In this guide
- Supabase's REST API (PostgREST) lets a tag insert rows with an API key and a JSON body.
- Use a server-only key, row-level security, and only the columns you need.
- For event warehouses at volume, BigQuery is usually a better fit.
Sometimes you want your events in your own database: a table of purchases, leads or custom events you can query with SQL. Supabase is a popular hosted Postgres with an HTTP API, and a server container can write to it. This page gives the pattern and the cautions. Supabase's API changes, so check its documentation. See cloud databases for server GTM and server-to-server tracking.
What you need
- A Supabase project and a table, for example
eventswith columns for name, time, order ID, value and source. - An API key. For writing from a server, use a key that is never exposed to browsers.
- Row-level security policies that allow only the inserts you intend.
Ask Ari instead of digging through reports
Ari reads your tracking and ad data and answers in plain words.
The request
const sendHttpRequest = require("sendHttpRequest");
const JSON = require("JSON");
const getEventData = require("getEventData");
sendHttpRequest(data.projectUrl + "/rest/v1/events", (statusCode) => {
statusCode >= 200 && statusCode < 300 ? data.gtmOnSuccess() : data.gtmOnFailure();
}, {
method: "POST",
headers: {
"apikey": data.apiKey,
"Authorization": "Bearer " + data.apiKey,
"Content-Type": "application/json",
"Prefer": "return=minimal"
},
timeout: 3000
}, JSON.stringify({
event_name: data.eventName,
order_id: data.orderId,
value: data.value,
source: data.source
}));Allow your Supabase project's host in the template permissions, and keep the key in a secure field.
Design the table
| Choice | Advice |
|---|---|
| Primary key | A unique event or order ID, so retries do not duplicate rows |
| Columns | Only what you will query. No unnecessary personal data |
| Retention | Decide how long to keep rows, and delete older ones |
| Indexes | On time and order ID |
Connected in minutes
Add your domain, install the pixel, connect your ad platforms and watch the first events land.
Security
- Never put a powerful key in the web container or the browser.
- Use row-level security so the key can only insert.
- Rotate keys if they leak.
- Treat the table as personal data if it can identify people. See GDPR and server-side tracking.
When to use something else
A realistic example
A subscription business wants a simple table of purchases and sign-ups that its team can query with SQL, without waiting for analytics exports. It creates an events table in Supabase with the order or event ID as the primary key, and adds a tag to its server container that inserts a row for each purchase and sign-up, with a source and a value but no names or e-mail addresses. Row-level security allows only inserts from the server key. Retries cannot create duplicates because of the primary key. After a month the team has a reliable table that answers questions analytics could not, and the container's cost did not change. The discipline was in the design: few columns, no personal data and a key that prevents duplicates.
Keep it healthy
Watch the table size and the cost of the project, and delete or archive old rows on a schedule. Review the row-level security policies when you add columns. If volume grows beyond what row-by-row inserts handle comfortably, move to batching or to a warehouse.
Orders from your store, back to the ad that earned them
Your store sends the order once. Open Tracked passes it on to each ad platform, cleaned and deduplicated.
Frequently asked questions
Can a server container write to Supabase?
Yes, by calling its REST API from a tag with an API key and a JSON body.
Which key should I use?
A server-only key kept in a secure field, with row-level security limiting what it can do.
How do I avoid duplicate rows?
Use a unique event or order ID as the key.
Is Supabase good for event analytics?
For small volumes yes. For large volumes use a warehouse such as BigQuery.
Do I need consent?
If the rows hold personal data or identifiers, yes where the law requires it.
Do I need spreadsheets to read my results?
No. Once tracking is live, the Open Tracked analytics shows spend, revenue, ROAS and profit, and you can ask Ari, the built-in AI assistant, questions about your own numbers in plain words. Ari's allowance depends on your analytics plan.
Is Open Tracked different from Open Track or Open Space Track?
No. Open Tracked is the official name of our server-side tracking platform, and the website is opentracked.io. Many people search for it as Open Track, OpenTrack or Open Space Track. All of them lead to the same product: server-side Google Tag Manager hosting, first-party analytics and a CRM pipeline.
Fix your tracking at the source
Open Tracked hosts your server-side Tag Manager, keeps first-party cookies alive and shows what each ad is really worth.
The Open Tracked team
We build Open Tracked: server-side tracking hosting, analytics and the tools around them, for stores that spend on ads. Questions about this guide, or an idea for the next one?
Comments
Loading comments...
Integrations · 5 min read
