• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

supabase / auth
72%

Build:
DEFAULT BRANCH: master
Repo Added 27 Mar 2024 06:02AM UTC
Token 1T31V1W6OkCUSHigZiCz5dLEn3wnbRdrc regen
Build 2447 Last
Files 208
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH master
branch: master
CHANGE BRANCH
x
Reset
Sync Branches
  • master
  • add-max-length-check-for-email
  • add-phone-number-in-sms-webhook
  • annabaker/auth-1552-add-expiresat-column-to-the-one_time_tokens-table
  • annabaker/auth-1553-cleanup-find-user-by-token-logic
  • annabaker/auth-1553-ott-phone-providers
  • annabaker/auth-1553-ott-query-helpers
  • annabaker/auth-1553-switch-one_time_tokens-table-to-source-of-truth
  • annabaker/auth-1556-add-link_token_hash-column
  • annabaker/auth-1572-clamp-otp-exp
  • annabaker/auth-1572-start-writing-to-one_time_tokensexpiresat
  • annabaker/auth-1573-add-lefthook-pre-commit-hooks
  • annabaker/auth-1574-make-migrate_test-print-applied-migration-names
  • annabaker/auth-1628-bump-googlegolangorggrpc-to-v1831-to-clear-go-2026-6348
  • auth-1547
  • auth.resend-consistent-confirmation-flow
  • beng/fix-config
  • bewinxed/add-scim-v2
  • bewinxed/webauthn-persist-latest-attestation
  • bewinxed/webauthn-support
  • bo/docs/readme-code-syntax
  • bugfix/bootstrapping
  • cemal/add-checksums-to-release-notes
  • cemal/audit-log-stdout
  • cemal/audit-logs-prevent-only-writing-postgres
  • cemal/chore-blacksmith-runners
  • cemal/chore-parallel-builds
  • cemal/ci-fix-yaml-syntax-error
  • cemal/custom-oidc-cache-discovery
  • cemal/enhance-record-login-calls
  • cemal/facebook-limited-login-support
  • cemal/feat-1539-login-events-oauth-server
  • cemal/feat-add-oauth-authorize-endpoint
  • cemal/feat-add-oauth-client-type
  • cemal/feat-add-oauth-client-update-endpoint
  • cemal/feat-add-oauth-consent-list-and-revoke
  • cemal/feat-add-oauth-scopes-for-oidc
  • cemal/feat-add-oauth-token-endpoint
  • cemal/feat-add-oidc-provider-cache
  • cemal/feat-add-oidc-support
  • cemal/feat-add-pagination-oauth-clients-list
  • cemal/feat-add-regenerate-client-secret
  • cemal/feat-add-well-known-oauth-auth-server
  • cemal/feat-authorization-ttl-envvar
  • cemal/feat-cursor-based-pagination
  • cemal/feat-custom-claims-for-custom-providers
  • cemal/feat-custom-oauth-oidc-providers
  • cemal/feat-db-cache-for-custom-oidc-providers
  • cemal/feat-enable-custom-providers-by-default
  • cemal/feat-enhance-url-check-issuer
  • cemal/feat-experimental-provider-gropping
  • cemal/feat-explicit-base-url-for-custom-oauth
  • cemal/feat-facebook-limited-login-skip-nonce-check
  • cemal/feat-loose-amr-claim-check
  • cemal/feat-oauth-client-for-supabase
  • cemal/feat-oauth2-return-redirect-url
  • cemal/feat-prefix-for-migration-queries
  • cemal/feat-redirect-url-v2
  • cemal/feat-remove-client-id-column-oauth-clients
  • cemal/feat-saml-key-rotation
  • cemal/feat-supabase-auth-identifier-oauth-redirects-auth-919
  • cemal/feat-support-custom-discovery-urls
