React Native with Supabase, Supabase Auth and Stripe is a mobile client on a Postgres backend where money is collected for things that happen outside the app. It works for marketplaces, bookings, delivery and business tools that charge for real-world transactions rather than for digital features unlocked inside the app itself.
Database
Supabase gives the React Native client a hosted Postgres it can query directly over HTTPS, with realtime subscriptions for screens that update while the app is open. Because a mobile build sits on devices you no longer control, every table the client touches needs row level security written as though the anon key is public, which it effectively is. Keep Stripe-derived order and payout columns in tables the client may read but only the service role can write.
Authentication
Supabase Auth ships a client that persists sessions to native storage and refreshes tokens in the background, which is the part people underestimate on mobile. Deep links carry magic link and OAuth callbacks back into the app. Because the JWT carries the user ID into row level security, the same policies protect data whether a request comes from the phone or from a server function reconciling Stripe webhooks after a payment settles.
Payments
Stripe here means charging for something outside the app: a booking, a delivery, a physical good, a service between two people. Those are exactly the transactions the app stores permit, and Stripe's React Native SDK provides native payment sheets with Apple Pay and Google Pay. Webhooks land on a Supabase edge function or your own server, which writes the resulting order row using the service role key rather than trusting the device.
Apple and Google require their own in-app purchase systems for digital content and subscriptions consumed inside the app, so a Stripe paywall for premium features is a rejection waiting to happen. Confirm your product really is a physical good or a real-world service before committing to this combination. If it is not, you need in-app purchase, and a web checkout outside the app is a narrower path than it looks.
Matched on React Native plus the parts of this stack our catalog tags. Each card shows which pieces actually line up, so you can see how much you would still wire yourself.
The rules that matter for this combination specifically, including who owns entitlement state. Adapt the commands to your repository before committing it.
# CLAUDE.md
This project is a React Native SaaS on Supabase, Supabase Auth and Stripe.
## Stack
- Framework: React Native
- Database: Supabase
- Auth: Supabase Auth
- Payments: Stripe
## Boundaries
- Never edit a migration that has already run. Write a new one.
- Never hardcode Stripe price or product identifiers in components. They belong in config.
- Never trust a client-supplied user id. Read the session from Supabase Auth on the server.
- Treat webhook handlers as idempotent. The same event will arrive twice.
## Entitlements
- Stripe is the source of truth for what a customer paid for.
- The database mirrors that state; it never decides it.
- Any check for "can this user do X" reads the mirrored entitlement, not a live API call.
## Before you say a change is done
- The app builds.
- Tests pass.
- No secret, key or webhook signing secret appears in a committed file.