Hosted identity pages, not only auth APIs
Guardhouse packages hosted login, account management, authorization, email delivery, and machine access as one product. Supabase Auth is tied closely to Postgres and Row Level Security, with application-owned UI and policy design. The deciding question is how much of the customer identity journey your team wants to build.
Last verified: July 20, 2026
Guardhouse advantage
Teams that want a complete white-label identity journey without assembling auth screens, permission tables, customer administration, and service authentication themselves.
Where Supabase Auth fits
Teams already building on Supabase that want identity tied directly to Postgres and are comfortable owning customer UI and authorization policy code.
Guardhouse hosts the identity experience on your domain and gives every plan visual themes plus advanced HTML and CSS control. Your application keeps its own visual language without maintaining separate authentication screens.
Compare the customer experience, access model, implementation work, pricing, and deployment choices. Use the filters to focus on the decision your team is making.
Every row in this comparison is a difference.
No rows match this filter. Turn off “differences only” or choose another category.
Guardhouse
Hosted password, passwordless, social, and SSO flows
Email/password, email magic links, Google, Microsoft, Apple, and Facebook are built in. Business and Enterprise plans add SSO.
Supabase Auth
Broad password, passwordless, phone, social, and SSO support
Supports email or phone credentials, magic links and OTPs, anonymous users, many social and custom OAuth/OIDC providers, and usage-priced SAML on paid plans. Applications integrate the flows.
Guardhouse
Hosted TOTP, recovery, trusted-device, and passkey flows
Enrollment, challenge, recovery codes, trusted devices, administrator MFA reset, and user-managed WebAuthn credentials are part of the hosted journey.
Supabase Auth
Plan, add-on, or setup dependent
MFA APIs and experimental passkeys
TOTP is included and phone MFA is a paid add-on. The application must build enrollment, challenge, factor management, and enforcement. Passkey support is experimental and requires explicit client opt-in.
Guardhouse
Hosted session controls and API revocation choices
Users can inspect and revoke browser and OAuth sessions from the hosted portal. APIs can reject revoked tokens on their next introspection check; locally validated JWTs remain valid until expiry.
Supabase Auth
Available
JWT and rotating refresh-token sessions
Pro adds session timeouts and single-session controls. Sign-out removes refresh state, but an issued access JWT remains valid until its expiry unless the API checks session state.
Guardhouse
Ready OAuth/OIDC flows for users, APIs, and services
Includes hosted authorization, Authorization Code with PKCE, refresh tokens, Client Credentials, JWT/JWKS validation, introspection, revocation, APIs, audiences, and scopes.
Supabase Auth
Plan, add-on, or setup dependent
Beta OAuth 2.1/OIDC server with RLS integration
Supports Authorization Code with PKCE and refresh tokens, discovery, UserInfo, and JWKS. Client Credentials is not supported; the developer must build login handoff and consent UI.
Guardhouse
Low-code roles, permissions, and organizations
Manage roles, direct and inherited permissions, OAuth scopes, and token claims in the identity console. Business adds organizations and multi-tenancy.
Supabase Auth
Plan, add-on, or setup dependent
Build the model with Postgres RLS and custom claims
Supabase documents SQL role and permission tables, a Custom Access Token Hook, and RLS policies. It is flexible, but teams design, code, test, and administer the tenant and permission model.
Guardhouse
Complete hosted profile and security portal
Users manage profile data, credentials, linked identities, passkeys, sessions, account deletion, and a basic profile export in a branded hosted experience.
Supabase Auth
Plan, add-on, or setup dependent
APIs, not a hosted account portal
APIs cover profile updates, identity linking, MFA, passkeys, and OAuth grants. The application builds and maintains the profile, security, session, consent, and account-deletion experience.
Guardhouse
White-label hosted journey on every plan
Theme controls, assets, custom text and links, seven languages, and advanced per-page HTML/CSS are available on all plans across login and profile surfaces.
Supabase Auth
Available
Customizable code blocks for basic Next.js auth screens
Supabase UI offers copied-into-your-app password and social-auth blocks for Next.js. Teams own the code and still build the wider account, MFA, passkey, consent, and administration journey. Email branding removal starts on Pro.
Guardhouse
Included on every plan
Customers configure a custom identity domain through a simple Customer Portal wizard on Startup, Business, and Enterprise.
Supabase Auth
Plan, add-on, or setup dependent
$10 monthly project add-on
Available on paid plans at $10 per domain per month per project. A project can use one CNAME-based custom domain; DNS and activation changes remain part of setup.
Guardhouse
Email templates and delivery included
Seventeen editable email templates, preview, testing, and SMTP, Postmark, SendGrid, or Amazon SES delivery are managed alongside authentication.
Supabase Auth
Plan, add-on, or setup dependent
Custom templates with customer-supplied production delivery
Custom SMTP and a Send Email Hook are supported. The default sender is testing-only, limited to authorized addresses and currently two messages per hour.