  • cemal/feat-support-multiple-aud
  • cemal/feat-update-docker-compose-dev
  • cemal/feat-update-oauth-client-list-response
  • cemal/feat-update-openapi
  • cemal/fix-404-as-json-response
  • cemal/fix-add-issuer-validator
  • cemal/fix-add-missing-param
  • cemal/fix-ignore-transitive-cve
  • cemal/fix-info-log-on-http-server-close
  • cemal/fix-makefile
  • cemal/fix-migration-version
  • cemal/fix-oauth-client-redirect-uri-validation
  • cemal/fix-oauth2-referer-check
  • cemal/fix-oidc-issuer-strip-slash
  • cemal/fix-openapi
  • cemal/fix-provider-info-signup-audit
  • cemal/fix-token-auth-endpoint-method-update
  • cemal/fix-update-last-sign-in-refresh-token-v2
  • cemal/oauth-provider-client
  • cemal/refactor-token-service
  • cemal/revert-reset
  • chore-fix-link-to-netlify-gotrue
  • chore/gofmt-go-1.27
  • chore/harden-runners
  • chore/ip-tracking-cleanup
  • chore/metric-tags
  • chore/prodsec-89
  • chore/remove-security-md-org-policy
  • chore/testing
  • chore/update-workflow-check-commits
  • ci/codeql-advanced-setup
  • ci/openapi-lint
  • cleanup-ci
  • codex/add-passkey-support-to-supabase
  • cs/api-db-access
  • cs/api-errorcodes-refactor
  • cs/auth-sso-resource-id-support
  • cs/background-template-reloading
  • cs/background-template-reloading-p2
  • cs/background-template-reloading-p3
  • cs/bug-fix-send-email-hook
  • cs/bump-go-1.25.5
  • cs/bump-go1.26.5
  • cs/chore-apitask-tests
  • cs/chore-gosec-fixes
  • cs/conf-coverage
  • cs/conf-json-parsing
  • cs/crypto-generate-otp-tests
  • cs/e2e
  • cs/e2e-tests-phone-confirm-and-change
  • cs/error-code-metrics
  • cs/feat-add-after-user-created-hook
  • cs/feat-background-workers
  • cs/feat-config-reloader
  • cs/feat-config-reloads-poller
  • cs/feat-email-and-sms-rate-limiting
  • cs/feat-mailer-cleanup-p1
  • cs/feat-mailer-logging
  • cs/feat-makefile-qol
  • cs/feat-makefile-update
  • cs/feat-percentage-based-db-conn-limits
  • cs/feat-pkg-envparse
  • cs/feat-rate-limiter-persistence
  • cs/feat-ratelimit-reloads
  • cs/feat-test-failfast
  • cs/feat-tools-dir
  • cs/feat-tools-dir-vulncheck-fix
  • cs/feat-validate-email-address
  • cs/feat-version-metric
  • cs/feat-version-metric-errors
  • cs/fix-build-system
  • cs/fix-ctx-server-errors
  • cs/fix-dockerfile
  • cs/fix-rate-limit-zero-value-test
  • cs/fix-release-workflow
  • cs/fix-respect-rate-limit-zero
  • cs/fix-version-empty
  • cs/hooks-add-metdata
  • cs/hooks-content-negotiation-fix
  • cs/hooks-errors-fix
  • cs/hooks-p1
  • cs/hooks-p2
  • cs/hooks-p3
  • cs/hooks-p4
  • cs/hooks-pr5-opt1
  • cs/hooks-pr5-opt2
  • cs/hooks-refactor-apierrors
  • cs/hooks-test-coverage
  • cs/invite-fix
  • cs/json-config
  • cs/mailer-refactor-p1
  • cs/master-fix-missing-error-propagation
  • cs/maxconn-fix-1
  • cs/migrations-fix-for-add-mfa
  • cs/modernize-error-handling
  • cs/pr-2497-fix
  • cs/rate-limit-otp-clarity
  • cs/rate-limit-refactor
  • cs/reduce-artifact-sizes
  • cs/reload-coverage
