Disabling GraphQL or PostgREST (if you don’t need it)
By default, any Supabase project comes with GraphQL support. This is good for those who want it but I’d rather not have it enabled by default as Supabase already provides a good way of data handling without GraphQL with the Supabase client.
So, if you’re like me, not in need of GraphQL, I highly recommend disabling this exposed API. This means one less API, one less attack option, and in the best case, you’re saving resources.
As GraphQL is also just a database extension (pg_graphql), you can easily disable it in the Database | Extensions area of Studio. And, as shown in Understanding migrations, you can also pre-deactivate it as part of a migration file.
Sometimes people use Supabase for connecting to the database only and using its Auth system. Then, exposing/using PostgREST at all doesn’t make sense. In that case, you can completely disable it. In your local instance you can set the...
