sign-up & sign-in methods

33 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Signup confirmation rate limits

The `/auth/v1/signup` endpoint for signup confirmation requests is rate limited based on the last request of the user. The default limit is auth.rate_limits.signup_confirmation.period window before a new request is allowed to the same user. This limit is customizable.

Anonymous sign-in rate limits

The `/auth/v1/signup` endpoint for anonymous sign-ins is rate limited by IP Address. The limit is auth.rate_limits.anonymous_signin.requests_per_hour requests per hour with bursts up to auth.rate_limits.anonymous_signin.requests_burst requests. This limit is not customizable. The rate limit only applies if this endpoint is called without passing in an email or phone number in the request body.

Astro signUp action with email confirmation

Define server-side auth actions using defineAction from astro:actions. The signUp action accepts email and password (min 6 chars), calls supabase.auth.signUp() with an emailRedirectTo callback URL, and returns success/error messages. Email redirect can be configured to http://localhost:4321/auth/callback.

Astro signIn action with password

The signIn action accepts email and password, calls supabase.auth.signInWithPassword() with those credentials, and returns success/error messages.

Astro signOut action

The signOut action calls supabase.auth.signOut() on the server and returns a success boolean.

Astro email confirmation template configuration

To enable email confirmation in Supabase Astro apps, update the email template in Auth > Email Templates. Replace {{ .ConfirmationURL }} with {{ .SiteURL }}/auth/callback?token_hash={{ .TokenHash }}&type=email. Also set the Site URL to http://localhost:4321 (or your production URL).

Email signup with implicit flow - C#

Call SignUp() with email address and password. You can optionally specify RedirectTo to redirect after the user confirms their email. Example: var options = new SignUpOptions { RedirectTo = "https://example.com/welcome" }; var session = await supabase.Auth.SignUp("valid.email@supabase.io", "example-password", options);

Email signup confirmation email template for PKCE flow

The signup email template should contain HTML with a confirmation link using the token hash. The template must include the URL pattern: {{ .SiteURL }}/auth/confirm?token_hash={{ .TokenHash }}&type=email&next={{ .RedirectTo }}. This requires the email template to be configured to send the token hash variable.

Token exchange endpoint for PKCE email signup

Create an API endpoint at <YOUR_SITE_URL>/auth/confirm to handle the token exchange for PKCE flow email signup. The endpoint receives token_hash (string), type (EmailOtpType, required), and next (string, optional, defaults to '/') as query parameters. Call supabase.auth.verifyOtp({type, token_hash}) to exchange the token. If successful, redirect to the next URL.

Email signup PKCE flow - SvelteKit token exchange

Create file at src/routes/auth/confirm/+server.ts. Extract token_hash, type (EmailOtpType), and next from URL search params. Call supabase.auth.verifyOtp({token_hash, type}). If no error, redirect with 303 status to the next URL. If error, redirect to /auth/error. Clean up redirect URL by deleting auth flow parameters.

Email signup PKCE flow - Remix token exchange

Create file at app/routes/auth.confirm.tsx. Extract token_hash, type (EmailOtpType), and next from request URL search params. Create server client with cookie handling. Call supabase.auth.verifyOtp({type, token_hash}). If no error, return redirect(next, {headers}). If error or missing parameters, return redirect('/auth/auth-code-error', {headers}).

Email signin with password - JavaScript

Call signInWithPassword() with email address and password. Example: supabase.auth.signInWithPassword({email: 'valid.email@supabase.io', password: 'exa••••••rd'})

Email signin with password - Dart

Call signInWithPassword() with email address and password. Example: supabase.auth.signInWithPassword(email: 'valid.email@supabase.io', password: 'exa••••••rd')

Email signin with password - Swift

Call signIn(email:password:) with email address and password. Example: supabase.auth.signIn(email: "valid.email@supabase.io", password: "exa••••••rd")

Email signin with password - Kotlin

Call signInWith(Email) with email address and password. Example: supabase.auth.signInWith(Email) { email = "valid.email@supabase.io"; password = "exa••••••rd" }

Email signin with password - Python

Call sign_in_with_password() with email address and password. Example: client.auth.sign_in_with_password({'email': 'valid.email@supabase.io', 'password': 'exa••••••rd'})

Email signin with password - C#

Call SignIn() with email address and password. Example: var session = await supabase.Auth.SignIn("valid.email@supabase.io", "example-password");

Phone password auth signup

Users can sign up with a phone number instead of an email as an identifier. This practice is usually discouraged because phone networks recycle mobile phone numbers, giving access to the original user's account to anyone receiving a recycled number. To mitigate this risk, implement MFA. Enable phone authentication on the Auth Providers page for hosted Supabase projects, or in the configuration file for self-hosted projects.

