supabase-auth

Use when implementing authentication with Supabase Auth — email/password, OAuth, magic links, or Row Level Security integration. Also use when connecting Supabase Auth with RLS policies or debugging auth token issues.

Model	Source
sonnet	pack: auth

Full Reference

┏━ 🔧 supabase-auth ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓ ┃ Use when implementing authentication with Supa… ┃ ┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛

Supabase Auth

Supabase Auth is a JWT-based authentication system built on GoTrue. It uses PKCE flow by default via @supabase/ssr, stores sessions in cookies (SSR) or localStorage (SPA), and integrates directly with Postgres Row Level Security via auth.uid() and auth.jwt(). General Supabase setup — project creation, database, storage — is covered by the supabase skill.

Quick Reference

Item	Value
Install	npm install @supabase/supabase-js @supabase/ssr
Anon key env	NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY
Server client	createServerClient from @supabase/ssr
Browser client	createBrowserClient from @supabase/ssr
Email rate limit	2/hr built-in; configure custom SMTP for production
JWT validation	Use getUser() server-side — never getSession()
Docs	https://supabase.com/docs/guides/auth

Reference Index

I want to…	File
Set up the Supabase client in Next.js SSR, React SPA, or Node.js/Edge	reference/setup.md
Add session refresh middleware for SSR (required)	reference/middleware.md
Sign users in via email/password, OAuth, or magic links	reference/auth-methods.md
Understand getUser vs getSession, PKCE flow, and MFA	reference/session.md
Write RLS policies using auth.uid(), auth.jwt(), and profiles table	reference/rls.md
Protect routes in middleware, Server Components, or Route Handlers	reference/protecting-routes.md
Add custom JWT claims or block signups with auth hooks	reference/auth-hooks.md
Configure custom SMTP, understand rate limits and pricing	reference/email-smtp.md

Usage: Read the reference file matching your current task from the index above. Each file is self-contained with code examples and inline gotchas.