Nacho
Supabase Auth IAM Provider
Open-source Postgres-native authentication backed by GoTrue. 50K MAU free tier, self-hostable on any infrastructure, and tightly integrated with the Supabase platform (database, storage, edge functions). Row Level Security is the authorization primitive.
Features
- 🇺🇸US🇪🇺EU🇦🇵AP🇨🇦CA🇸🇦SA
- AWSAzureGCPSelf-hosted
- JavaScriptTypeScriptReactNext.jsSvelteKitFlutterSwiftKotlinPython.NETGo
If you want to compare IAM features of different providers, please check out the (C)IAM Identity Providers benchmark.
Looking for OpenID Connect protocol-level compatibility across providers? Check out the OpenID Connect Providers benchmark.
Frequently Asked Questions
Does Supabase Auth support Username and Password authentication method?
Supabase Auth supports Username and Password authentication method. Email and password authentication available on all plans. Supports sign-up, sign-in, password reset via email, and email confirmation flows. Passwords stored as bcrypt hashes. Email enumeration protection is configurable. Read more
Does Supabase Auth support Social Sign-in authentication method?
Supabase Auth supports Social Sign-in authentication method. 20 built-in OAuth providers: Google, Facebook, Apple, Azure/Microsoft, Twitter/X, GitHub, GitLab, Bitbucket, Discord, Figma, Kakao, Keycloak, LinkedIn, Notion, Slack, Spotify, Twitch, WorkOS, Zoom, and Fly.io. Additional custom OAuth2/OIDC providers configurable via the dashboard. Read more
Does Supabase Auth support Passkey authentication method?
Supabase Auth partially supports Passkey authentication method. Passkeys (WebAuthn) are supported as an MFA factor for existing authenticated users, not as a standalone primary sign-in method. Users must first register with another method (email/password, magic link, etc.) before enrolling a passkey as a second factor. Read more
Does Supabase Auth support Email Passwordless authentication method?
Supabase Auth supports Email Passwordless authentication method. Email OTP (6-digit one-time code) for passwordless sign-in. Rate limited to 30 OTPs per hour project-wide and 60-second window per user before a new OTP can be requested. Requires custom SMTP for production (built-in SMTP limited to 2 emails/hour). Read more
Does Supabase Auth support Phone Passwordless authentication method?
Supabase Auth supports Phone Passwordless authentication method. Phone OTP via SMS for passwordless sign-in. Supports Twilio, Messagebird, Vonage, and custom SMS hooks. SMS costs are separate from Supabase billing. Requires a configured SMS provider. Read more
Does Supabase Auth support Magic Link authentication method?
Supabase Auth supports Magic Link authentication method. Email magic link (one-time URL) for passwordless sign-in. Same rate limits as email OTP: 30 per hour project-wide, 60-second per-user cooldown. Requires custom SMTP for production use. Read more
Does Supabase Auth support Anonymous / Guest authentication method?
Supabase Auth supports Anonymous / Guest authentication method. Anonymous sign-ins create a real user record in auth.users without credentials. Anonymous users can be converted to permanent accounts by linking an email, phone, or OAuth identity. Rate limited to 30 anonymous sign-ins per hour per IP address. Available on all plans. Read more
Does Supabase Auth support Time-based One-Time Password (TOTP) MFA?
Supabase Auth supports Time-based One-Time Password (TOTP) MFA. TOTP (Time-based One-Time Password) MFA via authenticator apps (Google Authenticator, Authy, etc.). Free on all plans, enabled by default on every Supabase project. 30-second code validity with one-interval clock skew tolerance. Developers are responsible for building the enrollment and challenge UI. Read more
Does Supabase Auth support HMAC-based One-Time Password (HOTP) MFA?
Supabase Auth does not support HMAC-based One-Time Password (HOTP) MFA. Counter-based HOTP is not supported. Supabase MFA supports TOTP (time-based) and phone/passkey factors only. Read more
Does Supabase Auth support Universal 2nd Factor (U2F) MFA?
Supabase Auth supports Universal 2nd Factor (U2F) MFA. Hardware security keys (YubiKey, etc.) supported as a WebAuthn MFA factor. Implemented via the same WebAuthn/passkey MFA API. Available on all plans. Read more
Does Supabase Auth support WebAuthn MFA?
Supabase Auth supports WebAuthn MFA. WebAuthn/passkey MFA factor (Touch ID, Face ID, Windows Hello, hardware keys). Supported as an additional factor alongside TOTP. Users enroll via the Factor API. Available on all plans. Read more
Does Supabase Auth support Email Code MFA?
