Glossary

105 terms from Firebase and Supabase, in plain words, each with the chapter that teaches it.

Search the glossary

#

.env file: A file of `NAME=value` lines that Vite reads at start. Only names starting with `VITE_` are passed to the page, and their values end up in the built files where anyone can read them, so never put a secret key there.

A

access rules: Conditions the service checks on every request, such as 'a member may read only their own card'. They are the real lock on your data, because the page's connection details are public.
Admin SDK: Firebase's server-side library, which acts with full access and skips security rules. It belongs only in trusted code such as Cloud Functions or seed scripts, never in a page.
affectedKeys(): Rules functions used together: `diff` compares the incoming document with the stored one, `affectedKeys()` lists the fields that would change, and `hasOnly([...])` checks that only the listed fields are among them. Kettle & Crane uses this so members can change `name` and `city` but never `stamps`.
anon, authenticated: Postgres roles that Supabase requests run as: `anon` when the publishable key is used with nobody signed in, and `authenticated` when a signed-in user's token is sent. Policies name the roles they apply to.
API key (Firebase apiKey): A value in the Firebase config that only names your project. It is meant to be public, and access rules, not hiding it, protect the data.
aria-live: An HTML attribute that makes screen readers announce changes to an element, such as the Crane Card's message line. 'polite' waits until the reader is idle.
async/await: JavaScript syntax for waiting on promises. Many scripts here use `await` at the top level of a module to wait for each Firebase or Supabase call to finish.
auth.uid(): A Supabase SQL function that returns the signed-in user's ID, read from the request's JWT. `auth.users` is the table where Supabase Auth stores its users.
authentication (auth): Finding out who a visitor is, usually by email and password. It is one of the four parts every app needs from its backend.

B

backend: The part of an app that runs somewhere you control. It stores data, checks who each visitor is and holds secrets.
backend-as-a-service (BaaS): A hosted backend you configure instead of write, so you don't run servers, password storage or backups yourself. Firebase and Supabase are examples.
base64: A way of writing data as plain text. Each part of a JWT is JSON in base64, which is why every JWT starts with `eyJ`.
Bearer token: The way a client sends its access token in an HTTP request, in a header like `Authorization: Bearer <token>`. The add-stamp function strips `Bearer ` and asks Supabase Auth who the token belongs to.
Blaze: Firebase's pay-as-you-go paid plan. You keep the free amounts and pay only above them, and Cloud Functions and Cloud Storage need it, whereas the free Spark plan doesn't allow them.
Broadcast, Presence: Two Supabase Realtime features besides database change notifications. Broadcast sends messages between connected clients, and Presence tracks which clients are currently online.
bucket: A named container for uploaded files in Cloud Storage or Supabase Storage. A public bucket serves files to anyone with the address, while a private bucket serves only requests its rules or policies allow.

C

callable function: A Cloud Function made with `onCall`, built to be called from your own app. Firebase checks the caller's ID token first, and your code receives `request.data` and `request.auth`.
channel: In Supabase Realtime, a named stream of messages that you pick the name of. You attach `.on(...)` listeners and call `.subscribe()` to open it.
check constraint: A SQL column rule that makes Postgres refuse any row that breaks its condition, such as `stamps_needed > 0` on the rewards table.
CLI (command-line tool): A program you run by typing commands in a terminal rather than clicking in a window. Examples are the Firebase CLI (`firebase`) and the Supabase CLI (`supabase`), which run local copies of those services and deploy projects.
client SDK: A library your page or a Node script imports to talk to the service directly, with no API of your own in between. The Firebase SDK is the npm package `firebase`.
Cloud Functions: Your JavaScript code that Firebase runs on Google's servers when called. It uses the Admin SDK, so it skips the rules and members can't change its code.
Cloud Storage: Firebase's file storage, which keeps files such as photos in a bucket at paths like `avatars/dana/me.png`. A `storage.rules` file decides who may read or write.
collection, subcollection: A collection is a named group of documents, such as `cards`. A subcollection is one living inside a document, like Dana's `cards/dana/stamps`.
column, row, table: In Postgres, data lives in tables like spreadsheets: each column has a name and a type, and each row is one record. The rewards table has three columns and two rows.
config object: The public settings object passed to `initializeApp` that says which Firebase project to talk to. It isn't a secret and ships in every page.
config.toml: The Supabase CLI's settings file, created in the `supabase/` folder by `npx supabase init`. It holds per-project options, such as `verify_jwt = false` under `[functions.add-stamp]` to stop Supabase checking the caller's token before running that edge function.
container: A small self-contained Linux system that runs one program. Docker runs each Supabase service (Postgres, Auth, Storage) in its own container.
CORS headers: Headers that tell a browser that pages from other origins may call this server. A browser first sends an `OPTIONS` preflight request, which the edge function answers with these headers, and without them the browser blocks your page's calls.
curl: A command-line tool that sends a request to a web address and prints the reply. It is handy for testing a web address such as a `hello` function without writing a script.

