- 
- )}
- 
-
-
-
-
-
+
+ )
+}
+
+const GuidesSidebar = ({
+ className,
+ video,
+ hideToc,
+}: {
+ className?: string
+ video?: string
+ hideToc?: boolean
+}) => {
+ const pathname = usePathname()
+ const { toc } = useTocAnchors()
+ const showFeedback = isFeatureEnabled('feedback:docs')
+ const tocVideoPreview = `https://img.youtube.com/vi/${video}/0.jpg`
+
+ return (
+ `). **This is the default for confidential clients.** | Confidential clients |
-| `client_secret_post` | Client credentials sent in the request body (`client_id` and `client_secret` as form parameters). | Confidential clients |
+| Method | Description | Used by |
+| --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- |
+| `none` | No client authentication. Only `client_id` is sent in the request body. | Public clients (required) |
+| `client_secret_basic` | Client credentials sent via HTTP Basic auth (`Authorization: Basic `). **This is the default for confidential clients.** | Confidential clients |
+| `client_secret_post` | Client credentials sent in the request body (`client_id` and `client_secret` as form parameters). | Confidential clients |
**Defaults:** Public clients default to `none`. Confidential clients default to `client_secret_basic` (per [RFC 7591](https://datatracker.ietf.org/doc/html/rfc7591#section-2)).
diff --git a/apps/docs/content/guides/auth/server-side/creating-a-client.mdx b/apps/docs/content/guides/auth/server-side/creating-a-client.mdx
index b02a37ad8fd..3ba089193d4 100644
--- a/apps/docs/content/guides/auth/server-side/creating-a-client.mdx
+++ b/apps/docs/content/guides/auth/server-side/creating-a-client.mdx
@@ -463,8 +463,8 @@ export async function loader({ request }: LoaderFunctionArgs) {
return parseCookieHeader(request.headers.get('Cookie') ?? '')
},
setAll(cookiesToSet) {
- cookiesToSet.forEach(({ name, value }) =>
- headers.append('Set-Cookie', serializeCookieHeader(name, value))
+ cookiesToSet.forEach(({ name, value, options }) =>
+ headers.append('Set-Cookie', serializeCookieHeader(name, value, options))
)
},
},
@@ -497,8 +497,8 @@ export async function action({ request }: ActionFunctionArgs) {
return parseCookieHeader(request.headers.get('Cookie') ?? '')
},
setAll(cookiesToSet) {
- cookiesToSet.forEach(({ name, value }) =>
- headers.append('Set-Cookie', serializeCookieHeader(name, value))
+ cookiesToSet.forEach(({ name, value, options }) =>
+ headers.append('Set-Cookie', serializeCookieHeader(name, value, options))
)
},
},
diff --git a/apps/docs/content/guides/auth/sessions.mdx b/apps/docs/content/guides/auth/sessions.mdx
index 1b79d9f8d66..c7eac35d2bf 100644
--- a/apps/docs/content/guides/auth/sessions.mdx
+++ b/apps/docs/content/guides/auth/sessions.mdx
@@ -69,7 +69,7 @@ Otherwise sessions are progressively deleted from the database 24 hours after th
### What are recommended values for access token (JWT) expiration?
-Most applications should use the default expiration time of 1 hour. This can be customized in your project's [Auth settings](/dashboard/project/_/settings/jwt) in the Advanced Settings section.
+Most applications should use the default expiration time of 1 hour. This can be customized in your [project's settings](/dashboard/project/_/settings/jwt/legacy) in the JWT Keys > Legacy JWT Secret section.
Setting a value over 1 hour is generally discouraged for security reasons, but it may make sense in certain situations.
diff --git a/apps/docs/content/guides/database/extensions/pg_partman.mdx b/apps/docs/content/guides/database/extensions/pg_partman.mdx
new file mode 100644
index 00000000000..de2db96c9c0
--- /dev/null
+++ b/apps/docs/content/guides/database/extensions/pg_partman.mdx
@@ -0,0 +1,95 @@
+---
+id: 'pg_partman'
+title: 'pg_partman: partition management'
+description: 'Automated partition management'
+---
+
+[`pg_partman`](https://github.com/pgpartman/pg_partman) is a Postgres extension that automates the creation and maintenance of partitions for tables using Postgres native partitioning.
+
+## Enable the extension
+
+To enable `pg_partman`, create a dedicated schema for it and enable the extension there.