Supabase Auth does not support Email Code MFA. Email OTP is available as a primary authentication method but not as a dedicated MFA second factor. Supported MFA factors are TOTP, phone (SMS), and WebAuthn/passkeys. Read more
Does Supabase Auth support Phone Code MFA?
Supabase Auth partially supports Phone Code MFA. Phone/SMS MFA available as a paid add-on: $75/month for the first project, $10/month per additional project. Not included in the base Pro or Team plan subscription. Requires a configured SMS provider (Twilio, etc.). Read more
Does Supabase Auth support Recovery Code MFA?
Supabase Auth does not support Recovery Code MFA. Recovery/backup codes are not supported. Supabase recommends enrolling multiple MFA factors (e.g., both TOTP and passkey) to prevent account lockout. Read more
Does Supabase Auth support Push Notification MFA?
Supabase Auth does not support Push Notification MFA. Push notification MFA is not supported natively. Can be approximated by integrating an external IdP (e.g., Okta, Duo) via SAML SSO. Read more
Does Supabase Auth support Adaptive / Risk-Based MFA MFA?
Supabase Auth does not support Adaptive / Risk-Based MFA MFA. Risk-based or adaptive MFA is not supported. MFA policy is all-or-nothing (require MFA for all users or none). Can be partially implemented via the MFA Verification Attempt hook. Read more
Does Supabase Auth support Cisco Duo MFA?
Supabase Auth does not support Cisco Duo MFA. No native Cisco Duo integration. Duo can be reached indirectly by configuring Duo as a SAML IdP via Enterprise SSO (Pro+ plan). Read more
Does Supabase Auth support Step-Up Authentication MFA?
Supabase Auth supports Step-Up Authentication MFA. Step-up authentication via Authenticator Assurance Level (AAL) checks. Routes users through MFA verification when accessing sensitive resources by inspecting the `aal` claim in the session JWT. Available on all plans. Read more
Does Supabase Auth support OpenID Connect (OIDC) integration protocol?
Supabase Auth supports OpenID Connect (OIDC) integration protocol. Supabase Auth issues JWTs compliant with OpenID Connect. The auth server exposes JWKS endpoints for token verification. Acts as an OIDC provider for downstream services and supports OIDC-based social login. Read more
Does Supabase Auth support SAML 2.0 integration protocol?
Supabase Auth supports SAML 2.0 integration protocol. SAML 2.0 Single Sign-On available on Pro plan and above. Priced at $0.015 per SSO MAU with 50 SSO MAU included per project. Works with any SAML 2.0-compatible IdP (Google Workspace, Okta, Auth0, Microsoft Entra ID, PingIdentity, OneLogin, etc.). Read more
Does Supabase Auth support WS-Federation integration protocol?
Supabase Auth does not support WS-Federation integration protocol. WS-Federation is not supported. Supabase Auth supports OIDC and SAML 2.0 as federation protocols. Read more
Does Supabase Auth support Machine-to-Machine (M2M) Authentication integration protocol?
Supabase Auth supports Machine-to-Machine (M2M) Authentication integration protocol. OAuth 2.1 authorization server available for M2M and MCP (Model Context Protocol) auth flows. Service role keys provide admin-level API access for backend services. Anonymous tokens can also serve lightweight M2M patterns. Read more
Does Supabase Auth support OpenID Connect (OIDC) Federation identity federation?
Supabase Auth does not support OpenID Connect (OIDC) Federation identity federation. Supabase Auth does not support configuring external OIDC providers as enterprise IdP connections for SSO federation. Only SAML 2.0 is supported for enterprise SSO. Custom OAuth2/OIDC providers can be added for social login but not for federated enterprise identity. Read more
Does Supabase Auth support SAML 2.0 Federation identity federation?
Supabase Auth supports SAML 2.0 Federation identity federation. SAML 2.0 enterprise identity federation. Supabase acts as the Service Provider (SP). Any SAML 2.0-compatible IdP is supported. Attribute mapping for user metadata configurable. Priced at $0.015/SSO MAU (50 included). Read more
Does Supabase Auth support Active Directory / LDAP identity federation?
Supabase Auth does not support Active Directory / LDAP identity federation. No native LDAP/Active Directory connector. AD users can federate via SAML 2.0 (e.g., Microsoft Entra ID, ADFS as SAML IdP) on Pro+ plans. Read more
Does Supabase Auth support Azure Active Directory (Entra ID) identity federation?
Supabase Auth supports Azure Active Directory (Entra ID) identity federation. Microsoft Entra ID (Azure AD) supported both as a social OAuth provider (Microsoft app) and as an enterprise SAML 2.0 IdP (Pro+ plans). Full attribute mapping available via the SAML SSO configuration. Read more
Does Supabase Auth support Bulk User Import user management?
