Verify production

Use a new external mailbox and the production HTTPS origin. Testing only with an existing administrator account misses confirmation, onboarding, and sender restrictions.

Deployment sanity check

• Confirm Vercel Production is running the intended commit.
• Confirm the custom domain is serving that deployment over HTTPS.
• Confirm NEXT_PUBLIC_SITE_URL is the same origin as Supabase Site URL.
• Confirm the browser bundle does not contain a Supabase secret/service-role key or another server credential.
• Confirm production and preview deployments use the intended Supabase projects.

Authentication journey

Test every enabled path:

1. Create a new account with email and password.
2. Complete signup using the configured OTP or link.
3. Confirm a second use of the consumed token shows a safe expired/already-used message.
4. Request another message and confirm the UI cooldown is not shorter than Supabase's cooldown.
5. Sign out and sign back in.
6. Test magic-link sign-in if enabled.
7. Request a password reset, confirm it exchanges at /auth/callback?flow=recovery, and finish it at the protected /account/reset-password/new page.
8. Change the password or email if those account controls are exposed.
9. Complete the configured profile or organization onboarding journey.
10. Test every enabled social provider through /auth/callback.

For OTP mode, also verify that an expired or mistyped code produces a useful localised error without exposing a raw Auth object. For link mode, verify the destination does not retain token_hash after completion.

Claims and authorization

After a fresh sign-in, inspect the user's claims through a trusted server-side diagnostic path and confirm the custom access-token hook added the expected role claim. Do not use browser-editable user_metadata for authorization.

Exercise at least one permitted and one forbidden data operation as the new user. An authenticated session alone is not proof that RLS ownership policies work.

Email and abuse controls

• Confirm the message arrives from the production sender.
• Confirm SPF, DKIM, and DMARC results.
• Confirm OTP and link expiry match the configured duration.
• Confirm Auth rate limits return a user-friendly response when reached.
• Confirm CAPTCHA or Turnstile protects public email-triggering endpoints when required by the threat model.

Logs and security checks

Review:

• Supabase → Logs → Auth for failed callbacks, invalid redirects, SMTP failures, and unexpected anonymous users;
• database and security advisors for exposed objects, missing RLS, unsafe functions, and policy issues;
• Vercel build and function logs for missing variables, callback errors, and server exceptions; and
• the sending provider's delivery and suppression logs.

Treat warnings individually. Do not grant broad access, disable RLS, or convert a function to SECURITY DEFINER merely to make an advisor or permission error disappear.

Record the release

Store a non-secret deployment record containing:

• Supabase project reference;
• Vercel project and production domain;
• production branch and verified commit;
• migration version;
• enabled Auth methods;
• OTP expiry and resend cooldown;
• SMTP provider and sending domain;
• date and person who completed the checks; and
• any intentionally deferred optional branch.

The hosted setup is complete when the full enabled journey works from an external mailbox, authorization checks behave correctly, and the logs contain no unexplained production errors.

Return to the wizard overview or continue with an optional integration.