Supabase Auth
Supabase Auth is an open-source authentication service built on PostgreSQL and PostgreSQL Row Level Security, providing email/password, OAuth, and passwordless login options. Developers use it for its tight integration with Supabase's backend, generous free tier, and ease of setup compared to rolling custom auth.
Overview
| Category | Auth |
| Ecosystem | supabase |
| Compliance | SOC2, HIPAA, GDPR |
| Self-Hostable | No |
| On-Prem | No |
| Best For | hobby, startup, growth |
| Last Verified | 2026-02-13 |
Strengths & Weaknesses
Strengths:- dx
- cost
- customization
- getSession warnings in _saveSession patterns (critical issue)
- tree-shaking failures with certain bundler configurations
- Navigator LockManager exclusive lock acquisition failures
- TypeScript type instantiation too deep with JSON schemas
- session management bugs
When to Use
Best when:- building full-stack apps with Supabase
- need OAuth/passwordless auth
- want row-level security integration
- bootstrapping side projects
- developing with modern TypeScript-first stacks
- need strictly on-premises deployment
- strict data residency requirements outside Supabase regions
- require managed passwordless auth (SMS/TOTP) without additional setup
- bundling with tools that don't support proper tree-shaking
Known Issues (10)
- [critical] Still having getSession warning whenever _saveSession is called
- [critical] Acquiring an exclusive Navigator LockManager failed
- [critical] Tree shaking
- [high] Proposal: throwOnError should be default behavior
- [high] Json type: Type instantiation is excessively deep and possibly infinite.
- [high] user object warning logged, even when not touching `session.user`
- [high] Full Name not stored in Database when Using Apple Sign-In in React Native
- [high] Supabase operations in onAuthStateChange will cause the next call to supabase anywhere else in the code to not return.
- [medium] WebSocket connection failed on subscribing to realtime channel
- [medium] Enabling Post-Signup Email Verification without Blocking User Sign-In on Supabase (Resend)