Authentication

​

What is Auth

• Account creation - Users can sign up with email, phone, or Google
• Secure login - Password hashing, session management, all handled for you
• Password reset - Automatic “forgot password” emails
• User management - See all your users and their account details

​

Adding Login with OptiDev Agent

​

Example: Basic Email Login

“Add user login to my app with email and password”

1. Enable email authentication
2. Create sign-up and login forms
3. Add logout functionality
4. Show different content for logged-in vs logged-out users

​

Example: Google Sign-In

“Let users sign in with their Google account”

​

Example: Phone Login

“Add phone number login with SMS verification codes”

​

Sign-In Methods

​

Email Settings

• Enable email sign-in — Master toggle for this method.
• Confirm email — When on, users must click a link in their email before they can use your app. Recommended.
• Secure email change — Requires re-authentication before a user can change their email.
• Secure password change — Requires re-authentication before a user can change their password.
• Prevent leaked passwords — Checks passwords against the HaveIBeenPwned database and blocks ones that have appeared in known breaches.
• Minimum password length — Between 6 and 72 characters (default 6).
• Password requirements — None, letters + digits, mixed case + digits, or mixed case + digits + symbols.
• OTP expiration and OTP length — Controls one-time codes used for magic links and password resets.

​

Phone Settings

​

SMS Provider

• Twilio — needs Account SID, Auth Token, Message Service SID
• Twilio Verify — needs Account SID, Auth Token, Verify Service SID (optional Content SID for WhatsApp)
• MessageBird — needs Access Key and Originator
• Textlocal — needs API Key and Sender
• Vonage — needs API Key, API Secret, and From number

“Set up phone authentication using Twilio”

​

Other phone controls

• Phone confirmations — Require users to verify their phone before signing in.
• SMS OTP expiry and OTP length — Tune how long codes are valid and how many digits they have.
• SMS template — Customize the message body; use {{ .Code }} as the placeholder for the verification code.
• Test phone numbers — Pre-set phone=otp pairs for testing without sending real SMS.

​

Google Settings

• Client ID(s) — Comma-separated. You can list multiple IDs here for Web OAuth, Android, One Tap, and Chrome extensions all at once.
• Client Secret — From your Google Cloud OAuth client.
• Skip nonce checks — Leave off unless you have a specific reason; nonce checks protect against replay attacks.
• Callback URL — Read-only field shown in the panel. Copy this and paste it into your Google OAuth client’s “Authorized redirect URIs” list.

​

General Settings

• Allow new signups — When off, only existing users can log in. Good for invite-only apps.
• Anonymous sign-in — Lets people use your app without creating an account. They can convert to a full account later by adding an email or phone.
• Require email confirmation — A general version of the per-provider email confirmation toggle above.

​

Advanced Settings

​

Site URL

​

Redirect URLs

​

Custom SMTP

​

Setting it up (example: Resend)

1. Verify your domain with your email provider. In Resend, add your domain — it will show you a few DNS records to copy into your domain’s DNS settings (wherever your domain is registered). Once added, Resend marks the domain Verified, usually within a few minutes.
2. Create an API key in the provider.
3. In the Authentication tab, scroll to Custom SMTP, turn on Enable custom SMTP, and fill in:

4. Click Save changes, then send a test invite. Emails now come from your domain.

​

Managing Users

• Create a user manually (email + password, optional phone).
• Invite a user by email so they pick their own password.
• Click the … menu on any user row to send them a Magic link (passwordless sign-in email) or Delete their account.
• Click a row to see full details (UUID, last sign-in, verification timestamps, enabled login methods).
• Search by email, phone, or user ID. List shows 10 per page.

​

Security Best Practices

• Require email confirmation to verify real addresses and reduce fake accounts.
• Keep sign-in options simple. Pick one or two methods that fit your audience instead of enabling everything.
• Use Row Level Security to make sure users can only access their own data:

“Make sure users can only see their own orders”

​

For Developers

// Check who's logged in
const { data: { user } } = await supabase.auth.getUser()

// Sign up
await supabase.auth.signUp({ email, password })

// Sign in
await supabase.auth.signInWithPassword({ email, password })

// Sign in with Google
await supabase.auth.signInWithOAuth({ provider: 'google' })

// Sign out
await supabase.auth.signOut()

// React to auth changes
supabase.auth.onAuthStateChange((event, session) => {
  // event: 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED' | ...
})

-- Users can only see their own orders
CREATE POLICY "Users see own orders" ON orders
  FOR SELECT USING (auth.uid() = user_id);

GET    /api/supabase/projects/:projectId/auth/users?page=1&perPage=10
POST   /api/supabase/projects/:projectId/auth/users
POST   /api/supabase/projects/:projectId/auth/users/invite
DELETE /api/supabase/projects/:projectId/auth/users/:userId

interface User {
  id: string;                    // UUID
  email?: string;
  phone?: string;
  created_at: string;            // ISO 8601
  updated_at: string;
  last_sign_in_at?: string;
  email_confirmed_at?: string;
  phone_confirmed_at?: string;
  invited_at?: string;
  app_metadata: { provider: string };  // 'email' | 'phone' | 'google'
  user_metadata: Record<string, any>;  // Custom fields
}

await supabase.auth.admin.listUsers({ page: 1, perPage: 10 })
await supabase.auth.admin.createUser({ email, password, email_confirm: true })
await supabase.auth.admin.deleteUser(userId)
await supabase.auth.admin.inviteUserByEmail(email, { redirectTo })