Phone number confirmation with SMS provider

If you want users to confirm their phone number on signup, you need to set up an SMS provider. Supported providers include MessageBird, Twilio, Vonage, and TextLocal (community-supported). Each provider has its own configuration.

Phone signin with password - JavaScript

Call signInWithPassword() with phone number and password. Example: const {data, error} = await supabase.auth.signInWithPassword({phone: '+13334445555', password: 'some-password'})

Phone signin with password - Swift

Call signIn() with phone number and password. Example: supabase.auth.signIn(phone: "+13334445555", password: "some-password")

Phone signin with password - Kotlin

Call signInWith(Phone) with phone number and password. Example: supabase.auth.signInWith(Phone) { phone = "+13334445555"; password = "some-password" }

Phone signin with password - Python

Call sign_in_with_password() with phone number and password. Example: supabase.auth.sign_in_with_password({'phone': "+13334445555", 'password': "some-password"})

Phone signin with password - C#

Call SignIn() with SignInType.Phone, phone number, and password. Example: var session = await supabase.Auth.SignIn(SignInType.Phone, "+13334445555", "some-password");

Phone signin with password - HTTP

POST to /auth/v1/token?grant_type=password with apikey header and Content-Type: application/json. Body contains phone and password. Example: curl -X POST 'https://cvwawazfelidkloqmbma.supabase.co/auth/v1/token?grant_type=password' -H "apikey: SUPABASE_KEY" -H "Content-Type: application/json" -d '{"phone": "+13334445555", "password": "some-password"}'

Email signup PKCE flow - Express token exchange

Create route at /auth/confirm. Extract token_hash, type, and next from query parameters. Create server client. Call supabase.auth.verifyOtp({type, token_hash}). If no error, res.redirect(303, '/{next.slice(1)}'). If error, res.redirect(303, '/auth/auth-code-error').

Phone signin with password - Dart

Call signInWithPassword() with phone number and password. Example: final AuthResponse res = await supabase.auth.signInWithPassword(phone: '+13334445555', password: 'some-password');

Two signup flows for email password auth

Email password signup supports two flows: implicit flow and PKCE flow. The implicit flow only works for client-only apps and directly provides the access token after the user confirms their email. The PKCE flow allows for server-side authentication and requires an intermediate token exchange step before getting the access token. If using SSR, the PKCE flow is used. For client-only code, the default flow depends on the client library: implicit flow is default in JavaScript and Dart, while PKCE flow is default in Swift.

Email signup with implicit flow - Dart

Call signUp() with email address and password. Example: supabase.auth.signUp(email: 'valid.email@supabase.io', password: 'exa••••••rd')

Email signup with implicit flow - Kotlin

Call signUpWith(Email) with email address and password. Example: supabase.auth.signUpWith(Email) { email = "valid.email@supabase.io"; password = "exa••••••rd" }

Email signup with implicit flow - Python

Call signUp() with email address and password. You can optionally specify email_redirect_to to redirect after the user confirms their email. This URL must be configured as a Redirect URL. If not specified, users are automatically redirected to your site URL, which defaults to localhost:3000. Example: supabase.auth.sign_up({'email': 'valid.email@supabase.io', 'password': 'exa••••••rd', 'options': {'email_redirect_to': 'https://example.com/welcome'}})

Next.js sign-up route default location

The default sign-up route is at /auth/sign-up in the Next.js app when using the with-supabase template.

Auth component manages logins and sign ups in React Native

Create a React Native component (Auth.tsx) to manage logins and sign ups. This component handles the authentication UI and logic.

Give your agent this brain