Supabase Auth supports Bulk User Import user management. Bulk user import via the Admin API (createUser per user) or directly via SQL INSERT into auth.users. No native bulk import endpoint — large migrations require scripted API calls or direct database operations. Available on all plans. Read more
Does Supabase Auth support Password Hash Import (Multiple Formats) user management?
Supabase Auth partially supports Password Hash Import (Multiple Formats) user management. Password hash import supported for bcrypt and scrypt formats via direct database operations. Limited documentation on supported hash algorithms. Firebase scrypt is specifically documented as importable. MD5, SHA, Argon2 not natively supported without custom migration scripts. Read more
Does Supabase Auth support Bulk User Export user management?
Supabase Auth supports Bulk User Export user management. Users can be exported by querying the auth.users and auth.identities tables via the SQL Editor (CSV export available). No dedicated REST endpoint for bulk export — requires direct database access. Read more
Does Supabase Auth support Bulk User Update / Delete user management?
Supabase Auth partially supports Bulk User Update / Delete user management. Individual update and delete available via Admin API (updateUserById, deleteUser). No bulk update/delete endpoint — operations must be scripted. Direct SQL DELETE on auth.users also works for mass deletions. Read more
Does Supabase Auth support Upsert on Import user management?
Supabase Auth does not support Upsert on Import user management. No native upsert-on-import functionality. Importing a user whose email already exists will fail. Handle deduplication before importing or use direct SQL with ON CONFLICT clauses. Read more
Does Supabase Auth support Legacy Username Import (Non-Allowed Characters) user management?
Supabase Auth partially supports Legacy Username Import (Non-Allowed Characters) user management. Supabase Auth uses email (not username) as the primary identifier. A username field can be stored in a custom public.profiles table or in raw_user_meta_data but requires application-level uniqueness enforcement. No built-in username authentication. Read more
Does Supabase Auth support MFA Enrollment Import user management?
Supabase Auth does not support MFA Enrollment Import user management. Importing pre-existing MFA enrollments (TOTP secrets, phone numbers for MFA) is not supported. Users must re-enroll in MFA after migration. Read more
Does Supabase Auth support Inbound SCIM Provisioning user management?
Supabase Auth does not support Inbound SCIM Provisioning user management. No SCIM 2.0 endpoint. User lifecycle management must use the Admin REST API directly or third-party bridges. SCIM is not on the public roadmap. Read more
Does Supabase Auth support Outbound SCIM Provisioning user management?
Supabase Auth does not support Outbound SCIM Provisioning user management. No outbound SCIM provisioning to downstream applications. Read more
Does Supabase Auth support SCIM Groups Provisioning user management?
Supabase Auth does not support SCIM Groups Provisioning user management. No group objects or SCIM group management. Groups must be implemented via custom tables and RLS policies in the public schema. Read more
Does Supabase Auth support Just-In-Time (JIT) User Provisioning user management?
Supabase Auth supports Just-In-Time (JIT) User Provisioning user management. Just-in-time provisioning: users are automatically created in auth.users on first sign-in via social OAuth, magic link, or SAML SSO. The Before User Created Auth Hook can customize or block provisioning. Read more
Does Supabase Auth support Lazy / Trickle Migration from Legacy Database user management?
Supabase Auth partially supports Lazy / Trickle Migration from Legacy Database user management. Lazy migration possible via the Password Verification Attempt Auth Hook, which can intercept failed local password checks and verify against a legacy system, then update the local hash on success. Requires Pro+ for Auth Hooks. No official zero-downtime migration tooling. Read more
Does Supabase Auth support Self-Service Profile Management Portal user management?
Supabase Auth partially supports Self-Service Profile Management Portal user management. Users can update their own email, phone, password, and raw_user_meta_data via the client SDK. No built-in profile management UI — developers must build their own using the supabase-js SDK or @supabase/auth-ui-react components. Read more
Does Supabase Auth support User Account Linking user management?
Supabase Auth supports User Account Linking user management. Multiple authentication providers (email, phone, OAuth) can be linked to a single user account. Anonymous users are automatically converted to permanent accounts when they link an identity. Manual linking via the linkIdentity API is supported. Read more
Does Supabase Auth support User Blocking / Banning user management?
Supabase Auth supports User Blocking / Banning user management. Disable user accounts via the Admin API (updateUserById with banned_until set to a future date or '9999-12-31'). Blocked users cannot sign in. Ban can be time-limited or permanent. Read more
Does Supabase Auth support User Metadata user management?
