Authorization Is a Runtime Decision
See how an agent request becomes an allowed or denied tool action through identity context, policy checks, scoped credentials, and an auditable decision trail.
Loading…
Topic
Authentication
229 posts about Authentication. Every summary links to the original.
- 229 posts
- 29 companies
- 5 explainers
See the idea
Authentication explainers
Axum at the Trust Boundary: From Request to Protected Response
Axum is a Rust web framework for composing routes, middleware, and extractors. This explainer shows how different login flows become verified identity before a handler responds.
The Token’s Route: From Auth0 Login to API Authorization
See how an Auth0 login becomes an API decision: redirect the user, issue the right token, validate its claims, and apply audience, scope, and access policies.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
Launch Week 6: Wrap Up
Supabase’s Launch Week Day 6 wrap-up consolidates the products and platform changes announced during the event. The roundup announces redesigned Next.js documentation, Storage v2 features for image resizing, webhooks, and a Smart CDN, plus multi-factor authentication usable in Row Level Security policies. It also introduces Wrappers, an Alpha framework for connecting Postgres to external systems, Vault for encrypted secrets, and pg_graphql 1.0 with general availability. Additional releases include dashboard-enabled point-in-time recovery for Pro Projects, custom domains, pg_crdt, PostgreSQL 15 for new projects, a PostgREST 11 pre-release, and the PGroonga multilingual full-text search extension. Community partnerships with Flutterflow and OneSignal provide Flutter app development and push-notification integrations.
Multi-factor Authentication via Row Level Security Enforcement
Supabase announces the release of multi-factor authentication (MFA) for everyone and describes dashboard Single Sign-On (SSO) as preparation for a future SAML release; SSO is available on Enterprise plans by contacting the company. The implementation starts with Time-Based One-Time Passwords (TOTP), where an authenticator generates a short-lived code from a shared secret and the current time, exchanged through a QR code or entered manually. Enrollment uses /enroll, /challenge, and /verify, while subsequent sign-ins require a challenge and verification before a JWT is issued with Authenticator Assurance Level (AAL) and Authenticator Method Reference (AMR) claims. Those claims support full or selective enforcement through restrictive Postgres Row Level Security policies, including checks that require aal2 or require it only for users with verified MFA factors; planned additions include WebAuthn, FIDO2 devices, and email notifications.
Supabase Beta November 2022
Supabase’s November 2022 update previews Launch Week 6 while reporting a smaller set of product releases and community activity. Remix Auth Helpers are now available for server-side authentication, updated for supabase-js V2 and usable with TypeScript; the post also introduces the Edgy Edge Functions YouTube series and three examples covering OG image generation, Oak API servers, and Puppeteer screenshots. Product fixes address auth.signOut cookies and session removal, magic links can be customized with {{ .TokenHash }}, functions support redirects, and Supabase can be installed through Conda. The update also announces a Fireship course building a Reddit-inspired app with Supabase, PostgreSQL, and React, alongside a broad list of community resources and projects.
Zero trust with Kafka
Grab's real-time data platform team transitioned their large-scale Kafka infrastructure from basic network access controls to a zero-trust architecture. The platform implements mutual Transport Layer Security (mTLS) for offline peer authentication and encryption, driven by HashiCorp Vault's PKI engine and Strimzi on Kubernetes. Policy-Based Access Control is enforced using dedicated Open Policy Agent deployments per cluster, backed by GitOps workflows where topic owners approve JSON authorization rules. To simplify client integration, the team enhanced their Go SDK to handle ephemeral in-memory certificates, automatic renewals, and configurable retries. While the security posture improved, the Java encryption and decryption overhead caused a drop in streaming throughput.
The Supabase Content Storm
The post announces Supabase’s Content Storm, a community campaign created to promote Launch Week 6 through a coordinated release of external content. Supabase invited well-known YouTubers, community members, makers, the SupaSquad, and others building with Supabase to publish related material on the same day, while giving participants an opportunity to build personal brands or promote products and startups. More than 30 creators took part, producing videos, livestreams, tutorials, project write-ups, and a Twitter thread covering topics such as authentication, migrations, Edge Functions, Storage, GraphQL, Flutter, Rust, and TypeScript integrations. The content was published on Tuesday, December 6, and the post provides a complete list of works and authors while directing readers to bookmark the collection, give feedback, and follow contributors.
Flutter Authorization with RLS
This tutorial extends a Flutter real-time chat app by adding authorization and one-to-one conversations backed by Supabase. It introduces a rooms page for starting conversations and listing existing rooms, while flutter_bloc coordinates profile and message data across the rooms and chats pages. The database changes add rooms and room_participants tables, connect messages to rooms, expose create_new_room for reusing or creating a two-user room, and register deep links for email confirmation on iOS and Android. SQL RLS policies then restrict room, participant, and message reads to participants and require message inserts to use the caller's profile ID, producing a real-time chat app with authentication and authorization.
