Supabase Auth v2: Phone Auth now available

Summary

Supabase has released an update to its authentication server, a fork of Netlify's GoTrue, introducing phone-based authentication with SMS one-time passwords. Developers can now configure Twilio credentials in the Supabase Dashboard to support passwordless SMS logins or combine phone numbers with passwords for user authentication. The release also expands third-party login options by adding Twitch alongside existing integrations, bringing the total number of supported OAuth providers to ten. To assist teams needing dynamic or internationalized messaging, a new API endpoint exposed through supabase-js allows backend services using admin keys to generate confirmation, recovery, invite, and magic links directly. These features build on Supabase Auth's architecture, which stores credentials directly in PostgreSQL databases to enable granular Row Level Security policies across database tables and storage buckets.

Context

Supabase Auth, a fork of Netlify's GoTrue Auth server, stores user authentication data directly in the user's PostgreSQL database to reduce vendor lock-in and enable Row Level Security policies. As adoption grew, developers requested mobile phone authentication, broader OAuth support, and increased flexibility for dynamically generating localized email content.

Approach / What changed

Supabase introduced SMS-based OTP and phone-plus-password login powered by Twilio, added community-driven OAuth providers such as Twitch, and exposed an API endpoint in supabase-js to generate authentication links via a backend service_role key.

Takeaways

• Phone authentication allows passwordless six-digit SMS OTP logins or phone-plus-password workflows configured through Twilio credentials in the Supabase Dashboard.
• Developers can programmatically generate confirmation, invite, recovery, and magic links via an API endpoint in supabase-js using a backend service_role admin key.
• Supabase Auth stores user records in the user's PostgreSQL database, allowing access control through native Row Level Security policies and Supabase Storage rules.

Related reading

• Supabase · Jul 29, 2021

  Supabase Reports and Metrics

  Supabase introduced a dedicated Reports section and updated project home pages to deliver observability across hosted Postgres projects and complementary services. Because developers can run unconstrained database queries and custom workloads, monitoring both project-level service usage and underlying infrastructure metrics is essential. The new dashboard displays one month of historical data, including CPU and memory usage alongside request volumes for Database, Auth, and Storage APIs. To collect metrics across hundreds of thousands of targets without high latency, Supabase implemented a federated monitoring architecture running regional Prometheus instances that scrape local exporters and aggregate subsets into a central VictoriaMetrics instance. All project databases now also launch with the pg_stat_statements extension enabled for future query statistics.

  Div Arora

• Supabase · Aug 5, 2020

  Supabase Auth

  Following an early community launch on Hacker News, the open-source Firebase alternative Supabase faced heavy developer demand for a dedicated authentication and authorization solution. In response, the team evaluated existing open-source tools such as KeyCloak and Kratos before landing on an architecture combining a forked Netlify GoTrue server with PostgreSQL and PostgREST. The resulting Supabase Auth system provides client methods like signUp and signIn alongside authorization powered by PostgreSQL Row Level Security and policies. By leveraging SQL policies to enforce access rules directly in the database, developers avoid repetitive middleware filtering while maintaining granular access controls. Future roadmap plans include adding third-party OAuth providers, custom email templates, and simplified policy management interfaces for non-technical users.