  • cs/reloader-allow-invalid-config-dir
  • cs/reloader-unittest-race-fix
  • cs/remove-template-prefetch
  • cs/restore-version-format
  • cs/revert-1974
  • cs/sso-login-validation
  • cs/template-cache-warmup
  • cs/update-email-validation
  • cs/update-godotenv
  • cs/v1hooks
  • da/fix-release
  • dependabot/go_modules/github.com/consensys/gnark-crypto-0.18.1
  • dependabot/go_modules/github.com/ethereum/go-ethereum-1.16.8
  • dependabot/go_modules/github.com/getkin/kin-openapi-0.131.0
  • dependabot/go_modules/github.com/go-chi/chi/v5-5.2.2
  • dependabot/go_modules/github.com/go-jose/go-jose/v3-3.0.4
  • dependabot/go_modules/github.com/golang-jwt/jwt/v4-4.5.1
  • dependabot/go_modules/github.com/golang-jwt/jwt/v4-4.5.2
  • dependabot/go_modules/github.com/golang-jwt/jwt/v5-5.2.2
  • dependabot/go_modules/github.com/rs/cors-1.11.0
  • dependabot/go_modules/go_modules-03c8d65c28
  • dependabot/go_modules/go_modules-c0992384b1
  • dependabot/go_modules/go_modules-d07b0ecb09
  • dependabot/go_modules/go_modules-f8d2715201
  • dependabot/go_modules/golang.org/x/crypto-0.31.0
  • dependabot/go_modules/golang.org/x/net-0.23.0
  • dependabot/go_modules/golang.org/x/net-0.36.0
  • dependabot/go_modules/golang.org/x/net-0.38.0
  • dependabot/go_modules/golang.org/x/oauth2-0.27.0
  • depthfirst_ca0b1547f77f5261458a6e91ca2ccb2c0e907ca7_51bc5a6e525fb336543098af32316e68
  • depthfirst_effd66245bd981ba5a07aa6b7441ad37578f9b73_c9fe0adfec1c4c0e63a2388cdc8d50a6
  • development
  • dnywh/auth-email-health-default-copy
  • docs-1710-verify-type-options
  • docs-anon-login-configs
  • docs/documentation-cleanup
  • docs/prodsec-104
  • docs/remove-unused-env-var
  • esinx-naver-provider
  • etienne/auth-1421
  • etienne/auth-1550
  • etienne/cors-allowed-origins
  • etienne/current_password_check_recovery
  • etienne/prodsec-126-ardvark-auth-03
  • etienne/prodsec-189
  • etienne/prodsec-231
  • etienne/prodsec-259
  • etienne/prodsec-76
  • etienne/prodsec-97-auth-sup-02-012
  • etienne/prodsec-99-auth-sup-02-014
  • etienne/sec-666-pin-all-github-actions-to-full-commit-sha
  • etienne/sec-865
  • feat-slack-oauth-v2
  • feat/add-email-metrics
  • feat/alphanumeric-otp
  • feat/client-ip-forwarding
  • feat/comma-separated-header-keys
  • feat/cursor-mcp-oauth-support
  • feat/facebook-access-token-grant
  • feat/facebook-access-token-grant-link-identity
  • feat/min-jwt
  • feat/mx-blocklist
  • feat/prodsec-228
  • feat/solana-ledger
  • feat/token-endpoint-auth-method-enforcement
  • feat_docker_compose_and_go
  • feature/snapchat-oauth
  • figma-auth
  • fix--oauth-redirect-parsing
  • fix-binary-name
  • fix-contributing-md
  • fix-magiclink-requiredchars
  • fix/2430-phone-change-ambiguous-user
  • fix/after-user-created-fires-on-every-oauth-signin
  • fix/darwin-arm64-release-goos
  • fix/firebase-scrypt-base64-encoding
  • fix/notification-templates-siteurl
  • fix/oauth-offline-access-scope
  • fix/oauth-token-endpoint-auth-method
