Skip to content
WebAuditOS
Start free audit

Test your website now

Free, no card. We read only public pages.

Run free audit →

Security

How does Supabase Auth work, and how do you secure it?

How Supabase Auth signs users in with email, magic links, OAuth and phone, issues JWTs and connects to row level security, plus the settings to check at launch.

Supabase Auth manages users for your app: sign-up and login with email and password, magic links, one-time codes, phone and OAuth providers such as Google and GitHub. After login it issues a JWT that the Supabase client sends with each request, and your row level security policies use auth.uid() to decide what that user can access.

Published · Last updated

By Michal Měřínský. Audit methodology.

How it works

  • A user signs up or logs in through the supabase-js client or your server.
  • Supabase Auth issues a short-lived access token, a JWT, and a refresh token.
  • The client sends the access token with every database, storage and function request.
  • PostgreSQL reads the user's ID from the token through auth.uid(), and row level security policies use it. Users live in the auth.users table, managed by Supabase. Store your own profile data in a separate table linked by user ID.

Sign-in methods

  • Email and password, with email confirmation.
  • Magic links and one-time codes by email.
  • Phone with SMS codes, through a provider such as Twilio.
  • OAuth: Google, GitHub, Apple, Microsoft and others.
  • Multi-factor authentication with authenticator apps.
  • SSO with SAML on higher plans.

Settings to check before launch

  • Site URL and redirect URLs: set them to your production domain. Leftover localhost entries break emails, and overly broad wildcards allow redirects to places you did not intend.
  • Email confirmation: on, unless you have a reason to disable it.
  • Custom SMTP: the built-in email service has low limits and is meant for testing. Connect your own provider for production.
  • Rate limits and CAPTCHA protection on sign-up and sign-in, to stop abuse.
  • Password requirements and leaked password protection, where available on your plan.
  • MFA for any admin users.

Server-side rendering

In frameworks such as Next.js, use Supabase's server-side helpers so the session is stored in cookies and available on the server. Check that auth cookies are set with Secure and a SameSite value, and verify the user on the server for every protected action rather than trusting what the client says.

Getting the session on the server is not the same as checking it. Validate the user before any write, every time.

RLS is where auth becomes security

Login proves who someone is. Row level security decides what they can do. A logged-in user on a table without RLS can read everyone's rows. Write policies for select, insert, update and delete separately.

What a scan can and cannot tell you

WebAuditOS checks your login surface from outside: Secure and SameSite on cookies, password fields only on HTTPS pages, and a discoverable change-password URL.

It cannot log in, read your Supabase Auth settings or test your RLS policies.

Test with two accounts: log in as one and try to read the other's data. That one test catches most real Supabase security bugs.

Short answers

Is Supabase Auth free? It is included in all plans, with 50,000 monthly active users on the free plan.

Does Supabase Auth support Google login? Yes, along with many other OAuth providers.

Where are users stored? In the auth.users table, managed by Supabase.

Do I still need RLS with Supabase Auth? Yes. Auth identifies users. RLS controls their access.

In the product

The checks this maps to

Every check named here runs on every scan, on every plan - what a plan changes is how many pages are crawled, how long the history is kept and what you can do with the result. These are the ids the findings carry, so you can match a line in a report to the explanation above.

Hosting and deploy

What is Supabase?

Supabase is an open-source backend on PostgreSQL with auth, storage, realtime and functions. How it works, why vibe coders use it, and what to secure first.

Security

What is a JWT, and how does JWT authentication work?

A JWT is a signed token carrying claims about a user. How it works, how to verify one, where to store it, and common mistakes.