# 5. Configure authentication policy

> Align Supabase Auth provider, password, OTP, and account-change settings with the Supacharger application configuration.

# Configure authentication policy

The application UI and the hosted Auth server must enforce the same policy. Configure the hosted project from the decisions recorded in step 1.

## Align the email provider

Open **Supabase → Authentication → Sign In / Providers → Email** and compare it with `AUTHENTICATION` in `src/supacharger.config.ts`.

| `SIGN_UP_EMAIL_VERIFICATION` | Hosted Confirm Email | Confirm signup template |
| --- | --- | --- |
| `disabled` | Off | Not used for signup |
| `link` | On | Token-hash link through `/auth/confirm` |
| `otp` | On | Configured-length `{{ .Token }}` |
| `otp-and-link` | On | Both alternatives; either one consumes the verification |

Configure `PASSWORDLESS_EMAIL.SIGN_IN` and `SIGN_UP` separately as `disabled`, `otp`, or `link`. Passwordless mode is exclusive: the hosted **Magic Link or OTP** template must contain only the configured OTP or only the configured link. Set `PASSWORDLESS_EMAIL.OTP_LENGTH` to an integer from 6 through 10 and keep the hosted OTP length equal to it.

Keep **Allow new users to sign up** aligned with whether the product permits public account creation. Leave anonymous sign-ins disabled unless the application deliberately accepts anonymous Supabase users and its RLS distinguishes them correctly. Anonymous users receive the `authenticated` Postgres role, so `TO authenticated` alone does not separate them from permanent users.

## Email OTP expiration

Set **Email OTP Expiration** to a duration appropriate for the product. Supabase defaults to 3,600 seconds; use 3,600 seconds or less for a normal production application unless a documented user need justifies longer.

This single setting governs:

- email OTPs;
- magic links;
- signup confirmation links;
- password-recovery links;
- email-change links; and
- invitation links.

Do not write a different duration into the email copy. If the policy changes later, update the template copy at the same time.

## Resend cooldown and rate limits

The OTP expiration is not the resend cooldown. Supabase normally requires 60 seconds between OTP, magic-link, signup-confirmation, and recovery requests for the same user. Keep the application's displayed resend timer equal to or longer than the hosted cooldown.

Project-wide email and OTP quotas are configured separately under **Authentication → Rate Limits**. They are covered after custom SMTP is connected in step 6.

## Password policy

If password authentication is enabled:

1. Set a minimum password length of at least eight characters.
2. Select the required character policy appropriate for the product.
3. Enable leaked-password protection when the project plan supports it.
4. Match the minimum and character policy in Supacharger's application configuration.
5. Treat `PASSWORD_CUSTOM_REGEX` as additional application validation only; it does not alter Supabase's server policy.

Decide whether changing a password requires the current password or recent reauthentication. Do not enable a server requirement until the application supplies the corresponding user journey.

## Account changes and security notifications

Keep secure email change enabled unless the product has a documented reason to confirm only the new address. When secure email change is enabled, the user confirms both the existing and new address.

Enable the available security notifications for password, email, phone, sign-in-method, and verification-method changes that the product supports. Install their templates in step 7.

## Social providers

For every provider enabled in `AUTH_PROVDERS_ENABLED`:

1. Enable the matching provider in Supabase.
2. Supply its client ID and secret.
3. Copy Supabase's provider callback URL into the external provider console.
4. Verify `/auth/callback` is allowed in Supabase URL Configuration.

Do not enable a UI provider without its hosted credentials, and do not leave unused hosted providers enabled.

## Completion check

- The email-confirmation mode matches `SIGN_UP_EMAIL_VERIFICATION`.
- Passwordless mode and OTP length match `PASSWORDLESS_EMAIL`.
- OTP expiration and the UI resend timer are compatible.
- Password rules match on the client and Supabase server.
- Anonymous sign-ins and unused providers are off.
- Enabled account-change requirements have a working UI journey.

Next: [Configure production email](./06-production-email.md).