D

default (SQL): A SQL column setting giving the value used when a row supplies none, such as `default auth.uid()` for `member_id` or `default now()` for `created_at`.
demo- project ID: A Firebase project ID starting with `demo-` that needs no real project or account. Nothing you do with it can reach Google's servers, so it is safe for experiments.
Deno: A JavaScript runtime like Node that Supabase edge functions run on. It uses the web-standard `Request`, `Response` and `fetch`, and loads npm packages with an `npm:` import.
denormalizing: Keeping a copy of data where a screen needs it, because Firestore can't join collections. Kettle & Crane stores the stamp count on the card as well as in the stamps subcollection, and both must be updated together.
destructuring, spread: JavaScript syntax that unpacks values from an array or object into variables, such as `const { data, error } = ...`. The spread `...m` copies an object's fields into a new one.
Docker: A tool that runs programs in containers. The Supabase CLI uses it to run a full copy of Supabase on your computer.
document database: A database that stores records as documents much like JSON objects, instead of rows in tables. Firestore is one.
document, document ID: A Firestore document is a set of named fields, like a JavaScript object, up to 1 MiB in size. Its document ID is a name that's unique within its collection, such as `dana`.
download URL token: The `token` at the end of a Cloud Storage download address. Anyone holding the URL can open the file without passing storage rules.

E

edge function: Supabase's server function: your code, run on Supabase's servers when called, written for Deno. The add-stamp edge function checks an order and inserts a stamp with the secret key.
email confirmation: A Supabase Auth setting that makes a new user click a link in an email before signing in. It is on by default for hosted projects and off locally, where Mailpit catches emails instead of sending them.
Emulator Suite, Emulator UI: The Emulator Suite is a set of local copies of Firebase's services (Auth, Firestore, Functions, Storage) running on your computer. The Emulator UI is its local web page, with a tab per emulator.
environment variables: Settings passed to a program when it starts. The Admin SDK finds the emulators through them, and edge functions read them with `Deno.env.get`.

F

FieldValue: Special values for Firestore writes: `increment(1)` adds 1 to a stored number on the server, so simultaneous writes can't lose a count, and `serverTimestamp()` stores the server's time, so a wrong device clock doesn't matter. In the Admin SDK they live on `FieldValue`.
Firebase CLI: Google's command-line tool for Firebase, installed with npm. It runs the emulators and deploys rules and functions.
firebase deploy: CLI commands for going live: `firebase login` signs the CLI in once, and `firebase deploy --only ...` uploads rules, functions or storage rules to a hosted project. `firebase init` writes config files by asking questions.
Firebase, Firestore: Firebase is Google's backend-as-a-service. Firestore is its document database, which stores records as documents in collections.
firebase.json: The file that tells the Firebase CLI what your project uses: emulators and their ports, the rules files and the functions folder.
foreign key: A column that must match a value in another table's key. `member_id uuid references auth.users` means a card can't belong to a user who doesn't exist.
free tier: The no-cost plan of a service, big enough to launch a small app but with limits (Firebase Spark, Supabase Free). Going over a limit stops that product or needs a paid plan, and free Supabase projects pause after 7 days unused.

