Documentation
Auth
Sign users in with email and password, magic links, email codes or as anonymous visitors. Users and sessions live in the auth schema of your project's database.
Sign-in methods
| Method | supabase-js call |
|---|---|
| Email and password | auth.signUp, auth.signInWithPassword |
| Magic link | auth.signInWithOtp({ email }) |
| Email code (one-time code) | auth.signInWithOtp, then auth.verifyOtp |
| Anonymous | auth.signInAnonymously() |
| Password reset | auth.resetPasswordForEmail, auth.updateUser |
Email and password
const { data, error } = await vulcbase.auth.signUp({ email: "ana@example.com", password: "a-long-password", options: { data: { name: "Ana" } }, // saved as user metadata}); await vulcbase.auth.signInWithPassword({ email: "ana@example.com", password: "a-long-password" });await vulcbase.auth.signOut();Magic links and email codes
The same call sends either a link or a code, depending on the email template. Edit the templates in the auth settings: put {{ .ConfirmationURL }} in for a link or the token for a code.
// sendawait vulcbase.auth.signInWithOtp({ email: "ana@example.com" }); // verify a code typed by the userconst { data } = await vulcbase.auth.verifyOtp({ email: "ana@example.com", token: "123456", type: "email" });Anonymous sign-ins
Enable anonymous sign-ins in the auth settings. Anonymous users get a real user id and the authenticated role, so policies work as usual. Turn them into permanent users by adding an email and password.
await vulcbase.auth.signInAnonymously(); // laterawait vulcbase.auth.updateUser({ email: "ana@example.com", password: "a-long-password" });PKCE
Server-side and mobile apps can use the PKCE flow: the client sends a code challenge, and the link in the email returns a code that you exchange for a session.
const vulcbase = createClient(url, key, { auth: { flowType: "pkce" } }); // on your callback routeawait vulcbase.auth.exchangeCodeForSession(code);Settings and email
In the project's Authentication section you can set:
- Site URL and redirect URLs that links in emails may point to.
- SMTP host, port, user, password and sender address. Without SMTP configured, emails are not delivered to real inboxes.
- Email templates for confirmation, magic link, recovery, invite and email change.
- Sign-ups on or off, automatic confirmation, anonymous sign-ins, token lifetime, minimum password length, code lifetime and a per-hour email rate limit.
The Users page lists users, lets you create, invite, ban or delete them, and generate a magic or recovery link by hand.
Using the user in policies
-- the signed-in user's idauth.uid() -- claims from the JWTauth.jwt() ->> 'email'auth.role() -- 'anon' | 'authenticated' | 'service_role'