Skip to the article

Authentication and email

Auth email belongs to Supabase/GoTrue.

Set the correct Auth origin

Auth email belongs to Supabase/GoTrue. Application notifications through Resend do not configure confirmation or password recovery. In the full profile, retain the minddy overlay in every Compose command. Set SITE_URL, API_EXTERNAL_URL, SUPABASE_PUBLIC_URL and ADDITIONAL_REDIRECT_URLS to your selected origins. Configure SMTP_ADMIN_EMAIL, SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASS and SMTP_SENDER_NAME with your own provider. The overlay also sets the session limits: GOTRUE_SESSIONS_TIMEBOX is 8760h (one year) and GOTRUE_SESSIONS_INACTIVITY_TIMEOUT is 720h (30 days). Keep confirmation enabled and restart Auth in the installed Compose context.

Before using compose below, set the installed full-profile function from the reference Compose context.

Bash
compose up -d --wait auth
Configured Auth origin and redirects
Operator SMTP and versioned templates
Confirmation gesture and password login
TOTP, recovery and revoked-password tests
Read the stages in order. Configured Auth origin and redirects. Operator SMTP and versioned templates. Confirmation gesture and password login. TOTP, recovery and revoked-password tests.

Configure managed Supabase

In your own project Authentication settings, set Site URL and the exact <app-origin>/auth/callback redirect. Configure custom SMTP and both versioned confirmation/recovery templates. The confirmation template uses token_hash and type=signup. Set at least eight characters with lowercase, uppercase and digits and enable TOTP enrollment and verification. Enable compromised-password checks where supported, recording provider limitations. The full overlay uses fail-closed checks requiring outbound api.pwnedpasswords.com access. Set the session time-box to 8760 hours (one year) and the inactivity timeout to 720 hours (30 days). The database refuses sessions beyond these same limits, so a disabled or longer Auth limit keeps refreshing sessions that every API then rejects. Record session lifetime, refresh-token rotation, revocation and Auth rate limits; SQL bootstrap does not set these platform controls.

Test account-level results

Use a disposable address you control. Confirm that signup email reaches it, opens this instance and requires the confirmation gesture. Enroll TOTP in account security settings and save recovery codes outside the browser. Sign out and verify a fresh password-plus-TOTP login. Request reset, follow the recovery email and verify the previous password fails. For an ADMIN_EMAILS address, check administrator access only after MFA. Record versions, dates and sanitized outcomes. Container health cannot prove delivery or account security. Never include email tokens, passwords, sessions, TOTP secrets or recovery codes in evidence.

Related articles