Loading…
Topic
232 posts about Authentication. Every summary links to the original.
See the idea
A model deployed on AKS is open by default. See how MaaS policies insert Authorino authentication and Limitador rate limits in front of vLLM, so bad keys and over-quota requests stop at the gate.
See how an agent request becomes an allowed or denied tool action through identity context, policy checks, scoped credentials, and an auditable decision trail.
Axum is a Rust web framework for composing routes, middleware, and extractors. This explainer shows how different login flows become verified identity before a handler responds.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Supabase published its July 2022 beta update alongside the announcement of Launch Week 5 scheduled for August 15-19. Key feature releases include a developer preview of Flutter SDK 1.0 with an emphasis on developer experience and Auth Helpers supporting server-side rendering environments like SvelteKit. The team introduced pg_jsonschema, an experimental 10-line Postgres extension created with pgx to enforce structure on json and jsonb columns. Security and identity features were expanded with an hCaptcha integration in authentication settings to block bot attacks. Additionally, email one-time passwords now accommodate lengths between 6 and 10 digits, while the GenerateLink method returns explicit verification metadata.
Supabase released the Developer Preview of version 1.0 for its Flutter SDK, prioritizing improvements to developer experience across Dart applications. The new version eliminates the need for boilerplate state classes, automating authentication state persistence and deep link processing directly after initialization. To better align with Dart conventions, the SDK now throws exceptions across auth, storage, and Postgrest instead of returning error objects, while also deprecating the .execute() method for database queries. Switching to the app_links library expands deep linking support to macOS and Windows alongside existing mobile and web platforms. Supabase also introduced a companion Auth UI library for prebuilt authentication interfaces and announced plans to integrate the Multiplayer Realtime engine in the stable release.
Supabase has released an updated version of its framework-specific Auth Helpers libraries, introducing official support for SvelteKit alongside existing React and Next.js tooling to simplify server-side rendering authentication. The updated libraries transition from the @supabase/supabase-auth-helpers namespace to @supabase/auth-helpers within a dedicated monorepo managed by Turborepo. Structuring the codebase with Turborepo and changesets enables publishing isolated packages per framework through GitHub Actions, ensuring each helper contains only its own relevant dependencies. Versioning has also been reset to sub-0.x to reflect early framework lifecycles like pre-1.0 SvelteKit and manage expectations for future breaking changes. Meanwhile, the team has documented migration steps from previous packages and announced that Remix Auth Helpers are currently in active development.
Supabase released its Beta June 2022 updates covering developer tooling, authentication, and infrastructure changes. The team decoupled Supabase Auth Helpers into dedicated packages for Next.js and React, while introducing project pause and restore features to enable unlimited free projects. Developers can now initiate project creation directly through the Supabase CLI and toggle realtime updates from the table editor side panel. Authentication updates include exposing client IP addresses in audit logs, introducing an auth.jwt function, bubbling PostgreSQL errors from GoTrue, and deprecating older authentication functions. Additionally, infrastructure migrations are underway to support multiplayer features, accompanied by community-led tutorials, sponsorships, and platform growth reaching fifty thousand GitHub stars.
Developers can construct cross-platform real-time chat applications for iOS, Android, and web by pairing Flutter with Supabase. The architecture relies on Supabase to manage authentication and provide direct SDK access to a Postgres database without requiring custom backend server code. The database schema defines profiles with regex validation constraints and a messages table configured for live subscriptions through Postgres publication settings. Flutter clients capture user input, insert new records into the messages table, handle database exceptions, and format chat bubbles with dynamic timestamps. While this initial setup implements user registration and message broadcasting in a shared room, securing chat rooms requires subsequent row-level security configuration.
India’s October 2021 Reserve Bank of India (RBI) directive required recurring payments to use payer-authorized e-mandates, Additional Factor of Authentication (AFA), and pre-debit notifications at least 24 hours before charges. Shopify’s billing platform therefore had to model e-mandates, support recurring and one-time payments across cards and Unified Payments Interface (UPI), and integrate a local payment provider. The payment service reused its source object for the e-mandate token, recorded the temporary authorization as a charge for auditability, and refunded it asynchronously. To avoid two consecutive card authentication flows, the team used recurring-payment tokenization for both payment paths, accepting an atypical notification experience as a short-term trade-off; UPI required asynchronous webhook-driven handling and a hard mandate limit. After the beta launch, billing-payment success rates in India increased from pre-project levels, and the team said it would soon make UPI generally available to Indian merchants.