  • fix/oauth-token-endpoint-rfc6749-errors
  • fix/otp-signup-respects-min-password-length
  • fix/redirect-url-empty-authority
  • fix/replay-race-2026-07-02
  • fix/revoked-in-find-token
  • fix/update-sanitize-signup
  • fix/valid-methods-parsing
  • fix_contributing_typo
  • fixups
  • fm/add-darwin-arm64-build-target
  • fm/auth-1101-passkeys-discoverable-credentials
  • fm/auth-1102-passkeys-management-endpoints
  • fm/auth-1104-pk-admin-endpts
  • fm/auth-1106-aaguid-friendly-name
  • fm/auth-1111-passkeys-captcha-on-auth
  • fm/auth-1112-pk-auth-rl
  • fm/auth-1154-oriole-tests
  • fm/auth-1155-identities-ordering
  • fm/auth-1156-order-independent-tests-sso-providers
  • fm/auth-1157-skip-index-worker-on-oriole
  • fm/auth-1227
  • fm/auth-1228-delete-pk-on-soft-delete
  • fm/auth-1235-banned-user-token
  • fm/auth-1332
  • fm/auth-1337
  • fm/auth-1402
  • fm/auth-1415
  • fm/auth-1424
  • fm/auth-1428
  • fm/auth-1433
  • fm/auth-1526
  • fm/auth-1527
  • fm/auth-1528
  • fm/auth-1529
  • fm/auth-1530
  • fm/auth-1531
  • fm/auth-1532
  • fm/auth-1533
  • fm/auth-1534
  • fm/auth-1534-b
  • fm/auth-1535
  • fm/auth-1536
  • fm/auth-1589
  • fm/auth-1590
  • fm/auth-1593
  • fm/auth-969-state-param
  • fm/auth-982
  • fm/bump-deps
  • fm/bump-go-1.25.10
  • fm/bump-go-1.25.11
  • fm/bump-go-1.26.6
  • fm/bump-webauthn-lib-version
  • fm/create-email-identity-on-password-set
  • fm/fix-flaky-idx-worker-test
  • fm/fix-go-sec-errors
  • fm/fix-govuln-issues
  • fm/fix-make-deps-errors
  • fm/go-version-lint
  • fm/gosec-fixes
  • fm/govuln-fixes
  • fm/ignore-amd64-bin
  • fm/index-worker-threshold-config
  • fm/multigres-tests
  • fm/oapi-codegen-deps
  • fm/passkey-api-req-res-cleanup
  • fm/passkeys
  • fm/pin-oriole
  • fm/prodsec-103
  • fm/prodsec-69-mfa-webauthn-config
  • fm/prodsec-88
  • fm/remove-unused-audit-events
  • fm/use-provider-constants
  • fm/use-truncate-to-avoid-index-corruption
  • fm/warn-on-invalid-webauthn-config
  • go-1.27
  • hf/aao-in-send-email
  • hf/add-audit-log-disable-postgres
  • hf/add-authorized-email-addresses
  • hf/add-aws-kms-rs256
  • hf/add-azure-ciam
  • hf/add-exhaustive
  • hf/add-headers-to-issue-refresh-token
  • hf/add-magic-link-disable-toggle
  • hf/add-max-idle-time
  • hf/add-one-time-tokens
  • hf/add-support-for-argon2
  • hf/adjust-required-claims-in-auth-hooks
  • hf/artifact-bucket
  • hf/azure-overage-include-api-version
  • hf/bump-saml-0-5-1
  • hf/captcha-parsing-fix
  • hf/change-s3-role
  • hf/chore-fix-gha-perms
  • hf/chore-release-as-2-165-2
  • hf/ci-alpine-3
  • hf/ci-dogofooding-checks-on-release
  • hf/ci-fast-release-tarball
  • hf/ci-fix-binary-version-docker
  • hf/ci-fix-coverage-metering
  • hf/ci-fix-dogfooding
  • hf/ci-fix-dogfooding-take-2
  • hf/clean-up-master
  • hf/cover-crypto-100
  • hf/db-advisor
  • hf/email-less-accounts-with-oauth
  • hf/email-rate-limiting-new-config
  • hf/encrypt-sensitive-columns
  • hf/encrypted-password-pointer
  • hf/experimental-provider-linking-domains