Guardhouse
Predictable identity plans with published allowances
Startup is $50/€45 monthly with 100,000 MAU, 10,000 M2M tokens, and 1,000,000 introspections. Business is $250/€225 with 500,000 MAU, 100,000 M2M tokens, and 5,000,000 introspections. Annual billing lowers the monthly rate.
Supabase Auth
Available
Project subscription plus usage and add-ons
Free includes 50,000 MAU. Pro and Team include 100,000, then charge $0.00325 per MAU. Compute, egress, SSO, custom domains, and phone MFA can add cost.
Guardhouse
Complete customer identity platform
Guardhouse delivers hosted customer pages, administration, authorization, email templates and delivery, API protection, and machine access in one product.
Supabase Auth
Auth service inside a backend platform
Supabase Auth can stand alone, but its main advantage is integration with a project's Postgres database, generated APIs, Storage, Realtime, and Functions. The application still owns the end-user journey.
Guardhouse
Purpose-built customer administration
The console and management API cover search, create, invite, update, block, reset, access assignment, anonymization, and deletion without building an admin application.
Supabase Auth
Available
Project dashboard plus server-side Admin APIs
Project operators can view, invite, delete, and export users in the dashboard; Admin APIs cover programmatic management. A delegated customer-admin experience requires application UI and a trusted backend.
Guardhouse
Available
User-created and user-updated webhooks
Includes user lifecycle events, signed delivery, endpoint controls, secret rotation, retry settings, and delivery history.
Supabase Auth
Plan, add-on, or setup dependent
Auth-flow hooks at selected execution points
HTTP or Postgres hooks can run before user creation, token issuance, email/SMS sending, and selected verification attempts; some hooks require Team or Enterprise.
Guardhouse
Available
.NET and JavaScript SDKs, with selected beta SDKs
Includes .NET/ASP.NET Core and React support. Node.js, React Native, and Python SDKs are beta; Python includes FastAPI and Flask helpers.
Supabase Auth
Broad official and community client ecosystem
Official libraries cover JavaScript/TypeScript, Dart/Flutter, Swift, and Python; other languages are community-maintained. Supabase UI adds Next.js auth blocks, while the SSR package remains beta.
Guardhouse
Migration assistance and bulk import across plans
Guardhouse can support discovery, field and permission mapping, bulk user import, validation, and cutover. Scope and responsibilities are agreed for the source system and rollout.
Supabase Auth
Available
Documentation and plan-based support
Supabase publishes migration guides and lets project owners export users from Postgres. The published Free, Pro, and Team plans do not list hands-on Auth migration.
Guardhouse
Available
Direct product support with migration help
Startup includes standard email support and Business adds priority support. Enterprise support, account management, and any response commitments are tailored to the customer agreement. Migration assistance is available with agreed scope.
Supabase Auth
Large ecosystem with plan-based managed support
Free is community-supported, Pro adds email support, Team adds priority support and SLAs, and Enterprise lists dedicated and 24/7 support. Self-hosting is community-supported.
Guardhouse
First-class OAuth for services and APIs
Client Credentials issues service tokens for configured API resources, audiences, and scopes, with introspection where current revocation status matters.
Supabase Auth
Limited
Backend secret keys, not an OAuth Client Credentials grant
Secret project keys support servers and jobs but bypass RLS. Supabase OAuth 2.1 explicitly does not support the client_credentials grant.
Guardhouse
Dedicated agent and MCP resource types
Guardhouse protects agent and MCP resources with Client Credentials, scopes, JWT validation, and optional introspection.
Supabase Auth
Plan, add-on, or setup dependent
Beta user-delegated OAuth for MCP
Supports discovery, dynamic client registration, user consent, refresh tokens, and RLS. The developer supplies the MCP server and authorization interface.
Guardhouse
Available
Managed cloud in the USA and EU
Choose a primary Guardhouse Cloud region in the USA or EU. Enterprise can be customer-operated or operated by LegioSoft, with a hosting model tailored to customer requirements.
Supabase Auth
One primary region from a broad AWS catalog
Each project uses one primary region. Supabase lists three general choices and 17 specific AWS regions across the Americas, Europe, and APAC.
Guardhouse
Enterprise deployment choice
Enterprise can be customer-operated as a Docker deployment or operated by LegioSoft. The hosting model and responsibilities are tailored to customer requirements; SSO, directory sync, SCIM, and BYOK are also available.
Supabase Auth
Docker self-hosting for the wider Supabase stack
The operator owns provisioning, hardening, upgrades, Postgres maintenance, high availability, backups, monitoring, and uptime. Self-host support is community-based.
Guardhouse keeps the identity bill legible. Startup includes 100,000 MAU, 10,000 M2M tokens, and 1,000,000 introspections; Business includes 500,000 MAU, 100,000 M2M tokens, and 5,000,000 introspections. Custom domains and white-label pages do not require separate add-ons; migration assistance is available with scope agreed for the source system.
Supabase Auth is billed inside a broader project subscription. Pro and Team include 100,000 MAU and then charge per additional MAU, while compute, egress, SAML users, custom domains, and phone MFA can create separate line items. Its OAuth 2.1 Server is free during beta, with post-beta pricing not yet published.
Guardhouse owns the customer-facing identity journey: registration, invitations, sign-in, recovery, MFA, passkeys, profile and security settings, session controls, and email templates and delivery. Every plan includes a custom-domain wizard and advanced HTML/CSS when theme controls are not enough.
Supabase now offers official, customizable password and social-auth blocks for Next.js. They are copied into the application rather than hosted by Supabase. Teams still implement MFA and passkey management, OAuth consent, profile and security settings, customer administration, and production email delivery.
Guardhouse combines first-party SDKs and standard OIDC with hosted flows, a customer administration console, self-service, low-code permissions, email, and machine OAuth. Product teams integrate identity instead of assembling each part around an authentication API.
Supabase has broad official and community client coverage, and its same-client workflow is excellent when identity feeds directly into Supabase Database, Storage, and Realtime. Its UI blocks accelerate common Next.js auth pages, but tenant schemas, RLS, customer admin, and advanced account screens remain application work.
Guardhouse offers primary USA and EU Cloud regions. Enterprise can be customer-operated as a Docker deployment or operated by LegioSoft, with the hosting model and responsibilities tailored to customer requirements. BYOK, SSO, SCIM, and directory synchronization are also available.
Supabase offers a broader managed AWS region catalog, with one primary region per project. Its Docker self-hosting path covers the whole backend stack, but the operator owns security, upgrades, Postgres operations, high availability, backups, monitoring, and uptime.
Guardhouse models roles, inherited and direct permissions, organizations, API resources, audiences, and scopes inside the identity platform. APIs can use local JWT validation or introspection when current revocation status is required.
Supabase makes Postgres RLS the primary authorization boundary for project data. Custom RBAC and multi-tenancy use application-owned tables, policies, and token hooks. This is highly flexible, but the customer owns the model and its tests. Access JWTs remain usable until expiry after sign-out unless an API checks session state.
Moving from Supabase Auth affects more than user rows. Inventory identities, custom claims, RLS policies, provider configuration, hooks, email templates, application SDK calls, API token validation, and active sessions.
Guardhouse offers migration assistance and bulk import across plans. The agreed scope can cover user and permission mapping, import validation, and cutover planning. Active sessions, passkeys, and some MFA factors still require explicit reauthentication or re-enrollment decisions.
Supabase Auth is a strong fit when database-native control matters more than a complete hosted identity journey.
Your application already uses Supabase Postgres, generated APIs, Storage, Realtime, or Edge Functions.
You want authorization policies to execute next to application data through Postgres RLS.
You need phone authentication or Supabase's broad social and custom OAuth/OIDC provider catalog.
You want to self-host the database and backend platform as well as Auth, and can operate that stack.
Guardhouse offers migration assistance and bulk import across plans, with scope agreed for the source system and rollout. A safe cutover still separates user records, credentials, authorization policy, application integration, and active sessions.
Available across Guardhouse plans
Migration assistance and bulk import are available across Guardhouse plans. The agreed scope can include discovery, mapping, import validation, and cutover planning.
Replace Supabase Auth SDK calls and project keys, update callback and logout routes, and change API authorization from Supabase JWT/RLS assumptions to Guardhouse token claims or introspection. Database RLS may still remain as defense in depth, but it needs a deliberate token-to-policy design.
The agreed migration plan can cover password and identity records, but passkeys are bound to their relying-party configuration and MFA or passkey re-enrollment may be required. Supabase phone-auth users need an alternative sign-in plan; SSO connections should be rebuilt against Guardhouse Business or Enterprise capabilities.
Supabase access JWTs remain valid until expiry after sign-out, while refresh sessions belong to the Supabase Auth service. Do not assume sessions can move between issuers; use a short overlap or require reauthentication at cutover.
Competitor details were checked against official product, pricing, and documentation pages on July 20, 2026. Plans and release stages can change.
Guardhouse
Guardhouse pricing (opens in a new tab)Guardhouse
Guardhouse .NET SDK (opens in a new tab)Guardhouse
Guardhouse Python SDK (opens in a new tab)Supabase
OAuth 2.1 flows (opens in a new tab)Supabase
Custom domains (opens in a new tab)Supabase
Auth Hooks (opens in a new tab)Supabase
User sessions (opens in a new tab)Supabase
Signing out (opens in a new tab)Start with the hosted flows and authorization model, then bring your existing users across with migration assistance and bulk import support scoped to your source system.