+
+{/* prettier-ignore */}
+```sql
+create schema if not exists partman;
+create extension if not exists pg_partman with schema partman;
+```
+
+## Create a partitioned table
+
+`pg_partman` requires your parent table to already be declared as a partitioned table.
+
+{/* prettier-ignore */}
+```sql
+create table public.messages (
+ id bigint generated by default as identity,
+ sent_at timestamptz not null,
+ sender_id uuid,
+ recipient_id uuid,
+ body text,
+ primary key (sent_at, id)
+)
+partition by range (sent_at);
+```
+
+## Set up partitioning
+
+You configure the parent table using `partman.create_parent()`. The function takes an `ACCESS EXCLUSIVE` lock briefly while it creates the initial partitions.
+
+### Time-based partitions
+
+{/* prettier-ignore */}
+```sql
+select partman.create_parent(
+ p_parent_table := 'public.messages',
+ p_control := 'sent_at',
+ p_type := 'range',
+ p_interval := '7 days',
+ p_premake := 7,
+ p_start_partition := '2025-01-01 00:00:00'
+);
+```
+
+### Integer-based partitions
+
+{/* prettier-ignore */}
+```sql
+create table public.events (
+ id bigint generated by default as identity,
+ inserted_at timestamptz not null default now(),
+ payload jsonb,
+ primary key (id)
+)
+partition by range (id);
+
+select partman.create_parent(
+ p_parent_table := 'public.events',
+ p_control := 'id',
+ p_type := 'range',
+ p_interval := '100000'
+);
+```
+
+## Running maintenance
+
+It’s important to call `pg_partman` maintenance regularly so future partitions are pre-created and retention policies are applied.
+
+{/* prettier-ignore */}
+```sql
+call partman.run_maintenance_proc();
+```
+
+To automate this, schedule it using `pg_cron`.
+
+{/* prettier-ignore */}
+```sql
+create extension if not exists pg_cron;
+
+select
+ cron.schedule('@hourly', $$call partman.run_maintenance_proc()$$);
+```
+
+## Resources
+
+- Official [pg_partman documentation](https://github.com/pgpartman/pg_partman/blob/development/doc/pg_partman.md)
diff --git a/apps/docs/content/guides/database/extensions/timescaledb.mdx b/apps/docs/content/guides/database/extensions/timescaledb.mdx
index 8ca28081578..a3aa0303646 100644
--- a/apps/docs/content/guides/database/extensions/timescaledb.mdx
+++ b/apps/docs/content/guides/database/extensions/timescaledb.mdx
@@ -8,6 +8,10 @@ description: 'Scalable time-series data storage and analysis'
The `timescaledb` extension is deprecated in projects using Postgres 17. It continues to be supported in projects using Postgres 15, but will need to dropped before those projects are upgraded to Postgres 17. See the [Upgrading to Postgres 17 notes](/docs/guides/platform/upgrading#upgrading-to-postgres-17) for more information.
+If you are using hypertables, follow the [migration guide](/docs/guides/database/migrating-to-pg-partman) to convert to native partitioning managed by `pg_partman`.
+
+For additional support, contact our Success team by creating a support ticket in the Supabase Dashboard.
+
[`timescaledb`](https://docs.timescale.com/timescaledb/latest/) is a Postgres extension designed for improved handling of time-series data. It provides a scalable, high-performance solution for storing and querying time-series data on top of a standard Postgres database.
diff --git a/apps/docs/content/guides/database/migrating-to-pg-partman.mdx b/apps/docs/content/guides/database/migrating-to-pg-partman.mdx
new file mode 100644
index 00000000000..55243113dcd
--- /dev/null
+++ b/apps/docs/content/guides/database/migrating-to-pg-partman.mdx
@@ -0,0 +1,113 @@
+---
+id: 'migrating-from-timescaledb-to-pg-partman'
+title: 'Migrate from TimescaleDB to pg_partman'
+description: 'Convert TimescaleDB hypertables to Postgres native partitions managed by pg_partman.'
+---
+
+Starting from Postgres 17, Supabase projects do not have the `timescaledb` extension available. If your project relies on TimescaleDB hypertables, you will need to migrate to standard Postgres tables before upgrading.
+
+This guide shows one approach to migrate a hypertable to a native Postgres partitioned table and optionally configure `pg_partman` to automate ongoing partition maintenance.
