Log inStart free

Auth

Users, passwords, magic links, social login, MFA, sessions, emails and server-side auth.

21 pages · start with Auth on SupaHost

  1. 01Auth on SupaHostHow Supabase Auth works on SupaHost: what each project gets, which sign-in methods are available, where the settings live in the dashboard, and what isn't configurable.
  2. 02Users and the auth schemaWhere Supabase Auth stores users on SupaHost, what auth.users and auth.identities contain, the two kinds of metadata, and how to keep a public profiles table in sync.
  3. 03Email and password sign-inSign users up and in with an email and password on SupaHost, confirm their address, set the minimum password length, and build a working password reset flow.
  4. 04Magic links and email OTPPasswordless sign-in on SupaHost with signInWithOtp: every email carries both a magic link and a one-time code, so you can use either flow, on the web or in a mobile app.
  5. 05Social login (OAuth)How OAuth sign-in works on SupaHost: the callback URL to give each provider, enabling a provider in the dashboard, signInWithOAuth on the web and on the server, scopes and provider tokens.
  6. 06Sign in with GoogleAdd Google sign-in to a SupaHost project: create an OAuth client in Google Cloud, paste the Client ID and secret into the Auth tab, and call signInWithOAuth from your app.
  7. 07Sign in with GitHubAdd GitHub sign-in to a SupaHost project: register a GitHub OAuth app with your project's callback URL, paste the Client ID and secret into the Auth tab, and call signInWithOAuth.
  8. 08Sign in with AppleAdd Sign in with Apple to a SupaHost project: create the App ID, Services ID and signing key, generate the client secret JWT, paste it into the Auth tab, and handle native iOS sign-in.
  9. 09Every OAuth provider: setup referenceSetup reference for all 19 OAuth providers on SupaHost: the provider key for signInWithOAuth, where to create the app, what to paste into the Auth tab, and the extra URL fields.
  10. 10SAML 2.0 single sign-onLet your business customers sign in through their own identity provider (Okta, Microsoft Entra ID, Google Workspace) with SAML 2.0 SSO on a SupaHost project.
  11. 11Anonymous sign-insGive visitors a real Supabase session without an account on SupaHost, tell anonymous users apart in RLS, convert them to permanent users later, and clean up the ones who never return.
  12. 12Multi-factor authentication (TOTP)Add authenticator-app MFA to a SupaHost project with the supabase.auth.mfa API: enroll a TOTP factor, challenge at sign-in, check the aal claim, and enforce MFA in RLS policies.
  13. 13Site URL and redirect URLsSet the Site URL and the Redirect URLs allow list for a SupaHost project, write safe wildcard patterns for local, preview and production apps, and handle mobile deep links.
  14. 14Server-side auth and SSRUse Supabase Auth from server-rendered apps on SupaHost with @supabase/ssr: cookie-based sessions, the PKCE flow and callback route, and when to use getClaims, getUser or getSession.
  15. 15Auth in Next.js (App Router)Complete Supabase Auth setup for a Next.js App Router app on SupaHost: browser and server clients, the proxy that refreshes sessions, a callback route, sign-in actions and protected pages.
  16. 16Sessions, JWTs and refresh tokensHow Supabase Auth sessions work on SupaHost: access token lifetime (300 to 604800 seconds), the claims inside the JWT, refresh tokens, signing out, and verifying tokens on your own server.
  17. 17Auth emails and templatesHow SupaHost sends Auth emails for your project, which of the five templates each action uses, the fields and placeholders you can edit, sending limits, and options when you need full control.
  18. 18Managing users (admin API)Create, invite, list, update, ban and delete users in a SupaHost project with the supabase.auth.admin API and the service_role key, safely from a server or an Edge Function.
  19. 19Roles, custom claims and RBACRole-based access control for a SupaHost project: a roles table with RLS helper functions, app_metadata claims set through the admin API, and why user_metadata must never decide access.
  20. 20Linking identitiesHow Supabase Auth links several sign-in methods to one user on SupaHost: automatic linking by verified email, manual linking with linkIdentity, listing and unlinking identities.
  21. 21Auth rate limits and abuse protectionThe Auth rate limits on SupaHost (a fixed email sending limit and GoTrue's defaults for the rest), the 429 errors users see, and app-side ways to stop fake sign-ups without a CAPTCHA setting.