Supabase pricing: Free, Pro ($25/mo), and Team ($599/mo) explained.

anon / publishable key (NEXT_PUBLIC_SUPABASE_ANON_KEY)

service_role key (SUPABASE_SERVICE_ROLE_KEY)

Magic links (passwordless email)

Send a one-time login link to an email address. Users click the link and are authenticated instantly — no password required. Configured under Authentication → Email → Enable Magic Link in the Supabase Dashboard.

const { error } = await supabase.auth.signInWithOtp({
  email: "user@example.com",
  options: {
    emailRedirectTo: "https://yourapp.com/auth/callback",
  },
});

OAuth (social login)

Supabase supports GitHub, Google, Twitter/X, LinkedIn, Discord, Spotify, and more OAuth providers out of the box. Enable in Dashboard → Authentication → Providers. Each OAuth sign-in counts as an Auth MAU.

const { error } = await supabase.auth.signInWithOAuth({
  provider: "github",
  options: {
    redirectTo: "https://yourapp.com/auth/callback",
  },
});

Server-side auth (Next.js App Router)

Use @supabase/ssr for Next.js. Create a server client via createServerClient() in route handlers and Server Components. Reads session from cookies — no client-side token passing needed.

import { createServerClient } from "@supabase/ssr";
import { cookies } from "next/headers";

const supabase = createServerClient(
  process.env.NEXT_PUBLIC_SUPABASE_URL!,
  process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
  { cookies: { getAll: () => cookieStore.getAll() } }
);
const { data: { user } } = await supabase.auth.getUser();

Row Level Security (RLS)

RLS policies run inside Postgres and restrict data access based on the authenticated user's JWT. Enable RLS on every table, then write policies like: allow users to only see their own rows.

-- Allow users to read only their own rows
CREATE POLICY "Users can view own data"
  ON profiles
  FOR SELECT
  USING (auth.uid() = user_id);

-- Allow insert for the authenticated user
CREATE POLICY "Users can insert own data"
  ON profiles
  FOR INSERT
  WITH CHECK (auth.uid() = user_id);