Supabase Auth supports User Metadata user management. User-editable metadata stored in raw_user_meta_data (JSONB column on auth.users). Updated via the client SDK (updateUser). No strict field schema — any JSON structure is accepted. Size is constrained by Postgres JSONB practical limits (not explicitly documented by Supabase). Read more
Does Supabase Auth support Application Metadata user management?
Supabase Auth supports Application Metadata user management. Admin-only metadata stored in raw_app_meta_data (JSONB column). Cannot be updated by the client SDK — requires the service role key or Admin API. Used for storing authorization data like roles that should not be user-editable. Read more
Does Supabase Auth support Metadata Size Limits user management?
Supabase Auth partially supports Metadata Size Limits user management. No explicit documented size limits on user_metadata or app_metadata fields. Both are stored as Postgres JSONB, so practical limits depend on the database row size and Postgres TOAST limits. Claims included in JWT access tokens are limited by typical JWT size constraints (should stay under 8 KB to avoid HTTP header issues). Read more
Does Supabase Auth support User Search user management?
Supabase Auth partially supports User Search user management. Admin API provides listUsers with pagination (page, perPage) but no server-side search or filtering. To search by email, name, or metadata, query auth.users directly via SQL (requires service role access). No full-text search index on user fields. Read more
Does Supabase Auth support Role-Based Access Control (RBAC) user management?
Supabase Auth partially supports Role-Based Access Control (RBAC) user management. No built-in RBAC system with a roles/permissions management UI. RBAC is implemented by storing role claims in raw_app_meta_data (via admin API) and enforcing them in Postgres RLS policies or application middleware. The Custom Access Token Hook can add role claims to JWTs. Read more
Does Supabase Auth support Organizations (Multi-Tenancy B2B) user management?
Supabase Auth does not support Organizations (Multi-Tenancy B2B) user management. No built-in organization or multi-tenancy model. Must be built manually using custom tables (organizations, memberships), RLS policies scoped by organization_id, and JWT claims. Each Supabase project is effectively a single tenant. Read more
Does Supabase Auth support Password Strength Policies user management?
Supabase Auth supports Password Strength Policies user management. Password policy configurable in the Auth settings: minimum length, require uppercase/lowercase/numbers/special characters, and minimum password strength (using zxcvbn scoring). Leaked password protection (Have I Been Pwned integration) available on Pro+ plans. Read more
Does Supabase Auth support Username Restrictions user management?
Supabase Auth does not support Username Restrictions user management. Supabase Auth does not have a native username field with uniqueness constraints or format restrictions. The email field is the primary identifier. Username-based auth requires custom implementation (e.g., a unique username field in a public.profiles table with RLS). Read more
Does Supabase Auth support Progressive Profiling / Forms user management?
Supabase Auth does not support Progressive Profiling / Forms user management. No built-in progressive profiling flow. Custom progressive profiling can be implemented in the application layer using auth state and the updateUser API. Read more
Does Supabase Auth support Attribute-Based Access Control (ABAC) access control?
Supabase Auth supports Attribute-Based Access Control (ABAC) access control. Row Level Security (RLS) policies provide fine-grained attribute-based access control at the Postgres level. Policies can reference user attributes from auth.uid() and auth.jwt() to filter rows. The combination of RLS + JWT claims implements a full ABAC model for database resources. Read more
Does Supabase Auth support Fine-Grained Authorization (FGA / ReBAC) access control?
Supabase Auth partially supports Fine-Grained Authorization (FGA / ReBAC) access control. Row-level granularity via Postgres RLS — every SELECT/INSERT/UPDATE/DELETE can be controlled per-user per-row. However, no relationship-based access control (ReBAC) graph model. Complex sharing models (e.g., 'user A can edit document B because A is in group C which has editor access') require custom join logic in RLS policies. Read more
Does Supabase Auth support API Authorization (Scopes / Permissions) access control?
Supabase Auth supports API Authorization (Scopes / Permissions) access control. Supabase auto-generates a REST and GraphQL (pg_graphql) API with RLS enforcement. JWT access tokens are validated on every request. Service role bypasses RLS for admin operations. OAuth scopes via the OIDC provider. Read more
Does Supabase Auth support Audit Log Retention security feature?
Supabase Auth partially supports Audit Log Retention security feature. Auth events are logged in Postgres via the GoTrue server. On managed cloud, log retention is limited. Log Drains (paid add-on: $60/drain/month + usage) available on Pro+ for streaming to external SIEM/logging services. On self-hosted, log retention is infrastructure-managed. Read more
Does Supabase Auth support Audit Log Streaming security feature?