  • hf/external-host-validation
  • hf/fail-empty-address
  • hf/fallback-to-jwt-secret-if-unknown-kid
  • hf/feat-bump-new-version
  • hf/feat-embedded-migrations
  • hf/fix-apple-oidc-issuer-change
  • hf/fix-argon2
  • hf/fix-authenticate-empty-string
  • hf/fix-azure-large-groups
  • hf/fix-claim-overages-json-azure
  • hf/fix-coveralls-image
  • hf/fix-custom-sms-twilio-verify
  • hf/fix-expose-x-supabase-api-version-header-in-cors
  • hf/fix-gosec-siwe
  • hf/fix-id-token-permission
  • hf/fix-idempotent-logout
  • hf/fix-identity-email-verified
  • hf/fix-invalid-url-thing
  • hf/fix-local-dockerfile
  • hf/fix-mail-headers
  • hf/fix-mfa-config-backward-compatibility
  • hf/fix-mfa-verify-rt-v2
  • hf/fix-new-oidc-provider-apple
  • hf/fix-redirect-empty-hostname
  • hf/fix-redirect-ip-address
  • hf/fix-secret-api-key-ignore-aud-claim
  • hf/fix-session-upgrade-percentage
  • hf/fix-solana-localhost
  • hf/fix-strip-version
  • hf/fix-supafast
  • hf/fix-timeout-writer
  • hf/fix-write-header
  • hf/fix-write-header-deadlock
  • hf/gomft
  • hf/hook-log
  • hf/inline-mailme
  • hf/limit-low-aal-sessions
  • hf/link-identity-oidc
  • hf/log-json-error-response
  • hf/mail-headers
  • hf/merge-metadata
  • hf/mfa-rt-2-counter-2
  • hf/more-fix-rt-2
  • hf/move-email-sms-send-out-of-update-user-transaction
  • hf/new-rt
  • hf/openid-configuration
  • hf/phase-ii-ott
  • hf/redirect-url-fragment
  • hf/remove-data-migrations
  • hf/revert-azure-claim-overages
  • hf/saml-array-values
  • hf/saml-encrypted-assertions
  • hf/saml-specific-external-url
  • hf/separate-web3-rate-limits-from-other-token
  • hf/skip-apple-issuer-check-oidc
  • hf/snap
  • hf/split-words-audit-log
  • hf/supafast-tarball
  • hf/support-apple-transfer-sub
  • hf/test-release
  • hf/try-to-run-release-please-again
  • hf/ubuntu-latest
  • hf/upgrade-refresh-tokens-v2
  • hf/upload-artifacts-to-s3
  • hf/use-redirect-url
  • hf/vercel-global-user-id
  • hf/x-sb-error-code
  • iat/align-notifications-defaults
  • iat/async-index-creation
  • iat/auth-840-phone-number-changed-notification
  • iat/auth-841-identity-linked-notifications
  • iat/auth-842-email-send-hooks-for-notifications
  • iat/auth-906-auth-trgm
  • iat/auth-916-remove-text-pattern-ops-idx
  • iat/auth-954-remove-trgm-ext
  • iat/bump-go-version-docker
  • iat/email-changed-notification
  • iat/idx-worker-structured-logging
  • iat/mfa-enrollment-notifications
  • iat/password-changed-notification
  • iat/remove-create-extension-pg-trgm
  • iat/x-provider
  • j0/accurately_affect_max_frequency_limit
  • j0/add_additional_info_around_mime_type_error
  • j0/add_context_to_load_factor
  • j0/add_custom_email_sender_hook
  • j0/add_has_factor_claim
  • j0/add_hook_trigger_logic
  • j0/add_last_challenged_at
  • j0/add_mfa_phone_openapi_spec
  • j0/add_mfa_sms
  • j0/add_scrypt_password_hash
  • j0/add_timeout_middleware
  • j0/add_token_for_non_secure_email_change
