Supabase Auth

Supabase Auth is an open-source Go server (it began as a fork of Netlify's GoTrue) that runs beside each project's database and stores users in the auth.users table. It supports email and password, magic links, one-time codes by email or SMS, anonymous sign-ins, OAuth providers such as Google, Apple and GitHub, SAML single sign-on, TOTP two-factor and, more recently, passkeys. Client libraries for JavaScript, Flutter, Swift, Kotlin and Python handle sign-in and token refresh.

Each sign-in returns a short-lived JWT access token and a refresh token. Because the database understands those tokens, row level security policies can call auth.uid() to limit every query to the signed-in user's rows, and a custom access token hook can add claims such as a role. Projects can also accept tokens from Clerk, Firebase Auth or Auth0 when another provider handles sign-in.

Two settings matter before launch. The built-in email sender only reaches the project team's own addresses and allows a couple of messages an hour, so production apps connect their own SMTP service such as Resend, Amazon SES or Postmark. SMS codes likewise need an account with an SMS provider such as Twilio.