---
title: "Authentication"
description: "232 posts about Authentication, summarised, each linking to the original."
---

# Authentication
> 232 posts about Authentication, summarised, each linking to the original.

## Articles

### [Supabase Beta December 2022](https://yomu.fyi/post/supabase-beta-december-2022.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: ant\_wilson
- Published: Jan 5, 2023
- Type: Announcement

Supabase's December 2022 beta update recaps Launch Week 6, Community Day, Postgres ecosystem work, and other recent releases. The announcements include redesigned documentation rebuilt with Next.js; Storage v2 features for image resizing, webhooks, and a Smart CDN; and multi-factor authentication with optional enforcement through Row Level Security. Supabase Wrappers extend PostgreSQL Foreign Data Wrappers to query external databases, systems, and third-party APIs using SQL, while The Vault enters beta for encrypted secrets and stored data. The update also announces custom domains, point-in-time recovery, SSO on the dashboard in preparation for SAML, and ecosystem projects including pg\_graphql v1.0, a PostgREST 11 pre-release, and an experimental pg\_crdt extension.


### [Reliving Your Happiest HTTP Interactions with Ruby’s VCR Gem](https://yomu.fyi/post/reliving-your-happiest-http-interactions-with-ruby-s-vcr-gem.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Jan 5, 2023
- Type: Tutorial

Ruby’s VCR library records HTTP interactions and replays them in test suites, verifying requests and returning predictable responses; the post presents it as a way to manage complex WebMock stubs and multi-step or unreliable API behavior. It contrasts recordings from a live API with manually authored stubs: cassettes preserve observed behavior at recording time but are harder to change and do not update when the API changes. The guidance covers VCR.use\_cassette, configurable request matching, YAML cassettes, before\_filter logging, filter\_sensitive\_data, and safer recording modes such as :once and :none instead of :new\_episodes. It recommends VCR for integration-focused tests involving unpredictable sequences, multiple calls, or troublesome APIs, while favoring WebMock or decomposition for simple calls and specific states; cassette isolation and inspection add debugging value but can hide interactions.


### [Automatically Rotating GitHub Tokens (So You Don’t Have To)](https://yomu.fyi/post/automatically-rotating-github-tokens-so-you-don-t-have-to.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Dec 20, 2022
- Type: Problem & solution

Shopify needed automated GitHub workflows that could clone from private repositories, update organization-level projects, and trigger downstream workflows but could not use GITHUB\_TOKEN. Personal access tokens supplied those capabilities, yet introduced developer churn, user-attributed actions, and no organization-enforced rotation or expiry. The proposed system uses GitHub Actions and a GitHub App to generate repository secrets that rotate automatically while preserving PAT-like references in existing workflows. Its serverless design delegates scheduling, managed infrastructure, approvals, secret management, auditing, and break-glass operation to GitHub, while a custom TypeScript action encrypts and writes generated secrets. Prototyping exposed that parallel one-second jobs could accrue multiple billable minutes, prompting sequential execution in a consolidated workflow; the stated goal is improved resilience to developer churn and reduced leaked-secret blast radius.


### [Launch Week 6: Wrap Up](https://yomu.fyi/post/launch-week-6-wrap-up.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: paul\_copplestone
- Published: Dec 16, 2022
- Type: Announcement

Supabase’s Launch Week Day 6 wrap-up consolidates the products and platform changes announced during the event. The roundup announces redesigned Next.js documentation, Storage v2 features for image resizing, webhooks, and a Smart CDN, plus multi-factor authentication usable in Row Level Security policies. It also introduces Wrappers, an Alpha framework for connecting Postgres to external systems, Vault for encrypted secrets, and pg\_graphql 1.0 with general availability. Additional releases include dashboard-enabled point-in-time recovery for Pro Projects, custom domains, pg\_crdt, PostgreSQL 15 for new projects, a PostgREST 11 pre-release, and the PGroonga multilingual full-text search extension. Community partnerships with Flutterflow and OneSignal provide Flutter app development and push-notification integrations.


### [Multi-factor Authentication via Row Level Security Enforcement](https://yomu.fyi/post/multi-factor-authentication-via-row-level-security-enforcement.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: joel,kangmingtay,stojan
- Published: Dec 14, 2022
- Type: Announcement

Supabase announces the release of multi-factor authentication (MFA) for everyone and describes dashboard Single Sign-On (SSO) as preparation for a future SAML release; SSO is available on Enterprise plans by contacting the company. The implementation starts with Time-Based One-Time Passwords (TOTP), where an authenticator generates a short-lived code from a shared secret and the current time, exchanged through a QR code or entered manually. Enrollment uses /enroll, /challenge, and /verify, while subsequent sign-ins require a challenge and verification before a JWT is issued with Authenticator Assurance Level (AAL) and Authenticator Method Reference (AMR) claims. Those claims support full or selective enforcement through restrictive Postgres Row Level Security policies, including checks that require aal2 or require it only for users with verified MFA factors; planned additions include WebAuthn, FIDO2 devices, and email notifications.


