The Complete SaaS Migration Checklist: Moving to Supabase in 2025

Use This Checklist to Migrate Without Surprises

Based on dozens of production migrations, here is every step you need to complete a safe, zero-surprise Supabase migration. Print it, share it with your team, and check items off methodically.

Phase 1: Pre-Migration Audit

• ☐ Document all database tables with row counts
• ☐ List all foreign key relationships
• ☐ Identify all database indexes
• ☐ Document all database functions and triggers
• ☐ List all auth providers (social logins, magic links, OTP)
• ☐ Inventory all storage buckets and their access patterns
• ☐ List all third-party services connected to the backend
• ☐ Identify all real-time features in the app

Phase 2: Supabase Setup

• ☐ Create new Supabase project (or self-hosted instance)
• ☐ Configure environment variables in a staging environment
• ☐ Enable required Postgres extensions (uuid-ossp, pgcrypto, etc.)
• ☐ Set up custom SMTP for auth emails
• ☐ Configure auth redirect URLs
• ☐ Set up Storage buckets matching current structure

Phase 3: Database Migration

• ☐ Export schema from source database
• ☐ Clean schema of platform-specific syntax
• ☐ Import schema to Supabase
• ☐ Verify all tables created correctly
• ☐ Export all data (consider chunking large tables)
• ☐ Import data in correct dependency order
• ☐ Validate row counts match source
• ☐ Validate foreign key integrity
• ☐ Re-create all indexes

Phase 4: Auth Migration

• ☐ Export user accounts from source
• ☐ Import users via Supabase Admin API (preserve UUIDs)
• ☐ Verify user IDs match FK references in other tables
• ☐ Test email/password auth flow
• ☐ Test social auth providers (Google, GitHub, etc.)
• ☐ Configure and test magic link flow
• ☐ Verify email templates match your brand

Phase 5: Security Configuration

• ☐ Enable RLS on every table
• ☐ Write and test SELECT policies
• ☐ Write and test INSERT/UPDATE/DELETE policies
• ☐ Configure Storage bucket policies
• ☐ Test as anon role (unauthenticated)
• ☐ Test as authenticated role
• ☐ Verify service role key is server-side only

Phase 6: Application Code Update

• ☐ Install @supabase/supabase-js
• ☐ Update all data query calls to Supabase client
• ☐ Update auth flows (login, logout, signup, session)
• ☐ Update storage upload/download calls
• ☐ Update real-time subscriptions
• ☐ Generate and integrate TypeScript types

Phase 7: Testing

• ☐ Test all CRUD operations via API
• ☐ Test auth flows end-to-end
• ☐ Test file upload and retrieval
• ☐ Test real-time features
• ☐ Run performance benchmarks on key queries
• ☐ Test with production data volume (if possible)

Phase 8: Production Cutover

• ☐ Run final incremental data sync
• ☐ Schedule maintenance window
• ☐ Update production environment variables
• ☐ Deploy updated application
• ☐ Run smoke tests in production
• ☐ Monitor error rates for 48 hours
• ☐ Keep old backend live for 72 hours before decommissioning

Want this checklist executed for you? Our team handles end-to-end migrations from Lovable Cloud to Supabase with a guaranteed zero-data-loss process.