Grab utilizes facial recognition technology across its platform for driver authentication, passenger verification, and digital electronic Know Your Customer (e-KYC) processes. The core pipeline consists of image preprocessing through face detection and alignment, anti-spoofing checks, feature extraction into high-dimensional vector embeddings, and downstream verification or search. To counter spoof attacks like screen replays, synthetic moiré patterns are generated and cropped face patches are used during training and inference to focus on local structures rather than global semantic noise. Face verification challenges involving shallow ID datasets and masked faces are resolved using semi-Siamese training architectures and masked data augmentations.
Supabase announced several platform updates and performance improvements across its database, hosting, and developer tooling ecosystem for May 2022. Developers managing preview deployments on Jamstack platforms like Vercel and Netlify can now configure wildcard redirect domains such as *.mydomain.com/welcome. For serverless workflows, Edge Functions support a -no-verify-jwt CLI deployment flag to facilitate direct invocation via external webhooks without mandatory token validation. In addition, Supabase exposed a Prometheus-compatible metrics endpoint to all users for real-time project monitoring and alerting. Database security policies also gained a dedicated Target roles configuration, replacing older role check expressions and cutting query execution time from 46 seconds to 7 milliseconds in one customer deployment.
A collection of case studies outlines how diverse engineering teams adopt Supabase across various infrastructure, authentication, and database workloads. Companies like Good Tape and Shotgun achieved substantial cost reductions between 60% and 83% by migrating to Supabase managed Postgres and authentication services. For security and data access control, Quilia reduced development time by 75% leveraging Supabase Data API alongside Row Level Security features. In machine learning applications, organizations such as Firecrawl, Berri AI, and Quivr utilize Supabase Vector for PostgreSQL vector embeddings rather than standalone vector databases. Additional migrations include Mobbin transferring 200,000 users from Firebase for authentication, while teams like Replenysh implemented one-time password workflows in under 24 hours.
Supabase launched its Partner Gallery to showcase integration partners and certified expert agencies assisting developers on the platform. The open-source gallery is built using the Supabase stack, featuring Postgres Full Text Search, next-image with Supabase Storage, and email triggers via Supabase Edge Functions. Initial agency partners include Morrow, a UK app development agency specializing in React Native and Supabase, alongside Quinence, a Singapore-based product development studio. Integrated tooling covers authentication systems like Clerk and Stytch, database and developer utilities like Prisma, Snaplet, Vercel, and pgMustard, and low-code builders including Appsmith, Draftbit, Plasmic, and Teta. These ecosystem integrations allow developers to manage Postgres workflows, secure user authorization, and build applications across web and mobile platforms.
Marketplace Kit version 2 provides boilerplate app code and documentation for third-party developers integrating with Shopify, implementing selected commerce features, and launching marketplaces across channels. The team moved away from using the Shopify CLI-generated Node app because CLI changes could affect their code and documentation, while its dependencies limited control over development practices. The new kit separates a full-stack merchant-facing admin app from a buyer-facing client app, using Express, React, NextJS, GraphQL, Apollo Client, and Apollo Server; open-source versions are publicly available. Its examples demonstrate JWT authentication through App Bridge and Shopify’s Node API, serving REST and GraphQL together with Express, and choosing REST for a product-listing count where a query offered no advantage.
Supabase initiated its Launch Week with Community Day, announcing a series of ecosystem updates, security integrations, and open-source contributions. Through a partnership with GitHub, secret scanning now detects exposed Supabase service role API keys and automatically revokes them to prevent unauthorized database access. The pre-release of PostgREST version 10 introduces arrow operator queries for composite types and array elements, structured PostgreSQL-compliant error messages, and automated recovery from Linux EMFILE conditions. Authentication features expanded with four community-contributed OAuth providers, two phone providers, email one-time passwords via verifyOTP, and framework-specific supabase-auth-helpers starting with Next.js and Nuxt. Finally, Supabase launched a partner gallery powered by Postgres Full Text Search alongside educational courses and an upcoming ten-day virtual hackathon.
Supabase announced product updates, platform improvements, and community resources released during January 2022. The platform expanded authentication options by adding Notion and LinkedIn OAuth support alongside Vonage and Textlocal SMS providers for one-time passwords. Observability tooling gained SQL querying capabilities for logs, timestamp filtering, and expanded time spans across project usage charts to accelerate issue diagnosis. Database infrastructure advanced with the release of pg_graphql version 0.1.0 introducing SQL Comment Directives, while PostgREST replaced pg_listen with built-in schema reloading and automated compute-based connection pool scaling. To streamline customer assistance, a priority selector was added to dashboard support forms with urgent tiers for paid projects.