Supabase Auth partially supports Audit Log Streaming security feature. Log Drains available on Pro+ as a paid add-on ($60/drain/month + $0.20/million events + $0.09/GB egress). Supports streaming to BigQuery, Datadog, Elastic, HTTPS endpoints. Auth events included. Not available on Free plan. Read more
Does Supabase Auth support Security Center (Threat Monitoring Dashboard) security feature?
Supabase Auth does not support Security Center (Threat Monitoring Dashboard) security feature. No dedicated security dashboard or threat intelligence center. Auth metrics available via the Supabase dashboard (sign-ins, errors) but no real-time security alerting. Read more
Does Supabase Auth support Encryption at Rest security feature?
Supabase Auth supports Encryption at Rest security feature. AES-256 encryption at rest for all data and backups on Supabase Cloud. Self-hosted encryption depends on the underlying infrastructure provider. Read more
Does Supabase Auth support Encryption in Transit security feature?
Supabase Auth supports Encryption in Transit security feature. All connections to Supabase APIs require TLS. HTTP connections are automatically redirected to HTTPS. Database connections use SSL/TLS by default. Read more
Does Supabase Auth support Customer Managed Keys (BYOK) security feature?
Supabase Auth does not support Customer Managed Keys (BYOK) security feature. Customer-managed encryption keys (CMEK) are not available. Encryption keys are managed by Supabase. Read more
Does Supabase Auth support Bot Detection security feature?
Supabase Auth does not support Bot Detection security feature. No native bot detection or CAPTCHA integration in Supabase Auth. Bot protection can be added at the application layer (e.g., Cloudflare Turnstile, hCaptcha) before calling Supabase Auth APIs. Read more
Does Supabase Auth support Brute Force Protection security feature?
Supabase Auth supports Brute Force Protection security feature. Built-in rate limiting on all auth endpoints (e.g., 360 verify requests/hour by IP, 1800 token refreshes/hour by IP). Anomalous refresh token reuse detected and triggers session revocation. Some limits are configurable via the dashboard. Read more
Does Supabase Auth support Suspicious IP Throttling security feature?
Supabase Auth partially supports Suspicious IP Throttling security feature. Auth API rate limits are enforced per IP address (e.g., anonymous sign-ins: 30/hour per IP; OTP: 30/hour project-wide). No dedicated suspicious-IP detection or block-list management. Cloudflare DDoS mitigation applies at the infrastructure level. Read more
Does Supabase Auth support Breached Password Detection security feature?
Supabase Auth partially supports Breached Password Detection security feature. Leaked password protection available on Pro+ plans. Checks passwords against the Have I Been Pwned database during sign-up and password changes. Not available on Free plan. Read more
Does Supabase Auth support Credential Guard (Dark Web Monitoring) security feature?
Supabase Auth does not support Credential Guard (Dark Web Monitoring) security feature. No proactive continuous monitoring for compromised credentials beyond the standard leaked password protection check at sign-up/password-change. Read more
Does Supabase Auth support Tenant Access Control List (IP ACL) security feature?
Supabase Auth does not support Tenant Access Control List (IP ACL) security feature. No tenant-level access control lists for restricting sign-in traffic by IP, geography, or other signals. IP filtering must be applied at the infrastructure or reverse proxy layer. Read more
Does Supabase Auth support Device Fingerprinting security feature?
Supabase Auth does not support Device Fingerprinting security feature. No native device fingerprinting. Sessions track a session_id in the JWT but do not fingerprint the device. Can be added at the application layer via third-party services. Read more
Does Supabase Auth support Per-Organization Branding multi-tenancy?
Supabase Auth does not support Per-Organization Branding multi-tenancy. No per-organization or per-tenant branding in Supabase Auth. The auth UI theme is configured project-wide. Per-tenant branding must be fully custom-built. Read more
Does Supabase Auth support Per-Organization MFA Policy multi-tenancy?
Supabase Auth does not support Per-Organization MFA Policy multi-tenancy. MFA policy is configured globally per project, not per tenant or organization. Per-tenant MFA enforcement requires custom application logic. Read more
Does Supabase Auth support Hosted / Universal Login Page branding feature?
Supabase Auth partially supports Hosted / Universal Login Page branding feature. No centrally hosted login page like Auth0 Universal Login. Auth UI must be embedded in the developer's application using the @supabase/auth-ui-react library or a custom implementation. A minimal hosted sign-in/sign-up UI is available in the Supabase dashboard for admin use only. Read more
Does Supabase Auth support Embedded / Native Login Components branding feature?