### [Supabase Beta November 2022](https://yomu.fyi/post/supabase-beta-november-2022.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: ant\_wilson
- Published: Dec 7, 2022
- Type: Announcement

Supabase’s November 2022 update previews Launch Week 6 while reporting a smaller set of product releases and community activity. Remix Auth Helpers are now available for server-side authentication, updated for supabase-js V2 and usable with TypeScript; the post also introduces the Edgy Edge Functions YouTube series and three examples covering OG image generation, Oak API servers, and Puppeteer screenshots. Product fixes address auth.signOut cookies and session removal, magic links can be customized with {{ .TokenHash }}, functions support redirects, and Supabase can be installed through Conda. The update also announces a Fireship course building a Reddit-inspired app with Supabase, PostgreSQL, and React, alongside a broad list of community resources and projects.


### [Zero trust with Kafka](https://yomu.fyi/post/zero-trust-with-kafka.md)
- Company: [Grab](https://yomu.fyi/company/grab.md)
- Author: Fabrice Harbulot
- Published: Dec 7, 2022
- Type: Problem & solution

Grab's real-time data platform team transitioned their large-scale Kafka infrastructure from basic network access controls to a zero-trust architecture. The platform implements mutual Transport Layer Security (mTLS) for offline peer authentication and encryption, driven by HashiCorp Vault's PKI engine and Strimzi on Kubernetes. Policy-Based Access Control is enforced using dedicated Open Policy Agent deployments per cluster, backed by GitOps workflows where topic owners approve JSON authorization rules. To simplify client integration, the team enhanced their Go SDK to handle ephemeral in-memory certificates, automatic renewals, and configurable retries. While the security posture improved, the Java encryption and decryption overhead caused a drop in streaming throughput.


### [The Supabase Content Storm](https://yomu.fyi/post/the-supabase-content-storm.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: ramiro
- Published: Dec 6, 2022
- Type: Announcement

The post announces Supabase’s Content Storm, a community campaign created to promote Launch Week 6 through a coordinated release of external content. Supabase invited well-known YouTubers, community members, makers, the SupaSquad, and others building with Supabase to publish related material on the same day, while giving participants an opportunity to build personal brands or promote products and startups. More than 30 creators took part, producing videos, livestreams, tutorials, project write-ups, and a Twitter thread covering topics such as authentication, migrations, Edge Functions, Storage, GraphQL, Flutter, Rust, and TypeScript integrations. The content was published on Tuesday, December 6, and the post provides a complete list of works and authors while directing readers to bookmark the collection, give feedback, and follow contributors.


### [Flutter Authorization with RLS](https://yomu.fyi/post/flutter-authorization-with-rls.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: tyler\_shukert
- Published: Nov 22, 2022
- Type: Tutorial

This tutorial extends a Flutter real-time chat app by adding authorization and one-to-one conversations backed by Supabase. It introduces a rooms page for starting conversations and listing existing rooms, while flutter\_bloc coordinates profile and message data across the rooms and chats pages. The database changes add rooms and room\_participants tables, connect messages to rooms, expose create\_new\_room for reusing or creating a two-user room, and register deep links for email confirmation on iOS and Android. SQL RLS policies then restrict room, participant, and message reads to participants and require message inserts to use the caller's profile ID, producing a real-time chat app with authentication and authorization.


### [Authentication in Ionic Angular with Supabase](https://yomu.fyi/post/authentication-in-ionic-angular-with-supabase.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: simon\_grimm
- Published: Nov 8, 2022
- Type: Tutorial

The tutorial builds a simple realtime messaging app with Ionic Angular and Supabase, covering account authentication and database protection. It defines Postgres tables for users, groups, and messages, enables Row Level Security with policies for public reads and authenticated operations, and adds a trigger to copy newly registered users into a public users table. Angular services, route guards, and Supabase client logic handle email/password registration and login, session state, protected navigation, and magic links. For native apps, Capacitor URL events extract access and refresh tokens from a custom-scheme callback before establishing the session and navigating to the groups page. The tutorial concludes that Supabase can support Ionic Angular authentication with magic links, while phone authentication through Twilio is another possible option.


