Is Supabase banned in India? 2026 status and workaround

Short answer: On 24 February 2026, India's Ministry of Electronics and IT (MeitY) ordered access to supabase.co blocked under Section 69A of the IT Act, after a third party misused a project hosted on Supabase. Supabase says access was restored on 3 March 2026 after the order was rescinded (Supabase). As of our last check in October 2026, that post still reports access as restored. The lesson for app owners: if every request your app makes goes to <project>.supabase.co, one block on that domain can take your app down. A custom domain, a server-side proxy, monitoring and a tested backup reduce that risk.

What happened

Supabase's incident post lists the India block as running from 24 February to 3 March 2026, about eight days. It says the order came from MeitY under "Section 69A of the Information Technology Act" and was triggered by third-party misuse of a hosted project, not by anything Supabase customers in general did (Supabase).

TechCrunch reported that the block hit several providers, including Reliance Jio (JioFiber), Airtel and ACT Fibernet, and that it was uneven: some users in Bengaluru on ACT could still connect while users in New Delhi could not (TechCrunch). One founder told TechCrunch they had stopped seeing new sign-ups from India for two to three days.

The same Supabase post describes similar blocks in the UAE (September 2025) and Yemen (February 2026).

Why your users saw errors

A typical Supabase app, including most apps built with Lovable or Bolt, calls Supabase directly from the browser or phone. Login, database reads, uploads and Edge Function calls all go to https://<project>.supabase.co, and the block was on that supabase.co domain (Supabase).

So the app itself still loaded from your hosting, but every call to Supabase failed: endless spinners, "Failed to fetch" errors, logins that never finished. Your database was fine. Your users just couldn't reach it.

What Supabase suggested at the time

For developers, Supabase pointed to "VPNs, alternative DNS providers, and custom domains" as interim options (Supabase). Those can get a developer back into the dashboard. They are not a fix for your product: you can't ask every customer to install a VPN.

Option 1: put your API on a custom domain

Supabase lets you serve your project's API from your own domain, such as api.yourapp.in. Auth callbacks, Edge Functions and Storage URLs then use that domain too (Supabase custom domains docs). Your app's traffic then no longer depends on the name supabase.co.

Things to know before you do it:

• It costs extra. The docs say custom domains are "available as a paid add-on for projects on a paid plan." Free projects can't use it.
• The old URL keeps working. Supabase says the project domain "continues to work and serve requests", so you can switch client code over gradually. The fallback will only help you if your app actually uses the new domain, so update the URL in your app and your OAuth provider settings.
• Vanity subdomains don't help here. Supabase also offers names like your-brand.supabase.co, but that is still under supabase.co.

A custom domain still points to Supabase's servers, so it helps against a block on the domain name but shouldn't be your only safeguard.

Option 2: route requests through your own backend

The other approach is to stop the browser from calling Supabase directly. Your frontend calls your own API on your own domain (a Next.js route, a small server, or a function on your hosting provider). That server then talks to Supabase.

Your users only ever connect to your domain, and if one route to Supabase breaks, you fix it once on the server instead of in every installed copy of your app. The trade-off is work: moving auth, realtime and uploads behind your own API takes real effort. For many apps, doing it for the key flows (sign-up, login, checkout) is enough.

Option 3: know about it before your users tell you

During the block, at least one founder noticed only when sign-ups stopped. Add an uptime check on a simple Supabase endpoint, frontend error tracking that groups network failures by country, and a clear "we're having trouble reaching our servers" message instead of a blank screen.

Option 4: keep a tested backup and a migration plan

Supabase's docs show how to back up a project with the CLI in three parts: roles, schema and data, using supabase db dump (Supabase backup and restore docs). Storage files and Edge Functions have their own separate migration steps on the same page, so a database dump alone is not a full copy of your app.

A backup only counts if you've restored it. Restore it into a fresh project once and check the data. Write down the steps, environment variables and DNS records you'd change. That is your migration plan.

When moving off Supabase Cloud makes sense

An eight-day block that was later lifted isn't, on its own, a reason to move. It makes sense to consider moving if you have users or compliance needs that require you to control where and how the backend runs.

Self-hosted Supabase runs on Docker and gives you "full control over your data", but you take on server maintenance, security updates, Postgres maintenance and "backups and disaster recovery" yourself. Some platform features, including branching, managed backups and point-in-time recovery, aren't available when self-hosting (Supabase self-hosting docs). Moving to another Postgres host is also possible, but you'd need to replace Supabase Auth, Storage and Realtime, which is a bigger project.

For most small apps, a custom domain, monitoring and a tested backup are the right first steps.

FAQ

Is Supabase still banned or blocked in India? Supabase says access was restored on 3 March 2026 after the order was rescinded, and as of our last check in October 2026 that is still what its incident post reports. If one network still fails for you, test on a second network and check your own DNS settings.

Why did Supabase work on my Wi-Fi but not on Jio? Blocks are applied by each provider, and TechCrunch reported access varied by provider and city.

Will a custom domain stop this from happening again? It removes your app's dependence on the supabase.co name, which is the thing that was blocked, and Supabase suggested it as an option. It's a paid add-on, and it still points to Supabase's servers, so pair it with monitoring and a backup.

How do I migrate my Supabase app off supabase.co in India? You don't have to leave Supabase to stop depending on the supabase.co name: put the API on a custom domain or route key flows through your own backend, as described above. Moving to infrastructure you control is a bigger job, and our Rescue & Migration service covers it. See also how we work with founders in India.

Should I tell my users to use a VPN? No. Supabase mentioned VPNs as a workaround for developers. For your users, the fix belongs in your app's setup, not on their phones.

Building for users in India? See how we work with founders on our /india/ page. If you want help adding a custom domain, a server-side proxy or a tested backup, our Rescue & Migration service and our work on Supabase apps cover it. Start with the free Launch Check, or try our pricing calculator for an estimate.

Sources: Supabase: Navigating regional network blocks, TechCrunch on the India blocking order, Supabase custom domains docs, Supabase backup and restore docs, Supabase self-hosting docs. Checked October 2026.