Create a project
- Sign up at supabase.com
- Click New Project and choose a name (e.g.
vantage-wealth) - Pick a strong database password and save it — you’ll need it for migrations
- Choose a region close to you
- Project URL — goes into
SUPABASE_URL - anon public key — goes into
SUPABASE_ANON_KEY(Flutter app) - service_role key — goes into
SUPABASE_SERVICE_KEY(backend only, never expose publicly)
Run migrations
Install the Supabase CLI:| Migration | What it creates |
|---|---|
001_initial_schema | Core tables: users, accounts, transactions, holdings, budgets, debts, groups, bill_splits, user_insights, ai_conversations |
002_seed_data | Default spend categories and sample merchant mappings |
003_accounts_advanced_features | Statement day, payment day, credit limit fields |
004_add_transfer_id | Transfer linking for double-entry transactions |
005_rag_embeddings | pgvector extension, user_embeddings table, HNSW index, hybrid_search() RPC |
006+ | Loan fields, APR, default account flag, insights constraints, newsletter, pgcron |
Row Level Security
All tables have RLS enabled. Every row is scoped to the authenticated user viaauth.uid(). The backend uses the service role key (which bypasses RLS) only for admin operations like RAG ingestion.
Enable Google OAuth (optional)
- Go to Authentication → Providers → Google
- Enable Google provider
- Add your Google OAuth client ID and secret (from console.cloud.google.com)
- Add redirect URL:
com.vantagewealth.app://callback
pgvector (for AI memory)
The RAG pipeline requires thepgvector extension. It’s enabled automatically by migration 005. Verify it’s active: