Supabase auth
Guardrails, skills, loops, hooks & review agents for database + website builders on Claude Code (Next.js + Supabase).
npx -y skills add m-binimran/dev-pack --skill supabase-authAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Set up Supabase Auth in Next.js App Router — email/OAuth sign-in, server-side sessions, middleware refresh, and protected routes. Use when adding login, sign-up, OAuth, or gating pages behind auth.
SKILL.md
1.7 KB, as published. Nobody here has run it
supabase-auth
Auth is the foundation RLS stands on (auth.uid()). Get the session right on the server.
Process
- Two clients, two jobs: a browser client (client components) and a server client (server components,
actions, route handlers) via
@supabase/ssr. Don't share one across the boundary. - Middleware refreshes the session on every request and writes cookies — without it, server reads see a stale/expired token. Keep the middleware matcher tight (skip static assets).
- Read the user on the server in protected layouts/pages:
const { data: { user } } = await supabase.auth.getUser(). UsegetUser()(verifies with the auth server), notgetSession(), for auth checks. - Gate routes in a server component/layout: no user →
redirect('/login'). Don't gate only on the client. - OAuth / email: sign-in triggers a redirect to
/auth/callback(a route handler that exchanges the code for a session). Sign-out callssupabase.auth.signOut()then redirects.
Output
- The browser + server client setup, the middleware, the callback route, and one protected page example.
- State which routes are gated and where the check runs (server).
Guardrails
- Never trust the client for authorization — the real boundary is server checks + RLS.
- The service-role key bypasses RLS — server-only, never in a client component (the
secret-scanhook blocks it). - Use
getUser()for auth decisions;getSession()can return an unverified cached session.