# Supabase Auth v2: Phone Auth now available

[Supabase](https://yomu.fyi/company/supabase) · Kang Ming Tay · Jul 28, 2021

**Type:** Announcement

## Summary

Supabase has released an update to its authentication server, a fork of Netlify's GoTrue, introducing phone-based authentication with SMS one-time passwords. Developers can now configure Twilio credentials in the Supabase Dashboard to support passwordless SMS logins or combine phone numbers with passwords for user authentication. The release also expands third-party login options by adding Twitch alongside existing integrations, bringing the total number of supported OAuth providers to ten. To assist teams needing dynamic or internationalized messaging, a new API endpoint exposed through supabase-js allows backend services using admin keys to generate confirmation, recovery, invite, and magic links directly. These features build on Supabase Auth's architecture, which stores credentials directly in PostgreSQL databases to enable granular Row Level Security policies across database tables and storage buckets.

## Context

Supabase Auth, a fork of Netlify's GoTrue Auth server, stores user authentication data directly in the user's PostgreSQL database to reduce vendor lock-in and enable Row Level Security policies. As adoption grew, developers requested mobile phone authentication, broader OAuth support, and increased flexibility for dynamically generating localized email content.

## Approach / What changed

Supabase introduced SMS-based OTP and phone-plus-password login powered by Twilio, added community-driven OAuth providers such as Twitch, and exposed an API endpoint in supabase-js to generate authentication links via a backend service\_role key.

## Takeaways

- Phone authentication allows passwordless six-digit SMS OTP logins or phone-plus-password workflows configured through Twilio credentials in the Supabase Dashboard.
- Developers can programmatically generate confirmation, invite, recovery, and magic links via an API endpoint in supabase-js using a backend service\_role admin key.
- Supabase Auth stores user records in the user's PostgreSQL database, allowing access control through native Row Level Security policies and Supabase Storage rules.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [Open Source](https://yomu.fyi/topic/open-source), [Postgres](https://yomu.fyi/topic/postgres)

[Read original post](https://supabase.com/blog/supabase-auth-passwordless-sms-login)