Supabase Auth supports Embedded / Native Login Components branding feature. Auth is designed to be embedded in the application. The supabase-js SDK handles all auth flows client-side. The @supabase/auth-ui-react library provides pre-built React components for sign-in, sign-up, and password reset flows. Read more
Does Supabase Auth support White-Label / Full Brand Removal branding feature?
Supabase Auth supports White-Label / Full Brand Removal branding feature. Full white-labeling available. Since Supabase Auth is open source (Apache 2.0), the entire auth layer can be customized. Email templates can remove Supabase branding on Pro+ plans. Read more
Does Supabase Auth support Localization / i18n branding feature?
Supabase Auth partially supports Localization / i18n branding feature. The @supabase/auth-ui-react library has limited built-in i18n support. Localization must be handled at the application layer. Email templates support custom text but lack a translation framework. Auth error messages from the server are English-only. Read more
Does Supabase Auth support Prebuilt UI Components (SDK) branding feature?
Supabase Auth supports Prebuilt UI Components (SDK) branding feature. @supabase/auth-ui-react provides prebuilt React components for common auth flows (sign-in, sign-up, magic link, forgot password, social login buttons). Themed with appearance props. Community UI kits available for Next.js, SvelteKit, and others. Read more
Does Supabase Auth support Login / Auth Analytics Dashboard analytics?
Supabase Auth partially supports Login / Auth Analytics Dashboard analytics. Basic auth metrics (sign-in counts, error rates) available in the Supabase dashboard. No dedicated authentication analytics dashboard. Detailed analytics require exporting logs to BigQuery or an external tool via Log Drains. Read more
Does Supabase Auth support SOC 2 Type II Certification compliance?
Supabase Auth supports SOC 2 Type II Certification compliance. SOC 2 Type 2 compliant. SOC 2 reports are available to Team and Enterprise customers via the Supabase dashboard. Read more
Does Supabase Auth support ISO 27001 / 27017 / 27018 Certification compliance?
Supabase Auth supports ISO 27001 / 27017 / 27018 Certification compliance. ISO 27001 certified. Certificate available to Team and Enterprise customers. Read more
Does Supabase Auth support HIPAA Business Associate Agreement (BAA) compliance?
Supabase Auth partially supports HIPAA Business Associate Agreement (BAA) compliance. HIPAA BAA available on Team and Enterprise plans for storing Protected Health Information. Requires signing a Business Associate Agreement with Supabase. Not available on Free or Pro plans. Read more
Does Supabase Auth support PCI DSS Compliance compliance?
Supabase Auth does not support PCI DSS Compliance compliance. Supabase is not PCI DSS certified. Payment processing on the Supabase platform is handled by Stripe (PCI Level 1), but Supabase itself does not claim PCI compliance for customer workloads. Read more
Does Supabase Auth support CSA STAR Certification compliance?
Supabase Auth does not support CSA STAR Certification compliance. CSA STAR certification not mentioned in Supabase security documentation. Read more
Does Supabase Auth support FedRAMP Authorization compliance?
Supabase Auth does not support FedRAMP Authorization compliance. FedRAMP authorization is not held by Supabase. Supabase is not suitable for US federal government workloads requiring FedRAMP. Read more
Does Supabase Auth support GDPR: Data Export (Portability) compliance?
Supabase Auth supports GDPR: Data Export (Portability) compliance. User data export possible via SQL queries on auth.users and associated tables, and via the Admin API. GDPR data portability (Article 20) supported through direct database access. Read more
Does Supabase Auth support GDPR: Right to be Forgotten (User Deletion) compliance?
Supabase Auth supports GDPR: Right to be Forgotten (User Deletion) compliance. User deletion via Admin API deleteUser() removes the auth record. Application data in other tables should use ON DELETE CASCADE foreign keys to auto-delete. Developers responsible for purging data from storage buckets and other services. Read more
Does Supabase Auth support Consent Management compliance?
Supabase Auth does not support Consent Management compliance. No built-in consent management or cookie consent flows. Must be implemented at the application layer. Read more
Does Supabase Auth support Region Deployment compliance?
Supabase Auth supports Region Deployment compliance. 17 AWS regions available: US West (N. California, Oregon), US East (N. Virginia, Ohio), Canada Central, South America (São Paulo), EU West (Ireland, London, Paris), EU Central (Frankfurt, Zurich), EU North (Stockholm), Asia Pacific (Mumbai, Singapore, Tokyo, Seoul, Sydney). Read more
Does Supabase Auth support Private Cloud Deployment compliance?
Supabase Auth supports Private Cloud Deployment compliance. Supabase Cloud runs on AWS. Self-hosted deployment is fully supported (Docker Compose or Kubernetes) on any cloud provider or on-premises. Enterprise plan includes Bring Your Own Cloud (BYO Cloud) for dedicated infrastructure managed by Supabase. Read more
Does Supabase Auth support SDK Coverage developer integration?
