Can I use Clerk, Auth0 or Firebase Auth instead of Supabase Auth?

Not as a drop-in replacement. On SupaHost, the Data API, Storage and Realtime accept JWTs signed with your project's own secret (the anon key, the service_role key and the access tokens Supabase Auth issues). There's no setting to register Clerk, Auth0 or Firebase as a trusted token issuer, so their tokens won't be accepted for RLS. You can still use another identity provider, with your own server code in between, or move users to Supabase Auth.

Your options

Example: Clerk with an Edge Function

The function verifies the Clerk session token against Clerk's JWKS, then reads only that user's rows:

// index.ts of a function named my-invoices (Functions tab → New function)
import { createClient } from 'npm:@supabase/supabase-js@2'
import { createRemoteJWKSet, jwtVerify } from 'npm:jose@5'

const jwks = createRemoteJWKSet(new URL(Deno.env.get('CLERK_JWKS_URL')!))
const admin = createClient(Deno.env.get('SUPABASE_URL')!, Deno.env.get('SUPABASE_SERVICE_ROLE_KEY')!)

Deno.serve(async (req) => {
  const token = req.headers.get('x-clerk-token') ?? ''
  try {
    const { payload } = await jwtVerify(token, jwks)
    const { data, error } = await admin
      .from('invoices')
      .select('id, total, due_on')
      .eq('clerk_user_id', payload.sub)
    if (error) throw error
    return Response.json(data)
  } catch {
    return new Response('Unauthorized', { status: 401 })
  }
})

Add CLERK_JWKS_URL in the Functions tab's Secrets card. The function's "Require JWT" check only accepts project JWTs (such as the anon key), so either call it with the anon key in Authorization and the Clerk token in a separate header as above, or turn "Require JWT" off for this function and rely on your own check.

FAQ

Can I use the Supabase third-party auth integration on SupaHost?

No. There's no setting for it, and keys and the JWT secret can't be changed, so tokens from other issuers aren't accepted by the Data API.

Will Realtime and Storage work with my provider?

Only through your own server code using the service_role key, or with users signed in to Supabase Auth. Their policies rely on project-signed JWTs.

Is it hard to switch to Supabase Auth?

Usually not. The admin API accepts bcrypt and Firebase scrypt password hashes, so users can often keep their passwords.

Related

• Auth on SupaHost
• Authentication and JWT verification
• Every OAuth provider: setup reference
• Admin tasks on the server with the service_role key