Authorization is a pain in the ass, you have to fully buy into Postgres RLS system. On the authentication side, it helps to be familiar with OAuth and JWTs. Old

Authorization is a pain in the ass, you have to fully buy into Postgres RLS system. On the authentication side, it helps to be familiar with OAuth and JWTs. Old school cookie based solutions (or any unorthodox 3rd party delegate auth schemes like those used in enterprise spaces) will require custom code to integrate (or to call an external authentication function). If you are comfortable with JWTs and SPA ("jamstack") authentication then it is a breeze. I have had good experience with Supabase (PostgREST) using Prisma to manage the migrations. Hasura's out-of-the-box migration support is weaker, so you need to pay attention to make sure production and development don't drift apart.