Grab addressed the vulnerabilities and costs associated with SMS one-time passwords and PINs by implementing device-level biometric authentication. The architecture pairs device biometric sensors with hardware secure enclaves to protect private keys separately from the main operating system. During enrollment, Grab generates a public-private key pair using SHA512withECDSA, authenticates the user locally, and stores reference identifiers in encrypted device storage. HellfireSDK verifies that the device is not rooted, ensuring raw biometric data never leaves the handset. Early experimental runs indicate an adoption rate exceeding 90% and a login success rate near 90%.
Supabase updated its Realtime server to enforce PostgreSQL Row Level Security (RLS) policies when broadcasting database changes over websockets. Previously, Realtime operated as an opt-in beta feature that sent all replication changes to every client regardless of user authorization. To enforce RLS per subscriber without heavy performance overhead, Supabase introduced WALRUS, a security engine colocated inside PostgreSQL. For each replication change, WALRUS looks up active subscribers, assumes their identities, and evaluates row visibility using prepared statements queried by primary key. This in-database evaluation avoids external network round trips and single-query planning overhead while returning an authorized subscriber list to Realtime.
Supabase kicked off its Launch Week by showcasing integrations, ecosystem updates, and community contributions across its open-source stack. The platform announced that all hosted projects are upgrading to PostgREST 9, introducing inner joins, functions with unnamed parameters, and PostgreSQL 14 compatibility. Through community contributions, Supabase expanded authentication options to include Slack, Spotify, and MessageBird alongside existing providers. Updates to the Python ecosystem include package renaming to supabase, synchronous operation support in postgrest-py, and a rewritten gotrue-py matching JavaScript feature parity. Additionally, Supabase partnered with GitGuardian to automate secret detection and remediation across development lifecycles, protecting sensitive database service role keys.
PostgreSQL 14 introduces several enhancements to improve application performance, data manipulation, query troubleshooting, and database security. Developers can traverse nested JSON data structures using subscripting and store noncontiguous values using multirange data types in single operations. Applications relying on libpq can leverage client-side query pipelining to send multiple queries across high-latency networks without waiting for individual responses, while parallel execution now supports foreign data wrappers, parallel sequential scans, and materialized view refreshes. For observability, query IDs are integrated into live execution tracking via pg_stat_activity, EXPLAIN VERBOSE outputs, and log files. Security upgrades include predefined read-only roles such as pg_read_all_data alongside SCRAM-SHA-256 enabled as the default authentication mechanism.
Supabase announced its October 2021 beta release, introducing three new authentication providers for Slack, Spotify, and MessageBird phone logins. The platform rolled out database multi-schema support, enabling users to browse different database schemas directly within the Dashboard interface and query them through the PostgREST API after enabling schema access. Documentation and instructional resources were expanded to cover PostgreSQL functions, authentication server-side functions, RedwoodJS quickstarts, self-hosting architectures, and production readiness checklists. In addition to ecosystem releases such as supabase-py v0.0.3, nuxt-supabase v2.2.1, and vue-supabase v2.2.3, the project reached over 21,268 GitHub stars. The team also announced Launch Week III: The Trilogy, set to begin on November 29th on Discord.
Supabase announced a $30 million Series A funding round led by Coatue, bringing its total funding to $36 million. The company aims to provide an open source alternative to Firebase while addressing the scalability limitations typical of abstracted database platforms. Rather than building a compatibility layer, Supabase provisions a full PostgreSQL database for every project alongside integrated authentication, storage, RESTful APIs, and realtime data streaming. Platform features rely directly on core PostgreSQL primitives, including Row Level Security policies, database triggers, and logical replication streams. Funding will support long-term development of a cloud-native PostgreSQL platform offering database branching, distributed read-write nodes, scalable storage, and ephemeral compute that scales down to zero.
Replenysh builds infrastructure connecting brands with local communities to track, monetize, and recover used packaging and materials. The engineering team previously maintained their own backend infrastructure, pairing custom Twilio and password authentication with a Haskell server and a Postgres database on Heroku. Seeking to accelerate development velocity and minimize ongoing DevOps maintenance during a codebase refactor, Replenysh required an alternative backend platform that preserved relational Postgres and Row Level Security. The team selected Supabase over alternatives like Firebase because it provided native Row Level Security alongside built-in authentication tooling. By adopting Supabase Auth, Replenysh successfully implemented an SMS one-time password system in less than 24 hours before deploying their mobile application to production.
The best engineering reads, once a week.