  • j0/add_twilio_verify_support_for_mfa_phone
  • j0/add_webauthn
  • j0/add_webauthn_config
  • j0/adjust_mfa_status_codes
  • j0/allow_kong_and_edge_functions
  • j0/allow_only_one_phone_factor
  • j0/allow_postgres_and_http_on_extensibility_point
  • j0/backport_auth_namespace_to_enums
  • j0/change_mfa_error_code
  • j0/check_for_phone_identity_on_phone_chang
  • j0/custom_email_hook
  • j0/deprecate_mfa_enabled_config
  • j0/drop_uniqueness_constraint_on_mfa_phone
  • j0/fido2_authenticator_challenge_verify_model
  • j0/fix_email_change_with_phone_auth
  • j0/fix_migration_idempotent_phone_cnfig
  • j0/fix_rc_duplicate_identifier
  • j0/fixes_while_testing
  • j0/forbid_access_token_issuance_without_session
  • j0/hide_hook_name
  • j0/merge_aal_and_amr_update
  • j0/mfa_refactor_load_factor
  • j0/minor_speling_error
  • j0/move_totp_mfa_to_dedicated_fn
  • j0/move_verification_into_mailer_package
  • j0/patch_secure_email_change
  • j0/phone_mfa_refactors
  • j0/prevent_panic_on_email_change
  • j0/publish_to_ghcr
  • j0/refactor_generate_access_token
  • j0/refactor_generate_access_token_to_accept_request
  • j0/remove_deprecated_code
  • j0/remove_find_factors_by_user
  • j0/remove_find_session_by_id
  • j0/remove_set_cookie_tokens
  • j0/remove_totp_field_for_phone_response
  • j0/rename_to_send_sms
  • j0/require_appropriate_aal_for_pw_update
  • j0/return_factor_type_in_challenge
  • j0/send_over_user_in_send_sms_hook
  • j0/update_auth_functions
  • j0/update_error_code_id_token
  • j0/update_hook_schema
  • j0/update_mfa_error_message
  • j0/update_openapi_schema
  • j0/update_openapi_spec
  • j0/update_phone_admin_methods
  • j0/upgrade-contrib-docs
  • j0/upgrade_go_version
  • j0/upgrade_otel_deps
  • j0/validate_send_email
  • j0/webauthn_fixes
  • janek/signup-identities-email-verified
  • km/add-error-codes
  • km/add-error-codes-password-login
  • km/add-ip-based-limits
  • km/add-saml-tests
  • km/alter-auth-uid
  • km/bump-alpine-go
  • km/check-empty-aud
  • km/chore-remove-unused-hook-outputs
  • km/cleanup-anonymous-users
  • km/feat-asymmetric-jwt-support
  • km/fix-admin-update-user
  • km/fix-amr-mfa
  • km/fix-anonymous-user-linking
  • km/fix-attribute-mapping
  • km/fix-auth-hook-error
  • km/fix-auth-hooks
  • km/fix-authorized-emails
  • km/fix-authorized-middleware-check
  • km/fix-cleanup-logging
  • km/fix-context-cancellation
  • km/fix-custom-sms-hook-config
  • km/fix-email-verified
  • km/fix-enable-rls
  • km/fix-external-state
  • km/fix-figma
  • km/fix-ignore-rate-limits-for-autoconfirm
  • km/fix-improve-session-error
  • km/fix-jwt
  • km/fix-linkedin-oidc-issuer
  • km/fix-logging
  • km/fix-mailer-config
  • km/fix-max-password-length-error
  • km/fix-mfa-factors-index
  • km/fix-panic-logout
  • km/fix-panic-refresh-token
  • km/fix-pkce-verify-post
  • km/fix-rate-limit-log-level
  • km/fix-return-error-code
  • km/fix-saml-assertion
  • km/fix-search-path
  • km/fix-serve
  • km/fix-shared-limiter
  • km/fix-signup-generate-link
