TL;DR
To build an internal tool with team sign-in, a database, a daily job, and an agent API key, Vercel + Supabase takes two vendors, about 448 lines of auth code from the official template, and a shared secret key for the agent. floo takes one vendor, no auth code, and a scoped, revocable key per agent. floo runs the internal and personal software you build with AI: sign-in for people, API keys for agents, Postgres, storage, and scheduled jobs in one app.
- The task is the same on both. An inventory tool for 3 people with invite-only sign-in, a Postgres table, a daily low-stock job, and an API key for an outside agent.
- Sign-in is the biggest difference for people. Supabase's Next.js template generates 11 auth files. Inviting people outside your Supabase org also needs a custom SMTP provider.
- Agent access is the biggest difference for agents. Supabase's server-side keys bypass row-level security, so an agent gets full project access unless you build your own key system.
- On floo, both are configuration. Sign-in is one line in floo.app.toml, and each agent gets a key scoped to the routes you declare.
- Supabase Cron is a real strength. It runs a scheduled SQL statement with no app code or secret.
Every count below comes from the vendors' own documentation and the official with-supabase Next.js template, read on October 22, 2026. Sources are listed at the end.
What is the task?
An inventory tool for a 3-person team, built with Next.js:
- A web page only invited teammates can sign in to.
- A Postgres table of stock.
- A daily job that flags low stock.
- An API key an outside AI agent can use to read and update counts, scoped to this app and revocable without affecting the people.
We followed each vendor's recommended path: the Vercel Marketplace Supabase integration and the @supabase/ssr Next.js guide on one side, floo's docs on the other.
How do they compare?
| Vercel + Supabase | floo | |
|---|---|---|
| Vendors | 2, or 3 with an SMTP provider | 1 |
| Dashboards | 2 (Vercel, Supabase Studio) | 1 |
| Sign-in code | 11 template files, about 448 lines | None; read the X-Floo-User-Email header |
| Invite-only | Disable sign-ups, edit the invite email template, write an invite script that holds the secret key | access_mode = "accounts", then floo apps invite <email> |
| Invite email delivery | Built-in SMTP reaches only Supabase org members, 2 messages an hour; others need custom SMTP | Sent by floo |
| Database | Supabase Postgres; enable row-level security on every exposed table | [managed.default] with type = "postgres"; DATABASE_URL is injected |
| Daily job | Supabase Cron (SQL), or Vercel Cron plus a route and a CRON_SECRET | [cron.<name>] in config, run in the app's container |
| Agent key | A secret key with full project access that bypasses row-level security, or custom code | A per-consumer key scoped to declared routes, rate-limited, revocable, with request history |
| Cheapest commercial plans that never pause | About $45 a month (Vercel Pro $20 + Supabase Pro $25) | $0 monthly commitment; pay for usage |
What does sign-in take on Vercel + Supabase?
Supabase Auth handles identity, and your app handles the session. The official with-supabase template generates 11 files for it, about 448 lines: browser and server clients, a proxy that refreshes tokens, a confirm route, and login, logout, and password pages. The guide warns that refreshing a token in two places causes random sign-outs and that a CDN cache can leak one user's session to another.
Making it invite-only adds four more steps. You disable sign-ups, edit the invite email template so it links to a server route, write a script or route that calls inviteUserByEmail with the secret key, and delete the template's sign-up and forgot-password pages. Supabase's built-in email reaches only members of your Supabase org, at 2 messages an hour, so inviting anyone else needs a custom SMTP provider.
Vercel's Deployment Protection is an alternative gate. It admits only signed-in Vercel users, needs Pro for more than one outside viewer, and also blocks your API routes unless callers send a bypass header.
What does sign-in take on floo?
One config line. access_mode = "accounts" puts floo's hosted sign-in in front of the app, and floo apps invite teammate@acme.com --role member sends the invitation. Every request that reaches your code carries X-Floo-User-Email, X-Floo-User-Id, X-Floo-User-Name, and X-Floo-User-Role. Removing a member revokes their sessions immediately.
There is no login page, session store, token refresh, or email provider to set up.
How does an AI agent get access?
This is the widest gap. Supabase offers publishable keys, which respect row-level security, and secret keys, which bypass it. Its docs warn that exposing a secret key puts all of a project's data at risk, and recommend a separate secret key per backend component, but every secret key has full project access. A scoped key for one agent means minting your own JWTs, running Supabase's OAuth server and building its consent screen, or writing your own key table.
On floo, you declare which routes accept machine access, then mint a key for a named consumer:
floo apps consumers create stock-agent
floo apps keys create stock-agent --consumer stock-agent --scope inventory.write --rate-limit-rpm 60
The key works only on routes declared with that scope, is rate-limited, and can be revoked on its own. Every request it makes is listed by key ID. floo strips the key before your code sees the request and passes the verified consumer's identity instead. The people's sign-in is untouched.
Where is Vercel + Supabase stronger?
- Scheduled SQL. Supabase Cron runs a SQL statement on a schedule with no app code or secret. floo runs a command in your container, which is more flexible but means writing a small script.
- Ecosystem. Supabase adds realtime, edge functions, and its own auth providers. Vercel has a large framework and frontend ecosystem.
- Marketplace sync. Installing Supabase from the Vercel Marketplace syncs 13 environment variables automatically, so few secrets are copied by hand on that path.
Which should you choose?
Choose floo when the tool is for a known group of people and an agent will use it too: sign-in, database, jobs, and agent keys come in one app, with nothing to write for auth. Choose Vercel + Supabase when you need Supabase's realtime or auth providers, or your team already runs on both.
Sources
- Supabase: Next.js server-side auth, general auth configuration, inviteUserByEmail, email templates, SMTP, API keys, row-level security, Cron, Vercel Marketplace integration, pricing
- Vercel: with-supabase template, Deployment Protection, Vercel Authentication, cron jobs, Hobby plan, pricing
- floo: app auth, app API keys, Postgres, cron jobs, pricing
Frequently asked questions
Can Supabase give an AI agent a scoped API key?
Not as a documented feature. Supabase secret keys bypass row-level security and have full project access. A scoped agent credential means minting your own JWTs, running Supabase's OAuth server, or building your own key system.
How much auth code does Supabase need in a Next.js app?
The official with-supabase Next.js template generates 11 auth files, about 448 lines, before you make sign-in invite-only.
Does floo require auth code?
No. With access_mode = "accounts", floo's gateway handles sign-in and sessions and passes the signed-in user's identity to your app in request headers.
What does Vercel + Supabase cost for a commercial internal tool?
At least about $45 a month in plan fees: Vercel's Hobby plan is for non-commercial use only, and Supabase's free projects pause after a week of inactivity. floo's Pay as you go plan has no monthly commitment; you pay for usage.
Can floo run scheduled jobs?
Yes. Declare a [cron.<name>] section with a schedule and a command in floo.app.toml, and each deploy creates, updates, or removes the job.