Supabase Auth supports SDK Coverage developer integration. Official Supabase SDKs: supabase-js (JavaScript/TypeScript), supabase-dart (Flutter/Dart), supabase-swift (iOS), supabase-kt (Kotlin/Android), supabase-py (Python), supabase-csharp (.NET). Community SDKs for Go, Ruby, Rust. Auth UI React/SvelteKit. Next.js and SvelteKit SSR auth helpers. Read more
Does Supabase Auth support Management API developer integration?
Supabase Auth supports Management API developer integration. Full Admin REST API for user management (CRUD), SSO configuration, and MFA management. Requires service role key (bypasses RLS). Available in all official SDKs under the auth.admin namespace. Management API also available for project-level configuration. Read more
Does Supabase Auth support Authentication API Rate Limits developer integration?
Supabase Auth supports Authentication API Rate Limits developer integration. Documented per-endpoint rate limits: signup/magic link: 2/hour with built-in SMTP (unlimited with custom SMTP); OTP: 30/hour project-wide; token refresh: 1,800/hour per IP (burst: 30); verify: 360/hour per IP (burst: 30); MFA challenge/verify: 15/hour per IP; anonymous sign-ins: 30/hour per IP. Some limits configurable via dashboard. Read more
Does Supabase Auth support Actions / Extensibility Pipeline developer integration?
Supabase Auth supports Actions / Extensibility Pipeline developer integration. Auth Hooks provide six extensibility points: Before User Created, Custom Access Token (add JWT claims), Send SMS (custom provider), Send Email (custom provider), MFA Verification Attempt (custom MFA logic), Password Verification Attempt (custom password checks / lazy migration). Hooks implemented as Postgres functions or HTTPS endpoints (Edge Functions or external). Signed payloads for security. Read more
Does Supabase Auth support TypeScript Support in Extensibility developer integration?
Supabase Auth supports TypeScript Support in Extensibility developer integration. Auth Hooks implemented as Edge Functions run on Deno and support TypeScript natively. Postgres function hooks are written in PL/pgSQL or PL/v8 (JavaScript/TypeScript). Read more
Does Supabase Auth support Custom Domain developer integration?
Supabase Auth supports Custom Domain developer integration. Custom domain available as a paid add-on ($10/month per domain per project) on paid plans. Only one custom domain per project. CNAME records only — not compatible with root domain A records. Activating/removing a custom domain requires re-configuring OAuth and SAML integrations. Read more
Does Supabase Auth support Deploy CLI (Infrastructure as Code) developer integration?
Supabase Auth supports Deploy CLI (Infrastructure as Code) developer integration. Supabase CLI supports full project configuration as code: auth settings via config.toml, database migrations, Edge Functions deployment, and local development with supabase start. CI/CD integration via GitHub Actions. Read more
Does Supabase Auth support Terraform Provider developer integration?
Supabase Auth supports Terraform Provider developer integration. Official Supabase Terraform provider for managing projects, auth configuration, edge functions, and database settings. Available in the Terraform Registry. Read more
Does Supabase Auth support Custom Database Connections developer integration?
Supabase Auth supports Custom Database Connections developer integration. Supabase Auth stores user data in a Postgres auth schema — fully accessible via SQL. Developers have direct access to the underlying Postgres database for custom queries, triggers, and integrations. The auth schema is separate from the public schema but queryable with the service role. Read more
Does Supabase Auth support Native Webhook Support developer integration?
Supabase Auth supports Native Webhook Support developer integration. Auth Hooks act as synchronous webhooks at auth flow points (HTTP endpoint or Postgres function). Database webhooks via pg_net extension for async event notifications. Edge Functions can be triggered on database changes for post-auth workflows. Read more
Does Supabase Auth support Universal Login / Hosted Login Page Customization developer integration?
Supabase Auth partially supports Universal Login / Hosted Login Page Customization developer integration. No centrally hosted login page. Auth UI customization done via the @supabase/auth-ui-react library using appearance props, custom CSS variables, and theme overrides. Email template customization (13 template types) available in the Auth settings. Full custom UI builds are the recommended approach for production. Read more
Does Supabase Auth support Custom Email Provider (SMTP) developer integration?
Supabase Auth supports Custom Email Provider (SMTP) developer integration. Custom SMTP provider configurable on all plans. Works with any SMTP-compatible service (Resend, AWS SES, Postmark, SendGrid, Brevo, ZeptoMail, etc.). Built-in SMTP is limited to 2 emails/hour with no SLA — custom SMTP is required for production. The Send Email Auth Hook enables routing via non-SMTP providers. Read more
Does Supabase Auth support Email Templates developer integration?
