Report More Criticismo to Plasmic Support
Context & Frustrations
We have spent many hours building a workaround: “Plasmic button → triggers REST API call → Next.js API → Supabase Authentication.” Despite our best efforts, we have not succeeded, and this workaround feels like a major misuse of development time.
We expected Plasmic to provide a more seamless, secure, and straightforward Supabase integration, especially for authentication — but what we found has been deeply limiting, fragile, and insecure.
Key Issues & Limitations
1. Severe Limitation of Supabase Storage Integration
-
The Plasmic integration with Supabase Storage is astonishingly limited: it only allows “upload file” and “get URL”.
-
There is no ability to run any meaningful Supabase client logic (such as user auth, table insert/update, or any other data operations).
-
This makes the storage integration nearly useless for building real SaaS functionality in Plasmic, because authentication and data writing are core needs.
-
In contrast, tools like FlutterFlow let you perform authentication (login, signup, reset password) directly via their Supabase integration UI — this is far more powerful and flexible.
2. Dangerously Insecure Database Integration
-
Plasmic’s “Database” integration with Supabase opens direct database access from the client-side. This means:
-
Anyone using the app could potentially write to or modify tables, if not carefully secured.
-
You have no built-in mediation or secure API layer in Plasmic — Plasmic itself is making queries to your Supabase DB.
-
-
In a production SaaS scenario, this is unacceptable, because business logic and security are completely offloaded to the client.
-
We are deeply concerned about data integrity, RLS (Row Level Security) misuse, and exposing the database schema or sensitive operations to users.
3. No Built-in Supabase Authentication Support
-
Plasmic does not provide a native, out-of-the-box Supabase Auth integration (signup, login, logout, reset password, update email).
-
We are forced to implement a manual and fragile flow, building API routes in Next.js, writing client modules, and wiring Plasmic buttons. This is far more work than expected — especially considering that other tools (like FlutterFlow) do this in a few clicks.
-
The lack of first-class auth support increases development time, introduces security risk, and makes the Plasmic experience feel underpowered for real applications.
The Impact of These Limitations
-
We have wasted developer hours trying to build a workaround for authentication that should be native.
-
The architecture we have to build is more complex, brittle, and risky than we initially planned.
-
We are forced to expose or implement sensitive logic ourselves (auth, session management), while we expected Plasmic to give us that “out of the box” for Supabase.
-
Our confidence in Plasmic as a production-grade tool for building SaaS is shaken: if we must do all this ourselves, what is the real advantage compared to a more integrated platform?
What We Are Asking Plasmic to Do
-
Support Supabase Authentication as a first-class integration
We strongly request that Plasmic supports signup, login, logout, password reset, and update email directly via a native Supabase Auth integration (not just DB). -
Expand Storage Integration Capabilities
The storage integration should expose actual client logic (not just “upload” and “get URL”), such as running Supabase JS client methods, performing authenticated file operations, and possibly triggering other Supabase actions. -
Provide a Secure, Recommended Pattern for Production Use
Plasmic should document and/or provide best practices for:-
Securely connecting Plasmic to Supabase using service-side logic (API routes or server modules)
-
How to structure environment variables, clients, and security layers
-
Sample projects or templates that show secure auth workflows
-
-
Advise on Our Current Approach
Given our current setup — Next.js API routes, Plasmic buttons calling those APIs, and Supabase client modules — what is Plasmic’s recommended workflow? Is there a more official or supported way to do what we’re trying to achieve?
Why This Is Critical
-
Without better support, building a secure, production-ready app on Plasmic + Supabase becomes a fragile, high-risk exercise.
-
Plugins or integrations that are “good enough for demos” are not enough for real users.
-
We believe Plasmic has the potential to be a very powerful tool for serious SaaS builders — but only if these architectural gaps are addressed.
Please let us know:
-
Is there a roadmap for a native Supabase Auth Action + Data integration?
-
Do you agree that the storage integration is too limited, and are you planning to expand it?
-
Can you provide a secure example or template for Supabase + Plasmic production apps?
Thank you for your support and feedback.
