magic links & otp

10 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

OTP send rate limits - project-wide limit

The `/auth/v1/otp` endpoint for sending One-Time-Passwords is rate limited by the sum of combined requests project-wide. The default limit is auth.rate_limits.otp.requests_per_hour OTPs per hour. This limit is customizable.

OTP and magic link rate limits - per user limit

The `/auth/v1/otp` endpoint for sending OTPs or magic links is also rate limited based on the last request of the user. The default limit is auth.rate_limits.otp.period window before a new request is allowed to the same user. This limit is customizable.

Deep linking redirects to app from magic links, password reset, OAuth

Many Auth methods involve redirects to your app: signup confirmation emails, magic link signins, and password reset emails contain links that redirect to your app. OAuth signins automatically redirect to your app. With deep linking, you can configure these redirects to open a specific page.

Astro email OTP verification with token_hash and type

In the auth callback page, extract token_hash and type query parameters. Call supabase.auth.verifyOtp() with token_hash and type (EmailOtpType) to verify the email confirmation link.

Phone signup OTP verification

If phone verification is enabled, the user receives an SMS with a 6-digit OTP that must be verified within 60 seconds. Present a form to the user to input the 6-digit OTP, then send it along with the phone number to verifyOtp with type 'sms'.

Phone signup OTP verification - Kotlin

Call verifyPhoneOtp() with type OtpType.Phone.SMS, phone, and token. Example: supabase.auth.verifyPhoneOtp(type = OtpType.Phone.SMS, phone = "+13334445555", token = "123456")

Phone signup OTP verification - Python

Call verify_otp() with phone, token (6-digit OTP), and type 'sms'. Example: supabase.auth.verify_otp({'phone': "+13334445555", 'token': "123456", 'type': "sms"})

Phone signup OTP verification - Dart

Call verifyOTP() with phone, token (6-digit OTP), and type OtpType.sms. Example: final AuthResponse res = await supabase.auth.verifyOTP(phone: '+13334445555', token: '123456', type: OtpType.sms);

Phone signup OTP verification - C#

Call VerifyOTP() with phone and token (6-digit OTP) and MobileOtpType.SMS. Example: var session = await supabase.Auth.VerifyOTP("+13334445555", "123456", MobileOtpType.SMS);

Phone signup OTP verification - HTTP

POST to /auth/v1/verify with apikey header and Content-Type: application/json. Body contains type 'sms', phone, and token. Example: curl -X POST 'https://<PROJECT_REF>.supabase.co/auth/v1/verify' -H "apikey: <SUPABASE_KEY>" -H "Content-Type: application/json" -d '{"type": "sms", "phone": "+13334445555", "token": "123456"}'

Give your agent this brain