Supabase auth flow

Email registration, sign-in cookies, default user group membership, and session handling on Cloudflare.

Home desk with laptop, external monitor, and keyboard in a living space
Household members check the same dashboard from wherever they already work. Photo: David Wellbeloved / Flickr. CC BY 2.0

User accounts use Supabase Auth for email or OAuth sign-in, session cookies, and row-level security on history and feed configuration. The Astro site validates sessions on protected routes before rendering dashboard HTML or API mutations.

Session lifecycle

  1. User signs in via Supabase client or server exchange.
  2. Session cookie scoped to site domain; HttpOnly where configured.
  3. Server routes read session and query Postgres with user context.

What auth protects

Security notes

Never expose service role keys to the browser. Relay security for public JSON: relay security.