Supabase Auth supports Email Templates developer integration. 13 customizable email templates: 6 authentication (confirm signup, invite user, magic link/OTP, change email, reset password, reauthentication) and 7 security notifications (password changed, email changed, phone changed, sign-in method linked/removed, verification method added/removed). Templates use Go Templates syntax with variables like {{ .ConfirmationURL }} and {{ .Token }}. Configured via dashboard or config.toml. Read more
Does Supabase Auth support Custom OIDC Claims / Token Enrichment developer integration?
Supabase Auth supports Custom OIDC Claims / Token Enrichment developer integration. Custom JWT claims added via the Custom Access Token Auth Hook. The hook receives the standard claims and can add, modify, or remove claims before the token is signed. Available on all plans. Hooks implemented as Postgres functions or HTTP endpoints. Read more
Does Supabase Auth support No-Code Auth Flow Builder / Orchestration feature?
Supabase Auth does not support No-Code Auth Flow Builder / Orchestration feature. No visual/no-code authentication flow builder. Flows are configured programmatically via the supabase-js SDK and Auth Hooks. Read more
Does Supabase Auth support Identity Verification / Document Proofing feature?
Supabase Auth does not support Identity Verification / Document Proofing feature. No built-in identity document verification or biometric liveness proofing. Must integrate third-party services at the application layer. Read more
Does Supabase Auth support Decentralized / Verifiable Credentials feature?
Supabase Auth does not support Decentralized / Verifiable Credentials feature. No support for W3C Verifiable Credentials, Decentralized Identifiers (DIDs), or wallet-based authentication. Read more
Does Supabase Auth support Built-in Billing / Subscription Management feature?
Supabase Auth does not support Built-in Billing / Subscription Management feature. No native billing or subscription management integration. Billing must be handled via third-party services (Stripe, etc.) at the application layer. Read more
Does Supabase Auth support Agentic AI / MCP Server Authentication feature?
Supabase Auth partially supports Agentic AI / MCP Server Authentication feature. OAuth 2.1 authorization server supports MCP (Model Context Protocol) authentication flows for AI agent identity. No dedicated MCP auth tooling yet — implementable using the existing OAuth 2.1 client credentials and token exchange flows. Read more
Does Supabase Auth support Post-Quantum Hybrid TLS Key Exchange post-quantum cryptography feature?
Supabase Auth partially supports Post-Quantum Hybrid TLS Key Exchange post-quantum cryptography feature. Supabase's own security page states it uses 'protection at the CDN level via Cloudflare' in addition to fail2ban, confirming Cloudflare fronts at least part of Supabase's platform. Cloudflare has enabled hybrid post-quantum (X25519Kyber768/X25519MLKEM768) TLS 1.3 key exchange by default across its edge network since 2023-2024. This is infra-level, Cloudflare-driven support, not a GoTrue/Supabase Auth-specific implementation, and Supabase has made no direct statement about PQC. Read more
Does Supabase Auth support Post-Quantum Digital Signature Algorithms post-quantum cryptography feature?
Supabase Auth does not support Post-Quantum Digital Signature Algorithms post-quantum cryptography feature. No public evidence found that Supabase Auth (GoTrue) supports ML-DSA/SLH-DSA/Falcon for JWT signing. Supabase Auth uses standard JOSE algorithms (HS256/RS256/ES256/etc.); no PQC algorithm support is documented.
Does Supabase Auth support Post-Quantum Token & Data Encryption post-quantum cryptography feature?
Supabase Auth does not support Post-Quantum Token & Data Encryption post-quantum cryptography feature. No public evidence found that the provider supports ML-KEM or HPKE (RFC 9180) for encrypting JWE tokens, SAML assertions, or user secrets.
Does Supabase Auth support Post-Quantum Certificate & mTLS Support post-quantum cryptography feature?
Supabase Auth does not support Post-Quantum Certificate & mTLS Support post-quantum cryptography feature. No public evidence found of post-quantum or hybrid X.509 digital certificate support for mTLS client authentication or federation endpoints.
Does Supabase Auth support Post-Quantum Stateful Hash Signatures post-quantum cryptography feature?
Supabase Auth does not support Post-Quantum Stateful Hash Signatures post-quantum cryptography feature. No public evidence found of NIST SP 800-208 stateful hash-based signature scheme support (LMS/HSS, XMSS).
Compare with other providers
Note: The current data is based on provider documentation/experience and may not be 100% accurate. Please open an issue if you have spotted any inconsistencies.