Authentication in Ionic Angular with Supabase
The tutorial builds a simple realtime messaging app with Ionic Angular and Supabase, covering account authentication and database protection. It defines Postgres tables for users, groups, and messages, enables Row Level Security with policies for public reads and authenticated operations, and adds a trigger to copy newly registered users into a public users table. Angular services, route guards, and Supabase client logic handle email/password registration and login, session state, protected navigation, and magic links. For native apps, Capacitor URL events extract access and refresh tokens from a custom-scheme callback before establishing the session and navigating to the groups page. The tutorial concludes that Supabase can support Ionic Angular authentication with magic links, while phone authentication through Twilio is another possible option.
How to Categorize and Prevent Risks of Sensitive Links in URLScan
Security integrations with URLScan can accidentally index sensitive links when API calls are executed with public visibility. Tinder Security Labs constructed targeted queries to uncover exposed links across file-sharing services, enterprise ticketing platforms, and single sign-on portals. Investigations revealed that exposed links included document magic links containing contracts and bank details, as well as active new-hire registration links that allowed attackers to complete registration workflows and configure two-factor authentication. In one SSO query alone, researchers discovered 1,300 indexed invitation links, with 20 to 50 new links appearing daily. The researchers collaborated with URLScan to purge the exposed indexes from public searches and advised organizations to configure security scanning tools to use private or unlisted visibility settings.
Supabase Beta October 2022
Supabase’s October 2022 update reports a broad set of product, documentation, and community releases, while announcing that Launch Week 6 will run from December 12–16. The new supabase-js v2 and supabase-flutter v1 SDKs reached full release, alongside a revamped Next.js quickstart with pre-built Auth UI and Auth Helpers and a Next.js 13 example for fetching and caching data from the Serverless API. Documentation covers Supabase Auth’s server-side rendering flow, and a database-testing framework uses pgTAP and pg_prove; Edge Functions also gained support for GET, PUT, PATCH, and DELETE requests. Additional changes include functions support in supabase-py, session refreshing, provider refresh tokens, request-location detection through X-Forwarded-For, expanded logging, and storage downloads via a query parameter, alongside three featured community apps and hiring announcements.
supabase-flutter v1 Released
Supabase has released the stable v1 of its supabase-flutter SDK after several months of developer preview feedback and improvement. The release targets developer experience by reducing boilerplate and introducing more intuitive APIs, including removal of the required .execute() call from select, insert, update, delete, and stream operations; query errors are now thrown rather than returned. Authentication methods use more descriptive names such as signInWithPassword and signInWithOAuth, while onAuthStateChange returns a Dart stream. The SDK also adds first-class support for Realtime Multiplayer's broadcast and presence methods, including low-latency data sharing and client-status tracking, and the announcement provides updated documentation, a quick start guide, and a v0-to-v1 migration guide.
Finding Relationships Between Ruby’s Top 100 Packages and Their Dependencies
RubyGems’ phased MFA rollout required owners of gems with at least 180 million downloads to use MFA, but raised a supply-chain question: could a popular gem depend on a less-downloaded gem that remained an account-takeover target? The investigation loaded rubygems.org data dumps to identify 112 gems above the threshold, queried the API for direct dependencies, and used Bundler with Gemfile.lock files to resolve transitive dependencies. It found 13 big gems with small direct dependencies and 24 with small dependencies overall, attributing the mismatch mainly to newer dependencies and gems shipped with Ruby, such as racc and rexml. Graph visualizations, breadth-first traversal, and a custom depth-first search then mapped dependency structure and paths; the post leaves open whether to do nothing or enforce MFA early for the 24 technically insecure gems.
Supabase Beta September 2022
Supabase’s September 2022 update centers on reducing technical debt and clearing its backlog after five Launch Weeks. The team ran three Kaizen weeks focused respectively on QA and testing, documentation, and issue backlog and automation, closing over 250 open issues and 50 pull requests while pausing feature development. Product releases included Auth UI, a pre-built React component for Supabase Auth with custom themes and extensible styles, plus an open-source Postgres WASM release with Snaplet for running Postgres in a browser through an embeddable Linux Virtual Machine. Security changes to Dashboard database interactions simplify permissions and reduce the security surface area; they were scheduled for automatic application in November or could be run earlier through the Dashboard. Other updates covered Edge Functions, documentation, migration tooling, and community projects.
Supabase Beta August 2022
Supabase’s August 2022 Beta Update recaps Launch Week 5 releases, the Supa Hackathon, platform changes, migration resources, and community contributions. The release set includes Supabase CLI v1 with TypeScript type generation, the Management API Beta for programmatic project and organization control, and the supabase-js v2 release candidate with type support, new authentication methods, an async Auth overhaul, and Edge Functions improvements. Supabase also announced SOC2 compliance and made Realtime Presence and Broadcast available to all projects, alongside Vault, Auth UI, dashboard permissions, JSON schema validation, pg_graphql v0.4.0, and MFA early access. From September 11, HTTP API requests will redirect to HTTPS, and clients no longer need to send anon or service keys in the apiKey header; client-library users require no change.