  • km/fix-signup-verify
  • km/fix-timeout-write-header
  • km/fix-update-attribute-mapping
  • km/fix-update-phone
  • km/fix-update-user
  • km/fix-update-user-email
  • km/fix-update-user-phone-change
  • km/fix-use-factor-id
  • km/format-test-otps
  • km/hotfix-jwt-aud
  • km/improve-logging
  • km/improve-mfa-verify-logs
  • km/improve-saml-logging
  • km/improve-token-oidc-logging
  • km/inactivity-session-bug
  • km/normalise-emails
  • km/phase-iii-ott
  • km/redirect-invalid-state
  • km/ref-retrieve-request-params
  • km/remove-unused-args
  • km/return-identity
  • km/return-session-not-found-error
  • km/update-admin-create-user
  • km/update-chi-version
  • km/update-ci
  • km/update-error-message
  • km/update-golang-jwt
  • km/update-mailme
  • km/update-oapi
  • km/v2.157.1
  • line-oidc
  • oidc-iss-checks
  • omerhochman/fix-linkedin-iodc-error
  • optional_2fa
  • or/bearer_ci
  • or/fallback-on-btree-when-hash-unavailable
  • or/query_reduction
  • or/test-twitter-oauth
  • patch-1
  • push-wnvwkqmwrrtk
  • refs/tags/rc2.170.0-rc.10
  • refs/tags/v2.186.0
  • refs/tags/v2.187.0
  • refs/tags/v2.188.1
  • refs/tags/v2.190.0
  • refs/tags/v2.191.0
  • refs/tags/v2.192.0
  • refs/tags/v2.193.1
  • refs/tags/v2.194.0
  • refs/tags/v2.195.0
  • refs/tags/v2.197.0
  • release-please--branches--cs/test-release-please
  • release-please--branches--master
  • release/2.165.0
  • remove-instance-id-queries
  • remove-redundant-method-hookuri-param
  • revert-1534-omerhochman/fix-linkedin-iodc-error
  • revert-1616-km/alter-auth-uid
  • revert-1812-hf/artifact-bucket
  • revert-1856-or/fallback-on-btree-when-hash-unavailable
  • revert-1858-revert-1856-or/fallback-on-btree-when-hash-unavailable
  • revert-2239-iat/async-index-creation
  • sam/packaged-auth
  • scim
  • scim/1-migrations
  • scim/2-core
  • scim/3-users
  • sec-601-password-change-function
  • simplify-request-tracing-middleware-setup-logic
  • single-source-of-truth-for-waitforcleanup
  • siwe-implementation
  • snyk-fix-0720ecd3bfe1e766e52214a3bbab15f5
  • timkendrick/fix-saml-client-entity-id
  • tom/amd64x2
  • update-docker-container-name
  • update-md-for-resend-endpont
  • upgrade-github-actions-node24
  • upgrade-github-actions-node24-general
  • vercel-marketplace-oidc
  • xlg/chi-v5.3.0
  • xlg/ci-go-mod-tidy
  • xlg/docs
  • xlg/go-mod-tidy
  • xlg/go-tidy
  • xlg/golangci-lint
  • xlg/golangci-lint-build
  • xlg/x/crypto
  • xlg/x/mod
  • xlgmokha/auth-1289
  • xlgmokha/auth-1309
  • xlgmokha/auth-1361
  • xlgmokha/auth-1362
  • xlgmokha/auth-1362a
  • xlgmokha/auth-1362b
  • xlgmokha/auth-1362c
  • xlgmokha/auth-1362d
  • xlgmokha/auth-1362e
  • xlgmokha/auth-1368a
  • xlgmokha/auth-1368b
  • xlgmokha/auth-1369
  • xlgmokha/auth-1369b
  • xlgmokha/auth-1494
  • xlgmokha/context-key-refactor
  • xlgmokha/fix-docker-dev-build
  • xlgmokha/go-2026-6061
  • xlgmokha/json-builder-tests
  • xlgmokha/scim-protocol-errors
  • xlgmokha/upgrade-x-text

