KavachOS vs Supabase Auth
Supabase Auth is a solid open-source choice for human logins, especially if you are already on Supabase. KavachOS goes further — agent identity, MCP OAuth 2.1, and no PostgreSQL dependency.
11
unique features
10
shared
MIT
open source
Why switch
Supabase Auth is tightly coupled to PostgreSQL
GoTrue, the engine behind Supabase Auth, stores everything in Postgres. If your stack uses SQLite, D1, MySQL, or another database, you are pulling in a heavy dependency just for auth. KavachOS supports SQLite, Postgres, MySQL, and Cloudflare D1 natively.
No agent identity or MCP OAuth
Supabase Auth has no concept of AI agent tokens, delegation chains, or MCP OAuth 2.1. KavachOS ships these as first-class primitives — not a roadmap item, not a workaround using service role keys.
Open source, but on different terms
Supabase Auth is Apache 2.0. KavachOS is MIT. Both are self-hostable. The difference is that KavachOS runs on Cloudflare Workers and edge runtimes out of the box — no Docker, no VM, no Postgres server required to get started.
Feature comparison
| Feature | KavachOS | Supabase Auth |
|---|---|---|
| AI agent identity Supabase Auth has no agent token primitive | ||
| MCP OAuth 2.1 KavachOS is spec-compliant; Supabase has no MCP support | ||
| Agent delegation chains | ||
| Agent permission scoping | ||
| Agent audit log | ||
| Self-hosting Supabase is self-hostable via Docker | ||
| Open source (MIT) Supabase Auth is Apache 2.0, not MIT | ||
| Social / OAuth providers (27+) | ||
| Passkeys / WebAuthn | ||
| Magic link | ||
| Multi-factor authentication Supabase MFA supports TOTP; SMS MFA is in preview | ||
| Enterprise SSO (SAML, OIDC) Supabase SAML SSO requires Pro plan or above | ||
| SCIM provisioning Supabase does not offer SCIM | ||
| Organizations / multi-tenancy Supabase has no native multi-tenant auth primitive | ||
| Machine-to-machine tokens Supabase service role keys are a workaround, not a first-class M2M primitive | ||
| Custom domains Supabase custom domains require Pro plan | ||
| Custom email templates | ||
| Brute force protection | ||
| Breach password detection | ||
| Free tier Supabase free tier includes 50,000 MAU | ||
| Cloudflare Workers runtime GoTrue requires a persistent server |
Pricing
Supabase uses project-based pricing, not strict MAU tiers. The free tier is generous at 50,000 MAU. Beyond that, Pro at $25/month covers 100,000 MAU. SAML SSO requires Pro or above. The Team plan at $599/month adds priority support and higher limits.
KavachOS Cloud uses flat monthly tiers with no surprise overages for SSO, organizations, or enterprise features.
Migration
Export your users from Supabase using the admin API (`supabase.auth.admin.listUsers()`). KavachOS accepts this format through the import CLI command — bcrypt password hashes migrate without user resets.
Replace Supabase Auth client calls with the `kavachos` SDK. Session management and token verification follow standard OAuth 2.0 conventions, so the surface area to change is small.
Update environment variables — swap `SUPABASE_URL` and `SUPABASE_ANON_KEY` for the KavachOS project URL and publishable key from the dashboard.
Re-configure your social providers in the KavachOS dashboard. OAuth redirect URIs work the same way, so your existing provider app registrations stay valid.
If you were using Supabase Row Level Security with `auth.uid()`, update your policies to use the KavachOS JWT claim equivalent and test your data access rules before cutting over.
FAQ
MIT licensed. Self-hostable. Runs anywhere Node runs.