Configure authentication policy

The application UI and the hosted Auth server must enforce the same policy. Configure the hosted project from the decisions recorded in step 1.

Align the email provider

Open Supabase → Authentication → Sign In / Providers → Email and compare it with AUTHENTICATION in src/supacharger.config.ts.

SIGN_UP_EMAIL_VERIFICATION	Hosted Confirm Email	Confirm signup template
disabled	Off	Not used for signup
link	On	Token-hash link through /auth/confirm
otp	On	Configured-length {{ .Token }}
otp-and-link	On	Both alternatives; either one consumes the verification

Configure PASSWORDLESS_EMAIL.SIGN_IN and SIGN_UP separately as disabled, otp, or link. Passwordless mode is exclusive: the hosted Magic Link or OTP template must contain only the configured OTP or only the configured link. Set PASSWORDLESS_EMAIL.OTP_LENGTH to an integer from 6 through 10 and keep the hosted OTP length equal to it.

Keep Allow new users to sign up aligned with whether the product permits public account creation. Leave anonymous sign-ins disabled unless the application deliberately accepts anonymous Supabase users and its RLS distinguishes them correctly. Anonymous users receive the authenticated Postgres role, so TO authenticated alone does not separate them from permanent users.

Email OTP expiration

Set Email OTP Expiration to a duration appropriate for the product. Supabase defaults to 3,600 seconds; use 3,600 seconds or less for a normal production application unless a documented user need justifies longer.

This single setting governs:

• email OTPs;
• magic links;
• signup confirmation links;
• password-recovery links;
• email-change links; and
• invitation links.

Do not write a different duration into the email copy. If the policy changes later, update the template copy at the same time.

Resend cooldown and rate limits

The OTP expiration is not the resend cooldown. Supabase normally requires 60 seconds between OTP, magic-link, signup-confirmation, and recovery requests for the same user. Keep the application's displayed resend timer equal to or longer than the hosted cooldown.

Project-wide email and OTP quotas are configured separately under Authentication → Rate Limits. They are covered after custom SMTP is connected in step 6.

Password policy

If password authentication is enabled:

1. Set a minimum password length of at least eight characters.
2. Select the required character policy appropriate for the product.
3. Enable leaked-password protection when the project plan supports it.
4. Match the minimum and character policy in Supacharger's application configuration.
5. Treat PASSWORD_CUSTOM_REGEX as additional application validation only; it does not alter Supabase's server policy.

Decide whether changing a password requires the current password or recent reauthentication. Do not enable a server requirement until the application supplies the corresponding user journey.

Account changes and security notifications

Keep secure email change enabled unless the product has a documented reason to confirm only the new address. When secure email change is enabled, the user confirms both the existing and new address.

Enable the available security notifications for password, email, phone, sign-in-method, and verification-method changes that the product supports. Install their templates in step 7.

Social providers

For every provider enabled in AUTH_PROVDERS_ENABLED:

1. Enable the matching provider in Supabase.
2. Supply its client ID and secret.
3. Copy Supabase's provider callback URL into the external provider console.
4. Verify /auth/callback is allowed in Supabase URL Configuration.

Do not enable a UI provider without its hosted credentials, and do not leave unused hosted providers enabled.

Completion check

• The email-confirmation mode matches SIGN_UP_EMAIL_VERIFICATION.
• Passwordless mode and OTP length match PASSWORDLESS_EMAIL.
• OTP expiration and the UI resend timer are compatible.
• Password rules match on the client and Supabase server.
• Anonymous sign-ins and unused providers are off.
• Enabled account-change requirements have a working UI journey.

Next: Configure production email.