Authentication

HostBase Auth is compatible with Supabase Auth (GoTrue). Users are stored in the auth schema of your database, and every signed-in user gets a JWT signed with the project's secret.

Sign up and sign in with a password

const { data, error } = await supabase.auth.signUp({
  email: "jane@company.com",
  password: "a-very-secret-password-123",
  options: { emailRedirectTo: "https://myapp.com/welcome" },
});

await supabase.auth.signInWithPassword({
  email: "jane@company.com",
  password: "a-very-secret-password-123",
});

Magic link / OTP (requires SMTP)

await supabase.auth.signInWithOtp({ email: "jane@company.com" });

OAuth (Google, GitHub, Apple, Microsoft…)

Enable a provider in Authentication → Sign in / Providers, enter its Client ID and Secret, and use https://<ref>.host.ulewicz.space/auth/v1/callback as the redirect URI at the provider. 21 OAuth providers and custom OIDC providers are supported.

await supabase.auth.signInWithOAuth({
  provider: "github",
  options: { redirectTo: "https://myapp.com/auth/callback" },
});

Current user

const { data: { user } } = await supabase.auth.getUser();
await supabase.auth.signOut();

Auth in RLS policies

auth.uid() and auth.jwt() are available in SQL — see Row Level Security.

E-mail and SMTP

Until you configure SMTP, sign-ups are confirmed automatically, so password sign-in and OAuth work right away. Set up your own SMTP server (e.g. Amazon SES, Resend, Postal) in Authentication → E-mails to enable magic links, e-mail OTPs, password resets and invites, and to customize the e-mail templates.

Configuration in the dashboard

The Authentication module covers users (search, invite, ban, delete, CSV export), OAuth apps, e-mail templates, policies, providers, passkeys, the OAuth server, sessions, rate limits, MFA, URL configuration, attack protection (CAPTCHA, password rules), auth hooks, audit logs and performance.