Supabase makes it simple to manage your users.
When a user signs up, Supabase assigns them a unique ID. You can reference this ID anywhere in your database. For example, you might create a
profiles table referencing the user using a
Third Party Logins
We currently support the following OAuth providers:
You can enable providers by navigating to Authentication > Settings > External OAuth Providers and inputting your
Client ID and
Secret for each.
To fetch these you need to:
Secret(google, github, gitlab, bitbucket)
- Enter Authorized Redirect URI:
https://<your-project>.supabase.co/auth/v1/callbackon provider dashboard
Row Level Security
Authentication only gets you so far. When you need granular authorization rules, nothing beats PostgreSQL's Row Level Security. Supabase makes it simple to turn RLS on and off.
Policies are PostgreSQL's rule engine. They are incredibly powerful and flexible, allowing you to write complex SQL rules which fit your unique business needs.
With policies, your database becomes the rules engine. Instead of repetitively filtering your queries, like this ...
... you can simply define a rule on your database table,
auth.uid() = user_id, and your request will return the rows which pass the rule, even when you remove the filter from your middleware:
How it works
- A user signs up. Supabase creates a new user in the
- Supabase returns a new JWT, which contains the user's
- Every request to your database also sends the JWT.
- Postgres inspects the JWT to determine the user making the request.
- The user's UID can be used in Policies to restrict access to rows.
Supabase provides a special function in Postgres,
auth.uid(), which extracts the user's UID from the JWT. This is especially useful when creating Policies.
Never use a service key on the client.
Supabase provides special "Service" keys, which can be used to bypass all Row Level Security. These should never be used in the browser or exposed to customers, but they are useful for administrative tasks.
Even though Supabase provides an
auth.users table, it is helpful to also create a users table in the
public schema, which uses the same UUID Primary Key as the
For security purposes, the
auth schema is not exposed on the auto-generated API. Created a
public.users table allows you to interact via the Supabase client -
especially useful for cross-table queries.
Pro tip: if you want to add a row to your
public.users table every time a user signs up, you can use triggers. For example:
Policies are like where clauses.
Policies are easy to understand once you get the hang of them. You can just think of the as adding a
WHERE clause to every query. For example if you had a policy like this:
It would translate to this whenever a user tries to select from the todos table: