Docs menu

Backend: sign-in

A Backend app or website has its own sign-in: email and password, magic links, password resets, and Google and GitHub. Your app or website uses it through supabase-js's auth, at its own address. It runs while Backend is on (for a website, while the website is online).

See how it is set up

$ secretbase backend auth

It shows whether sign-in runs, where its mail comes from, confirm email, Google and GitHub, the addresses sign-in may send people back to, and the callback URL for Google and GitHub. From another folder: secretbase backend my-app auth; from a laptop, add --to <server> to each command on this page, as on Backend.

On the dashboard: the app's Backend tab, Sign-in. It has the mail line, Confirm email, Redirect addresses, Google and GitHub, and the Callback URL for Google and GitHub.

Mail from your own domain

Sign-in sends mail (confirm your email, a magic link, a password reset) from your own domain, through your own free Resend account. Until a domain is verified, no sign-in mail can go out: only sign-up with confirm email off works.

1
Set up email with a Full access Resend key: secretbase email set --to you@example.com (see Health and alerts).
2
Add your domain:
$ secretbase email domain add example.com
3
It prints the DNS records Resend asks for (type, name, value). Add them where example.com's DNS is. Secretbase never adds them itself.
4
Check: secretbase email domain. Resend may take a few minutes to see them. It says "example.com: verified." once it is.

Then each app's sign-in mail comes from my-app <no-reply@example.com>, and alerts from alerts@example.com. An app sends at most 50 emails a day. On the dashboard: Settings, Alerts, Send from your own domain (the link in the Backend tab's mail line opens Settings). secretbase email domain remove example.com removes it here and at Resend.

Confirm email

On (recommended): new users confirm their email before they sign in. Off: anyone signs up with an email and a password, and no mail is sent.

$ secretbase backend auth confirm-email on

Where sign-in sends people back

Sign-in may always send people back to the app's own addresses. To add another one, for example your app's own domain:

$ secretbase backend auth redirect add https://app.example.com/welcome

redirect remove <url> removes one; redirect list shows them.

Google and GitHub

1
At Google or GitHub, make an OAuth app for your app, and copy its client ID and client secret.
2
Turn the provider on. It asks for the client ID and the secret, which aren't shown while you type:
$ secretbase backend auth google on
3
It prints the callback URL, <address>/auth/v1/callback. Register it at Google as the OAuth app's redirect URL (at GitHub, its callback URL).

On the dashboard: Set up next to Google or GitHub on the Backend tab, paste the Client ID and Client secret, then Turn on. When an AI tool sets up sign-in, it never takes the client ID or secret: it sends you to this form.

secretbase backend auth github on does the same for GitHub. … off turns one off and removes its client ID and secret here. While a provider is on, the app's sign-in may reach only that provider's sign-in servers; nothing else on the internet.

If this computer has a firewall

Sign-in hands its mail and its Google and GitHub sign-in to Secretbase on two ports of the app's own network. When this computer's firewall (ufw or firewalld) blocks them, secretbase backend auth and the Backend tab say so, with the one command that allows just those two ports from the app's sign-in on that network (the tab has Copy the command). With ufw it looks like this, with the app's own network filled in:

$ sudo ufw allow in on <bridge> from <sign-in address> to <bridge address> port 2525,3129 proto tcp

With firewalld it adds two rich rules to the zone of that network, one for port 2525 and one for 3129, then reloads:

$ sudo firewall-cmd --permanent --zone=<zone> --add-rich-rule='rule family="ipv4" source address="<sign-in address>" destination address="<bridge address>" port port="2525" protocol="tcp" accept' --add-rich-rule='rule family="ipv4" source address="<sign-in address>" destination address="<bridge address>" port port="3129" protocol="tcp" accept' && sudo firewall-cmd --reload

Copy the command Secretbase prints rather than typing this one. Secretbase never changes your firewall itself. If it couldn't read the firewall, it says "Couldn't read this computer's firewall…" and names the two ports to check.

Not there

Sign-in by SMS or phone, other providers, and screens to manage your app's users.

If something goes wrong

  • "Mail: can't go out yet: no sending domain is verified.": add your domain as above.
  • "Your Resend key may only send email, so it can't add or check a domain.": make a key with Full access and set it again with secretbase email set.
  • "<app> has sent its 50 emails for today": it can send again the next day (UTC).
  • "That isn't a web address sign-in can send people back to": type a full address, like https://example.com/welcome.
  • "my-app has no sign-in while its Supabase features are off.": turn Backend on first.