G

gzip: A compression format. The gzip size Vite reports is roughly what visitors actually download.

H

Host addresses (127.0.0.1): 127.0.0.1 (also called localhost) is the address of your own computer, so the emulators and local Supabase use it. The number after the colon, such as 9099 or 54321, is the port of one service.
HTTP status codes: Numbers a server sends with each reply: 2xx means success, 400 bad request (such as 'Already stamped'), 401 not signed in, 404 not found and 500 a server error.
HttpsError: The error a callable function throws to refuse a request, with a standard code like `not-found` and a message. The client sees it with `functions/` in front of the code.

I

ID token, JWT: A signed pass proving who a user is, made of a header, a payload of facts and a signature, separated by dots. Anyone can read a JWT but only the service can sign one, and it lasts an hour before the SDK renews it.
index, composite index: A sorted list of field values Firestore uses to answer queries, made automatically for each field. A composite index covers two fields and is needed when a query filters on one field and sorts by another; on a hosted project the error includes a link to create it.
IndexedDB, localStorage: Browser storage where the SDKs keep a signed-in session between visits. Firebase uses IndexedDB and supabase-js uses localStorage.

J

JSON: A text format for structured data. Firestore documents are much like JSON objects, and `res.json` and `Response.json` send objects as JSON.

M

magic link: An emailed link that signs a user in without a password. Supabase supports them, but they need dashboard settings.
match, wildcard: In security rules, a `match` block names a path, and a `{name}` part is a wildcard that matches any ID and stores it in a variable. `match /cards/{uid}` covers every card document and puts its ID in `uid`.
migration: A numbered SQL file in `supabase/migrations/` that records one change to the database, so anyone can rebuild the same database from the files. `migration up` applies new ones and `db reset` replays all of them.
monthly active user: Anyone who signs in during a month, which is how both free tiers count sign-in users. Both allow 50,000 a month free.

N

npx: A tool that runs a package's command, such as `npx supabase start`.

O

onAuthStateChanged: A function that calls your callback with the current user, then again on every sign-in or sign-out. Firebase's version is `onAuthStateChanged` and supabase-js's is `onAuthStateChange`.
onRequest: A Cloud Functions helper that makes a plain web address. Your function receives the request and a response and sends a reply such as JSON.
onSnapshot: A Firestore function that calls your callback straight away and again each time a document or query changes. It returns an unsubscribe function that stops the listener.
open source: Software whose code is public. Because Supabase is open source, you can run it on your own servers, which is called self-hosting.

P

path, reference: A path says where a document lives, such as `cards/dana`, alternating collection and document. A reference is an object pointing at a path, whether or not anything exists there yet.
payload: The middle part of a JWT, holding facts about the user such as email, `user_id` and the issue and expiry times.
pg_dump: The standard Postgres tool that exports a database. Because Supabase is plain Postgres, it works for moving your data elsewhere.
policy: A Postgres rule that allows one action (select, insert, update or delete) on a table for chosen roles. Once row-level security is on, nothing is allowed until a policy allows it.
Postgres, SQL: Postgres is an open-source relational database that stores data in tables. SQL is the language you use to create tables and query them.
postgres_changes: The Realtime event type that delivers database changes. Only tables added to the Postgres publication `supabase_realtime` are sent.
primary key: The column that identifies each row, so no two rows can share it. The rewards table uses a numbered `id`, and cards use `member_id`.
Pro: Supabase's $25-a-month plan, with more database space, 100,000 monthly active users and no pausing, as of October 2026.
process.exit(0): A Node call that ends the script; 0 means it finished without errors. Firebase scripts need it because the SDK keeps a connection open.
project, project ID: A project is one app's backend: its users, database and files. The project ID is its unique name, such as `demo-kc`.
promise: A JavaScript object standing for a result that arrives later. Most SDK calls return one, which you wait for with `await`.
publishable key, secret key: Supabase's two kinds of key. The publishable key is safe in a page because it only lets visitors do what your policies allow, while the secret key can do anything and belongs only in trusted server code.

