Supabase Auth MAU, Storage, and Edge Functions: a free-tier check for indie MVPs
Supabase Free currently lists 50,000 MAU, 1 GB Storage, a 50 MB file limit, and 500,000 Edge Function invocations, but each wall affects a different path. This guide tests auth, uploads, and edge jobs separately for an indie MVP.
Supabase Auth MAU, Supabase Storage, and Edge Functions have separate free-tier walls. Supabase Free currently separates identity, files, and edge work into different allowances. Auth includes 50,000 MAU. Storage includes 1 GB, 5 GB cached egress, and a 50 MB maximum file size. Edge Functions include 500,000 invocations, while the free plan has a 150-second maximum wall-clock duration. Measure the three paths separately before changing the architecture or upgrading. This page was checked on November 10, 2026.
Draw three independent paths first
An indie MVP often has email or OAuth login, avatar or attachment uploads, and a daily sync task that calls an external API. Auth handles identity. Storage handles objects. Edge Functions handle scheduled or event-driven work. They may live in one project, but they do not consume one shared number.
Read the Supabase pricing page with the Auth guide, the Storage guide, and the Edge Functions limits. The pricing table gives allowances. The product docs explain the request and runtime model. Reading one table alone makes it easy to confuse MAU, file capacity, and invocations.
Auth MAU is not the registration total
The Free plan lists 50,000 MAU while Total Users is listed as Unlimited. For capacity work, record active users for the current month instead of adding every historical registration. A registered user with no activity in the month should not be treated as a current MAU without checking the billing definition.
Add a read-only observation field around login. Record monthly active users, sign-in method, and failure reason. Do not count email-code retries as new users, and do not use page views as a substitute for Auth activity. When an OAuth callback fails, inspect Auth logs and provider configuration before blaming a quota.
Free Auth also includes social OAuth, anonymous sign-ins, custom SMTP, and basic MFA. Advanced phone MFA, SAML SSO, leaked-password protection, and some session controls are listed outside Free. That is a feature eligibility boundary, not an MAU boundary. A product with enterprise sign-in can require a paid review with only a few hundred users.
Measure Storage by objects, bytes, and egress
Free Storage includes 1 GB, a 50 MB maximum file size, and 5 GB of cached egress. Avatars and attachments can reach the wall quickly when users keep uploading new versions without deleting old objects. Storing a path and metadata in Postgres does not remove the Storage object.
Before launch, record object count, total bytes, largest file, and monthly egress per bucket. Enforce type, size, and image-pixel limits on the server. Compress avatars. For larger files, compare an external object store or a resumable flow, then re-check authorization and deletion behavior.