### [How to Categorize and Prevent Risks of Sensitive Links in URLScan](https://yomu.fyi/post/how-to-categorize-and-prevent-risks-of-sensitive-links-in-urlscan.md)
- Company: [Tinder](https://yomu.fyi/company/tinder.md)
- Author: Tinder
- Published: Nov 7, 2022
- Type: Problem & solution

Security integrations with URLScan can accidentally index sensitive links when API calls are executed with public visibility. Tinder Security Labs constructed targeted queries to uncover exposed links across file-sharing services, enterprise ticketing platforms, and single sign-on portals. Investigations revealed that exposed links included document magic links containing contracts and bank details, as well as active new-hire registration links that allowed attackers to complete registration workflows and configure two-factor authentication. In one SSO query alone, researchers discovered 1,300 indexed invitation links, with 20 to 50 new links appearing daily. The researchers collaborated with URLScan to purge the exposed indexes from public searches and advised organizations to configure security scanning tools to use private or unlisted visibility settings.


### [Supabase Beta October 2022](https://yomu.fyi/post/supabase-beta-october-2022.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: ant\_wilson
- Published: Nov 2, 2022
- Type: Announcement

Supabase’s October 2022 update reports a broad set of product, documentation, and community releases, while announcing that Launch Week 6 will run from December 12–16. The new supabase-js v2 and supabase-flutter v1 SDKs reached full release, alongside a revamped Next.js quickstart with pre-built Auth UI and Auth Helpers and a Next.js 13 example for fetching and caching data from the Serverless API. Documentation covers Supabase Auth’s server-side rendering flow, and a database-testing framework uses pgTAP and pg\_prove; Edge Functions also gained support for GET, PUT, PATCH, and DELETE requests. Additional changes include functions support in supabase-py, session refreshing, provider refresh tokens, request-location detection through X-Forwarded-For, expanded logging, and storage downloads via a query parameter, alongside three featured community apps and hiring announcements.


### [supabase-flutter v1 Released](https://yomu.fyi/post/supabase-flutter-v1-released.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: tyler\_shukert
- Published: Oct 21, 2022
- Type: Announcement

Supabase has released the stable v1 of its supabase-flutter SDK after several months of developer preview feedback and improvement. The release targets developer experience by reducing boilerplate and introducing more intuitive APIs, including removal of the required .execute() call from select, insert, update, delete, and stream operations; query errors are now thrown rather than returned. Authentication methods use more descriptive names such as signInWithPassword and signInWithOAuth, while onAuthStateChange returns a Dart stream. The SDK also adds first-class support for Realtime Multiplayer's broadcast and presence methods, including low-latency data sharing and client-status tracking, and the announcement provides updated documentation, a quick start guide, and a v0-to-v1 migration guide.


### [Finding Relationships Between Ruby’s Top 100 Packages and Their Dependencies](https://yomu.fyi/post/finding-relationships-between-ruby-s-top-100-packages-and-their-depend.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Oct 19, 2022
- Type: Explainer

RubyGems’ phased MFA rollout required owners of gems with at least 180 million downloads to use MFA, but raised a supply-chain question: could a popular gem depend on a less-downloaded gem that remained an account-takeover target? The investigation loaded rubygems.org data dumps to identify 112 gems above the threshold, queried the API for direct dependencies, and used Bundler with Gemfile.lock files to resolve transitive dependencies. It found 13 big gems with small direct dependencies and 24 with small dependencies overall, attributing the mismatch mainly to newer dependencies and gems shipped with Ruby, such as racc and rexml. Graph visualizations, breadth-first traversal, and a custom depth-first search then mapped dependency structure and paths; the post leaves open whether to do nothing or enforce MFA early for the 24 technically insecure gems.


### [Supabase Beta September 2022](https://yomu.fyi/post/supabase-beta-september-2022.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: ant\_wilson
- Published: Oct 5, 2022
- Type: Announcement

Supabase’s September 2022 update centers on reducing technical debt and clearing its backlog after five Launch Weeks. The team ran three Kaizen weeks focused respectively on QA and testing, documentation, and issue backlog and automation, closing over 250 open issues and 50 pull requests while pausing feature development. Product releases included Auth UI, a pre-built React component for Supabase Auth with custom themes and extensible styles, plus an open-source Postgres WASM release with Snaplet for running Postgres in a browser through an embeddable Linux Virtual Machine. Security changes to Dashboard database interactions simplify permissions and reduce the security surface area; they were scheduled for automatic application in November or could be run earlier through the Dashboard. Other updates covered Edge Functions, documentation, migration tooling, and community projects.


