supabase-detect

Detect Supabase usage by analyzing client-side code, network patterns, and API endpoints. The tool identifies Supabase by combining domain patterns, client library signatures, API routes like /rest/v1/, and x-supabase-* response headers.

You can identify a Supabase backend without authentication. The detection process operates on a publicly accessible target URL, scanning for Supabase JS client signatures and known initialization patterns to return a confidence level.

Supabase API endpoints and headers indicating a backend integration include typical routes such as /rest/v1/, /auth/v1/, and /storage/v1/, alongside specific response headers like x-supabase-* found in network requests.

Supabase detection works for single page applications and custom domains. The approach applies during audits of unknown apps by analyzing domain patterns across HTML, JavaScript, and network requests to spot Supabase-related endpoints.

Verify Supabase usage before running deeper security tests by scanning for client library signatures and response headers. This quick verification returns a confidence level and project details when available from a public URL.

The best way to audit unknown apps for Supabase project details is to analyze domain patterns and client library signatures. This method quickly identifies Supabase usage and returns available project details without requiring login.