Auth

Supabase Auth makes it easy to implement authentication and authorization in your app. We provide client SDKs and API endpoints to help you create and manage users.

Your users can use many popular Auth methods, including password, magic link, one-time password (OTP), social sign-in, and single sign-on (SSO).

About authentication and authorization

Authentication and authorization are the core responsibilities of any Auth system.

• Authentication means checking that a user is who they say they are.
• Authorization means checking what resources a user is allowed to access.

Supabase Auth uses JSON Web Tokens (JWTs) for authentication. For a complete reference of all JWT fields, see the JWT Fields Reference. Auth integrates with Supabase's database features, making it easy to use Row Level Security (RLS) for authorization.

The Supabase ecosystem

You can use Supabase Auth as a standalone product, but it's also built to integrate with the Supabase ecosystem.

Auth uses your project's Postgres database under the hood, storing user data and other Auth information in a special schema. You can connect this data to your own tables using triggers and foreign key references.

Auth also enables access control to your database's automatically generated REST API. When using Supabase SDKs, your data requests are automatically sent with the user's Auth Token. The Auth Token scopes database access on a row-by-row level when used along with RLS policies.

Get started

Start here if you're new to Supabase Auth:

• Auth with email and password: Sign up and sign in users with email and password.
• Server-side rendering: Create a Supabase client for SSR frameworks like Next.js and SvelteKit.
• Which package to use: supabase-js vs @supabase/ssr vs @supabase/server — which to use on the server.
• Row Level Security: Use RLS policies to authorize data access from the client.

Providers

Supabase Auth works with many popular Auth methods, including social sign-in and phone sign-in with third-party providers. See the following sections for a list of supported third-party providers.

Social sign-in

Phone sign-in

Pricing

Charges apply to Monthly Active Users (MAU), Monthly Active Third-Party Users (Third-Party MAU), and Monthly Active SSO Users (SSO MAU) and Advanced MFA Add-ons. For a detailed breakdown of how these charges are calculated, refer to the following pages.

• Pricing MAU: How MAU usage is measured and billed.
• Pricing Third-Party MAU: How third-party auth MAU is measured and billed.
• Pricing SSO MAU: How SSO MAU usage is measured and billed.
• Advanced MFA - Phone: How Advanced MFA Phone add-on usage is measured and billed.

Next steps

Once you've covered the basics, these guides help with other use cases and features:

• Email (Magic link or OTP): Sign up and sign in users with a Magic Link or email OTP instead of a password.
• Enterprise SSO: Add Single Sign-On for enterprise applications with SAML 2.0.
• User sessions: Control session lifetime, refresh tokens, and multi-device sign-in behavior.
• Third-party auth: Use Clerk, Auth0, Firebase Auth, Cognito, or WorkOS JWTs with Supabase APIs.
• Multi-factor authentication: Add a second factor to user sign-in with TOTP or phone.
• JWTs: Understand how Supabase Auth issues and validates JWTs.
• Auth Hooks: Customize Auth behavior with Postgres functions at key lifecycle points.