Security & Quality

Supabase Auth

Set up Supabase Auth for email, social, and phone authentication with Row Level Security integration.

Claude Code Cursor Copilot Windsurf Gemini CLI

Overview

Supabase Auth is an open-source authentication system built on top of GoTrue, providing email/password, magic links, social OAuth, and phone/SMS authentication. It integrates deeply with Supabase's PostgreSQL database through Row Level Security (RLS) policies, enabling database-level access control tied directly to authenticated users.

The auth system supports over 20 social providers including Google, Apple, GitHub, and Azure. It provides server-side auth helpers for Next.js, SvelteKit, and Remix that handle cookie-based session management. PKCE (Proof Key for Code Exchange) flow is used by default for enhanced security in server-side rendering scenarios.

Supabase Auth includes built-in email templates, redirect URL configuration, and JWT customization. The integration with RLS means you can write PostgreSQL policies like `auth.uid() = user_id` to restrict data access at the database level, eliminating the need for authorization logic in your application code.

Who Is This For?

Add email/password and social login to a web app
Implement Row Level Security policies based on auth
Set up magic link passwordless authentication
Handle server-side auth in Next.js with Supabase SSR

Installation

Setup for Claude Code

npm install @supabase/supabase-js @supabase/ssr

Configuration

// lib/supabase/server.ts
import { createServerClient } from "@supabase/ssr"
import { cookies } from "next/headers"

export function createClient() {
  const cookieStore = cookies()
  return createServerClient(
    process.env.NEXT_PUBLIC_SUPABASE_URL!,
    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
    { cookies: { getAll: () => cookieStore.getAll() } }
  )
}