Q

query: A Firestore request for documents in a collection that match conditions, built with `where`, `orderBy` and `limit`. Security rules check the whole query before it runs.

R

Realtime: Supabase's service that pushes database changes to clients over a WebSocket instead of waiting for them to ask. It checks each event against the subscriber's select policies.
request.auth: In security rules, the user who sent the request (taken from their ID token), or `null` if nobody is signed in. `request.auth.uid` is their uid.
resource.data, request.resource.data: In security rules, `resource.data` is the document as stored now and `request.resource.data` is the document as it would be after the write. In Storage rules `request.resource` is the incoming file.
role, service_role: The Postgres identity a request runs as: anon, authenticated, or `service_role` for the secret key. `service_role` skips row-level security entirely.
row-level security (RLS): A Postgres feature that checks every row against your policies before a request may read or change it. Once enabled on a table, everything is denied until a policy allows it.
rules_version: The first lines of a rules file: `rules_version = '2'` picks the rules language version and `service cloud.firestore` says the rules are for Firestore.

S

security rules: Firebase's conditions checked on every client request before it reads or writes anything. A request no rule allows is refused, so they are the only thing between a visitor and your data.
signature: The third part of a JWT, made with a key only the service holds. It means nobody can change a token without being caught.
signed URL: An address that works for anyone, but only for a time you set. Dana's avatar link lasts an hour, whereas a public bucket's `getPublicUrl` address is permanent.
snapshot: The document, or a query's results, as it was at one moment. `snap.exists()` and `snap.data()` read it.
Storage rules: Firebase's security rules for Cloud Storage, kept in `storage.rules`. They use `service firebase.storage` and can limit who writes where, and a file's size and type.
storage.objects: Supabase's table with one row per stored file. Storage policies are RLS policies on it, and `storage.foldername(name)` splits a file path into folders so you can match the user's ID.
Studio: Supabase's web dashboard, with a table editor and a SQL editor. It has full access, so RLS doesn't stop what you do there.
Supabase CLI: The command-line tool that runs Supabase locally, manages migrations and edge functions, and links to a hosted project.
Supabase Storage: Supabase's file storage, which keeps files in buckets like Cloud Storage does. Access is controlled by RLS policies on `storage.objects`.
Supabase, supabase-js: Supabase is an open-source backend-as-a-service built on Postgres. supabase-js is its client SDK, whose calls return `{ data, error }` instead of throwing.

T

transaction: A group of reads and writes that succeed together or not at all. In Firestore, `runTransaction` reruns your function if another write changes the documents you read, so two claims of the same order can't both stamp it.
TypeScript: A typed superset of JavaScript. The edge function file ends in `.ts`, but it holds plain JavaScript.

U

uid: A user's permanent ID, which never changes even if the email does. It is the right key for a member's data, as in `cards/{uid}`. In Supabase the ID is a `uuid`, a long random ID.
unique: A SQL constraint that stops two rows sharing a value. On `stamps.order_no` it means an order earns one stamp at most, and a second insert fails with Postgres error code `23505`.

V

vendor lock-in: How hard and costly it is to move to another service once your code depends on one provider's features. The cost can be kept small by hiding the backend behind a single module in your own code.
verify_jwt: A Supabase function setting; with `verify_jwt = false` Supabase skips checking the caller's token and the function must check it itself.
Vite: A build tool and dev server for web pages. It reads `.env` settings, runs `npm run dev` and builds the `dist` folder for hosting.

W

WebSocket: A connection between client and server that stays open both ways, so the server can send messages at any time. Supabase Realtime uses one.