### [Supabase Beta August 2022](https://yomu.fyi/post/supabase-beta-august-2022.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: ant\_wilson
- Published: Sep 7, 2022
- Type: Announcement

Supabase’s August 2022 Beta Update recaps Launch Week 5 releases, the Supa Hackathon, platform changes, migration resources, and community contributions. The release set includes Supabase CLI v1 with TypeScript type generation, the Management API Beta for programmatic project and organization control, and the supabase-js v2 release candidate with type support, new authentication methods, an async Auth overhaul, and Edge Functions improvements. Supabase also announced SOC2 compliance and made Realtime Presence and Broadcast available to all projects, alongside Vault, Auth UI, dashboard permissions, JSON schema validation, pg\_graphql v0.4.0, and MFA early access. From September 11, HTTP API requests will redirect to HTTPS, and clients no longer need to send anon or service keys in the apiKey header; client-library users require no change.


### [Launch Week 5 Hackathon Winners](https://yomu.fyi/post/launch-week-5-hackathon-winners.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: tyler\_shukert
- Published: Aug 25, 2022
- Type: Announcement

Supabase announces the winners of its Launch Week 5 Hackathon, which received 46 project submissions and was described as the most popular hackathon yet. The awards recognized Supabase Cache Helpers as Best Overall for a caching utility that turns Supabase queries into cache keys and provides methods to retrieve and mutate database data, while Super UI was runner-up with a customizable React component library. Other category winners included Hop, a Tinder-like job board; Otentik Authenticator, a desktop app for managing two-step verification tokens; That Hot Dog Game, which uses facial recognition to detect eating; Quid Faciam Hodie?, a video journaling app; and RepoWatch, which shows Supabase GitHub organization updates in realtime. Winning team members receive limited-edition golden Supabase caps, runners-up receive silver caps, and all submissions are available on madewithsupabase.com.


### [Building a Realtime Trello Board with Supabase and Angular](https://yomu.fyi/post/building-a-realtime-trello-board-with-supabase-and-angular.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: simon\_grimm
- Published: Aug 24, 2022
- Type: Tutorial

The tutorial builds a Trello-style project-management board with Supabase, Angular, and Tailwind rather than stopping at a small “hello world” example. It defines boards, lists, cards, users, and user\_boards in Postgres SQL, adds magic-link authentication, and uses Row Level Security policies plus helper functions and triggers to control access and maintain relationships. Angular components and services use the Supabase JavaScript client, while realtime is enabled for cards and lists and exposed through an Observable that applies INSERT, UPDATE, and DELETE events to local board state. The resulting clone supports shared boards for invited, already registered users, and the article provides SQL and source code for running the project with a Supabase instance.


### [One more thing](https://yomu.fyi/post/one-more-thing.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: paul\_copplestone
- Published: Aug 19, 2022
- Type: Announcement

During Launch Week, Supabase announces six product updates spanning database security, authentication, dashboard administration, and developer tooling. Supabase Vault is a Postgres extension for managing secrets and encryption inside the database, built as a thin usability layer over pgsodium and released to gather user feedback rather than for immediate Supabase Platform availability. Auth UI moves from the @supabase/ui library into @supabase/auth-ui-react, with customizable themes, CSS and inline styles, and overridable labels for multilingual support; the initial release supports React. The update also adds granular Dashboard roles, pg\_jsonschema for JSON Schema validation on json and jsonb, pg\_graphql v0.4.0 with json/jsonb, the in filter, and larger-schema introspection, plus early-access signups for Supabase Auth MFA.


### [supabase-js v2](https://yomu.fyi/post/supabase-js-v2.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: inian,alaister
- Published: Aug 16, 2022
- Type: Announcement

Supabase announces supabase-js v2, a release focused on developer quality-of-life improvements and designed around incremental changes rather than a large rewrite. Its type system uses CLI-generated database definitions at the client level, while authentication adds explicit signInWithPassword() and signInWithOtp() methods, makes most Auth operations asynchronous, and moves server-side methods under auth.admin. Data mutations return minimal by default unless select() is appended, constructor options are scoped by library, and Edge Functions automatically detect request and response content types. The release also introduces typed errors, a channel() interface for presence and PostgreSQL change subscriptions, and a preparatory path toward multiplayer features; older realtime syntax remains supported for now. Developers can install v2, consult updated documentation and migration guidance, while v1 continues receiving security fixes and maintenance patches for three months.


[Newer posts](https://yomu.fyi/topic/authentication/page/8.md) · [Older posts](https://yomu.fyi/topic/authentication/page/10.md)