Launch Week 5 Hackathon Winners
Supabase announces the winners of its Launch Week 5 Hackathon, which received 46 project submissions and was described as the most popular hackathon yet. The awards recognized Supabase Cache Helpers as Best Overall for a caching utility that turns Supabase queries into cache keys and provides methods to retrieve and mutate database data, while Super UI was runner-up with a customizable React component library. Other category winners included Hop, a Tinder-like job board; Otentik Authenticator, a desktop app for managing two-step verification tokens; That Hot Dog Game, which uses facial recognition to detect eating; Quid Faciam Hodie?, a video journaling app; and RepoWatch, which shows Supabase GitHub organization updates in realtime. Winning team members receive limited-edition golden Supabase caps, runners-up receive silver caps, and all submissions are available on madewithsupabase.com.
Building a Realtime Trello Board with Supabase and Angular
The tutorial builds a Trello-style project-management board with Supabase, Angular, and Tailwind rather than stopping at a small “hello world” example. It defines boards, lists, cards, users, and user_boards in Postgres SQL, adds magic-link authentication, and uses Row Level Security policies plus helper functions and triggers to control access and maintain relationships. Angular components and services use the Supabase JavaScript client, while realtime is enabled for cards and lists and exposed through an Observable that applies INSERT, UPDATE, and DELETE events to local board state. The resulting clone supports shared boards for invited, already registered users, and the article provides SQL and source code for running the project with a Supabase instance.
One more thing
During Launch Week, Supabase announces six product updates spanning database security, authentication, dashboard administration, and developer tooling. Supabase Vault is a Postgres extension for managing secrets and encryption inside the database, built as a thin usability layer over pgsodium and released to gather user feedback rather than for immediate Supabase Platform availability. Auth UI moves from the @supabase/ui library into @supabase/auth-ui-react, with customizable themes, CSS and inline styles, and overridable labels for multilingual support; the initial release supports React. The update also adds granular Dashboard roles, pg_jsonschema for JSON Schema validation on json and jsonb, pg_graphql v0.4.0 with json/jsonb, the in filter, and larger-schema introspection, plus early-access signups for Supabase Auth MFA.
supabase-js v2
Supabase announces supabase-js v2, a release focused on developer quality-of-life improvements and designed around incremental changes rather than a large rewrite. Its type system uses CLI-generated database definitions at the client level, while authentication adds explicit signInWithPassword() and signInWithOtp() methods, makes most Auth operations asynchronous, and moves server-side methods under auth.admin. Data mutations return minimal by default unless select() is appended, constructor options are scoped by library, and Edge Functions automatically detect request and response content types. The release also introduces typed errors, a channel() interface for presence and PostgreSQL change subscriptions, and a preparatory path toward multiplayer features; older realtime syntax remains supported for now. Developers can install v2, consult updated documentation and migration guidance, while v1 continues receiving security fixes and maintenance patches for three months.
Supabase Beta July 2022
Supabase published its July 2022 beta update alongside the announcement of Launch Week 5 scheduled for August 15-19. Key feature releases include a developer preview of Flutter SDK 1.0 with an emphasis on developer experience and Auth Helpers supporting server-side rendering environments like SvelteKit. The team introduced pg_jsonschema, an experimental 10-line Postgres extension created with pgx to enforce structure on json and jsonb columns. Security and identity features were expanded with an hCaptcha integration in authentication settings to block bot attacks. Additionally, email one-time passwords now accommodate lengths between 6 and 10 digits, while the GenerateLink method returns explicit verification metadata.
Supabase Flutter SDK 1.0 Developer Preview
Supabase released the Developer Preview of version 1.0 for its Flutter SDK, prioritizing improvements to developer experience across Dart applications. The new version eliminates the need for boilerplate state classes, automating authentication state persistence and deep link processing directly after initialization. To better align with Dart conventions, the SDK now throws exceptions across auth, storage, and Postgrest instead of returning error objects, while also deprecating the .execute() method for database queries. Switching to the app_links library expands deep linking support to macOS and Windows alongside existing mobile and web platforms. Supabase also introduced a companion Auth UI library for prebuilt authentication interfaces and announced plans to integrate the Multiplayer Realtime engine in the stable release.
Revamped Auth Helpers for Supabase (with SvelteKit support)
Supabase has released an updated version of its framework-specific Auth Helpers libraries, introducing official support for SvelteKit alongside existing React and Next.js tooling to simplify server-side rendering authentication. The updated libraries transition from the @supabase/supabase-auth-helpers namespace to @supabase/auth-helpers within a dedicated monorepo managed by Turborepo. Structuring the codebase with Turborepo and changesets enables publishing isolated packages per framework through GitHub Actions, ensuring each helper contains only its own relevant dependencies. Versioning has also been reset to sub-0.x to reflect early framework lifecycles like pre-1.0 SvelteKit and manage expectations for future breaking changes. Meanwhile, the team has documented migration steps from previous packages and announced that Remix Auth Helpers are currently in active development.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.