BP-07 // ZERO GOTRUE MAU OVERAGE // SUPASCALE BLUEPRINT

Self-Host GoTrue Auth: Escape $0.00325/MAU Overages — SupaScale Docker Guide

Consumer and freemium apps crossing 250K MAU incur +$487.50/mo in pure MAU metering ($0.00325 × 150K) even though open-source GoTrue uses under 300 MB of RAM.

SupaScale minimum floor: 8 GB RAM • Sweet-spot tier: 16 GB RAM (Public vendor rates retrieved 2026-11-12).

SupaScale Deterministic OOM Risk Analysis:

Although GoTrue uses minimal RAM (~110–290 MB), concurrent login storms verifying bcrypt cost=10 password hashes consume ~70 ms of CPU time per login—provision at least 4 vCPUs past 100K MAU!

SupaScale Self-Host GoTrue Auth: Escape $0.00325/MAU Overages Self-Hosted Supabase Docker Architecture Diagram — SupaScale deterministic container topology for Self-Host GoTrue Auth: Escape $0.00325/MAU Overages.

SupaScale Deterministic Memory Model Table: Self-Host GoTrue Auth: Escape $0.00325/MAU Overages

Supabase Docker Subsystem	Baseline Idle Reserve	50K MAU Projected Reserve	Memory Role
100,000 MAU GoTrue Auth Surcharge	$0.00 overage	Included in $25 Pro	Quota Ceiling
250,000 MAU Overage ($0.00325 × 150,000)	+$487.50/mo	+$210 XL = $722/mo	Self-Host Wins
500,000 MAU Overage ($0.00325 × 400,000)	+$1,300.00/mo	+$410 2XL = $1,735/mo	98% Savings
GoTrue Container Memory in SupaScale Model	92 MB	295 MB @ 500K MAU	Lean Go Binary

SupaScale Zero-Logout auth.users Migration & SMTP Configuration

# Export auth schema INCLUDING encrypted_password bcrypt hashes & refresh_tokens:
pg_dump "$SUPABASE_CLOUD_DB_URL" \
  --schema=auth \
  --no-owner --no-privileges \
  --file=auth_schema_full.sql

# Preserve your exact Cloud JWT_SECRET in self-hosted .env so existing sessions stay valid:
GOTRUE_JWT_SECRET="your-existing-supabase-cloud-jwt-secret"
GOTRUE_SMTP_HOST="smtp.yourdomain.io"
GOTRUE_RATE_LIMIT_EMAIL_SENT="3600"

Load "Self-Host GoTrue Auth: Escape $0.00325/MAU Overages" Preset in SupaScale 12-Container Workbench →

1. SupaScale MAU Curve Analysis: Public Metering Above 100,000 Monthly Users

Per published Supabase pricing (retrieved 2026-11-12), the Pro tier includes 100,000 Monthly Active Users and bills $0.00325 for each additional MAU. For high-sign-up B2C apps with low ARPU, MAU surcharges quickly exceed actual server hardware cost by 20x. Because GoTrue is MIT-licensed and stores standard bcrypt hashes inside PostgreSQL auth.users, self-hosting removes per-user auth metering.

2. Preserving Active JWT & Refresh Sessions Cleanly During a SupaScale Cutover

Copy your existing project JWT_SECRET from Supabase Cloud Settings -> API into your self-hosted .env file prior to importing pg_dump --schema=auth. Both active access JWTs and stored tokens in auth.refresh_tokens validate cleanly across DNS cutover so mobile and web users are never logged out.

3. Decoupling Transactional SMTP Reputation in SupaScale Deployments

Point GoTrue GOTRUE_SMTP_HOST at a dedicated transactional relay (SES, Postmark, Resend) or an isolated domain mailbox on ChemiCloud with SPF, DKIM, and DMARC aligned so OTP emails never share reputation with your database IP.

SupaScale Matched KVM & VDS Tiers for Self-Host GoTrue Auth: Escape $0.00325/MAU Overages

SUPASCALE PRIMARY MATCH

Hostinger KVM NVMe VPS (1-Click Docker / Coolify + Supabase) — SupaScale

From $4.99/mo (~127k)

12–24 mo KVM 2 (8GB) or KVM 4 (16GB) locks lowest rate + stacks Extra 20% partner discount.

Check Hostinger KVM VPS Specs for Self-Host GoTrue Auth: Escape $0.00325/MAU Overages on SupaScale →

SUPASCALE RUNNER-UP

UltaHost Dedicated VDS (32GB–128GB Multi-Instance Agency) — SupaScale

From $37.5/mo (~956k)

Consolidate 8–15 client Supabase Pro orgs ($200–$600/mo) onto one 32GB–64GB VDS.

Compare UltaHost Agency VDS Options for Self-Host GoTrue Auth: Escape $0.00325/MAU Overages on SupaScale →

SupaScale rate citation: Public vendor tariffs retrieved 2026-11-12; promotional and renewal prices change — verify exact checkout pricing before ordering.