destination, including for flows such as email confirmations and password resets, so it should point to the real production domain.

Verify the Final Launch

Confirm the launch on the real domain before calling it done.

The production domain works

HTTPS is active

Sign up and login work

Email confirmations and password resets return to the correct domain

Database access follows the expected RLS policies

Storage and other Supabase features work

No private Supabase credentials are exposed in frontend code

Your Supabase-powered website or web app is now live.

Continue working normally and push new changes to the connected GitHub repository.

Your workflow becomes Project → GitHub → Hostinger + Supabase.

The application runs on Hostinger while your database, authentication, storage, and other Supabase services remain connected to Supabase.