21 Sep 2026 04:27PM UTC coverage: 71.673% (+0.001%) from 71.672%
35625721653

push

github

web-flow
fix: only trigger after-user-created hook on account creation (#2656)

## What kind of change does this PR introduce?

Bug fix.

## What is the current behavior?

The external OAuth callback sets `createdUser = true` unconditionally,
discarding the `models.AccountLinkingDecision`. That branch handles
every OAuth sign-in, so `after-user-created` also fires for
`AccountExists` (returning user) and `LinkAccount` (new identity on an
existing user). Hook side effects therefore repeat on every sign-in, and
since the hook's error propagates out of the callback, a hook that
rejects a duplicate user breaks all OAuth sign-ins.

## What is the new behavior?

`createdUser` is gated on `decision == models.CreateAccount`, matching
the existing call sites in `token_oidc.go`, `web3.go` and `samlacs.go`.

## Additional context

Two regression tests in `ExternalTestSuite` cover the `AccountExists`
and `LinkAccount` paths.

3 of 3 new or added lines in 1 file covered. (100.0%)

16669 of 23257 relevant lines covered (71.67%)

496.26 hits per line

Relevant lines Covered
Build:
Build:
23257 RELEVANT LINES 16669 COVERED LINES
496.26 HITS PER LINE
Source Files on master
  • Tree
  • List 208
  • Changed 1
  • Source Changed 0
  • Coverage Changed 1
Coverage ∆ File Lines Relevant Covered Missed Hits/Line

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
35625721653 master fix: only trigger after-user-created hook on account creation (#2656) ## What kind of change does this PR introduce? Bug fix. ## What is the current behavior? The external OAuth callback sets `createdUser = true` unconditionally, discarding th... push 21 Sep 2026 04:33PM UTC web-flow github
71.67
35622283244 master chore(deps): bump oapi-codegen to v2.8.0 and regenerate admin client push 21 Sep 2026 04:01PM UTC fadymak github
71.67
35617409748 master feat(openapi): document mfa recovery codes endpoints push 21 Sep 2026 03:17PM UTC fadymak github
71.67
35616276741 master chore: silence git describe errors in Docker make deps (#2823) Silences the errors from running `make deps` locally and in CI: ``` => [auth 6/8] RUN make deps ... push 21 Sep 2026 03:07PM UTC web-flow github
71.67
35616231916 master fix(mfa): ignore verify-disabled factors in recovery codes guard (#2824) When a user has a second factor enrolled but verification has been disabled at the configuration level, we should not allow the enrollment of recovery codes as that would ma... push 21 Sep 2026 03:07PM UTC web-flow github
71.67
35377958896 master feat(otp): handle test OTPs and Twilio Verify on the one_time_tokens path (#2798) Implementing the TestOTP + Twilio Verify logic that were intentionally deferred in https://github.com/supabase/auth/pull/2788. ## What kind of change does this PR ... push 18 Sep 2026 06:09PM UTC web-flow github
71.66
35368409400 master feat(otp): switch one_time_tokens table to source of truth (#2788) ## What kind of change does this PR introduce? Feat ## What is the current behavior? We dual-write token data to the `one_time_tokens` and `users` table, but read token data from... push 18 Sep 2026 04:30PM UTC web-flow github
71.55
35354476053 master feat(otp): add one_time_tokens query helpers (#2797) ## What kind of change does this PR introduce? Feature ## What is the current behavior? There is no single-query lookup for a token hash and its `pkce_`-prefixed form, and no lookup by `relate... push 18 Sep 2026 02:15PM UTC web-flow github
71.42
35318676274 master fix(sessions): invalidate legacy sessions with null aal (#2792) push 18 Sep 2026 07:23AM UTC web-flow github
71.39
35318704867 master fix(mfa): regenerate duplicate recovery codes (#2793) push 18 Sep 2026 07:22AM UTC web-flow github
71.4
See All Builds (2445)

Badge your Repo: auth

We detected this repo isn’t badged! Grab the embed code to the right, add it to your repo to show off your code coverage, and when the badge is live hit the refresh button to remove this message.

Could not find badge in README.

Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

Refresh
  • Settings
  • Repo on GitHub
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE TRIAL · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc