How to Self-Host a Supabase Proxy on Cloudflare Workers (Free)

Prerequisites

You need two things before starting:

• Node.js 18 or higher — check with node -v. Install from nodejs.org if needed.
• A Cloudflare account — sign up free at dash.cloudflare.com. No credit card required.

You also need your Supabase project URL. Find it in your Supabase Dashboard under Settings → API → Project URL. It looks like https://abcdefgh.supabase.co.

Open your terminal and run:

This downloads and runs the setup wizard. On first run, npm may ask to confirm the package install — type y and press enter.

The wizard asks for your Supabase project URL first. Paste the full URL or just the subdomain — the CLI normalizes it automatically:

  Step 1 of 5 -- Your Supabase project URL
  ◆ Supabase project URL
  |  https://abcdefgh.supabase.co
  ⌊

The CLI validates the URL format. You can enter abcdefgh.supabase.co without the protocol and it will add https:// automatically.

Next, the wizard asks about CORS origins and which Supabase services to enable:

• Allowed origins: Use * for development (allows all domains) or list specific origins like https://myapp.com
• Services: Toggle which Supabase services the proxy should handle. All 6 are enabled by default (REST, Auth, Storage, Realtime, Edge Functions, GraphQL). Deselect any you don't use.
• Worker name: Becomes your proxy URL: https://<name>.<you>.workers.dev

The CLI scaffolds your project, installs dependencies, and asks if you want to deploy immediately. If you're not logged into Cloudflare yet, it opens wrangler login in your browser for OAuth authentication.

After deployment, you'll see your proxy URL:

  ✔ Project scaffolded at ./supabase-proxy
  ✔ Dependencies installed
  ✔ Deployed to https://supabase-proxy.you.workers.dev

Replace your Supabase URL with the proxy URL. Only one line changes:

Your anon key, service role key, and all RLS policies stay exactly the same. Only the base URL changes.

Testing your proxy

Verify the proxy works with a few quick tests:

REST API

curl https://supabase-proxy.you.workers.dev/rest/v1/ \
  -H "apikey: YOUR_ANON_KEY"

Health check

curl https://supabase-proxy.you.workers.dev/__health

WebSocket (Realtime)

If you enabled the Realtime service, test WebSocket connectivity by using the Supabase client in your app. Subscriptions should connect through wss://supabase-proxy.you.workers.dev/realtime/v1/websocket.

Troubleshooting

Next steps

• Add a custom domain instead of the workers.dev URL
• Restrict CORS to your production domains instead of *
• Disable services you don't need for a smaller attack surface
• Consider the managed JioBase service if you need analytics and rate limiting