+The approach outlined in this guide can also be used for traditional partitioned tables.
+
+## Before you begin
+
+- Test the migration path in a staging environment (for example by creating a copy of your production project or using branching).
+- Review your application for TimescaleDB-specific SQL usage (for example `time_bucket()`, compression policies). Those features are not provided by `pg_partman`.
+
+## Migration overview
+
+1. Create a new partitioned table.
+2. Copy data from the hypertable to the new table.
+3. Swap over and drop the hypertable.
+4. Configure `pg_partman` (optional) and schedule maintenance.
+
+## Example: Migrate `messages` from hypertable to native partitions
+
+This example assumes a `messages` hypertable partitioned by `sent_at`.
+
+### 1. Rename the existing hypertable
+
+This keeps the original data in place while you create a new partitioned table with the original name.
+
+{/* prettier-ignore */}
+```sql
+alter table public.messages rename to ht_messages;
+```
+
+### 2. Create a new partitioned table
+
+When using native partitioning, the partitioning column must be included in any unique index (including the primary key).
+
+{/* prettier-ignore */}
+```sql
+create table public.messages (
+ like public.ht_messages including all,
+ primary key (sent_at, id)
+)
+partition by range (sent_at);
+```
+
+### 3. Copy data into the new table
+
+For large tables, consider copying in batches (for example by time range) during a maintenance window.
+
+{/* prettier-ignore */}
+```sql
+insert into public.messages
+select *
+from public.ht_messages;
+```
+
+### 4. Drop the old hypertable (and TimescaleDB)
+
+Only drop the extension once you’ve migrated all hypertables and no other objects depend on it.
+
+{/* prettier-ignore */}
+```sql
+drop table public.ht_messages;
+
+drop extension if exists timescaledb;
+```
+
+### 5. Configure `pg_partman` (optional)
+
+Enable `pg_partman` and register your table so partitions are created ahead of time.
+
+{/* prettier-ignore */}
+```sql
+create schema if not exists partman;
+create extension if not exists pg_partman with schema partman;
+
+select partman.create_parent(
+ p_parent_table := 'public.messages',
+ p_control := 'sent_at',
+ p_type := 'range',
+ p_interval := '7 days',
+ p_premake := 7,
+ p_start_partition := '2025-01-01 00:00:00'
+);
+```
+
+## Keep partitions up to date
+
+`pg_partman` requires running maintenance to pre-make partitions and apply retention policies.
+
+{/* prettier-ignore */}
+```sql
+call partman.run_maintenance_proc();
+```
+
+To automate this, schedule it with `pg_cron`.
+
+{/* prettier-ignore */}
+```sql
+create extension if not exists pg_cron;
+
+select cron.schedule('@daily', $$call partman.run_maintenance_proc()$$);
+```
+
+## Additional resources
+
+- [Partitioning your tables](/docs/guides/database/partitions).
+- [`pg_partman` documentation](/docs/guides/database/extensions/pg_partman)
+- [`pg_partman` migration guides](https://github.com/pgpartman/pg_partman/blob/development/doc/migrate_to_partman.md)
diff --git a/apps/docs/content/guides/getting-started/tutorials/with-refine.mdx b/apps/docs/content/guides/getting-started/tutorials/with-refine.mdx
index 2f7b929dd28..553d0f02105 100644
--- a/apps/docs/content/guides/getting-started/tutorials/with-refine.mdx
+++ b/apps/docs/content/guides/getting-started/tutorials/with-refine.mdx
@@ -15,91 +15,60 @@ If you get stuck while working through this guide, refer to the [full example on
## About Refine
-[Refine](https://github.com/refinedev/refine) is a React-based framework used to rapidly build data-heavy applications like admin panels, dashboards, storefronts and any type of CRUD apps. It separates app concerns into individual layers, each backed by a React context and respective provider object. For example, the auth layer represents a context served by a specific set of [`authProvider`](https://refine.dev/docs/tutorial/understanding-authprovider/index/) methods that carry out authentication and authorization actions such as logging in, logging out, getting roles data, etc. Similarly, the data layer offers another level of abstraction that is equipped with [`dataProvider`](https://refine.dev/docs/tutorial/understanding-dataprovider/index/) methods to handle CRUD operations at appropriate backend API endpoints.
+[Refine](https://github.com/refinedev/refine) is a React-based framework used to rapidly build data-heavy applications like admin panels, dashboards, storefronts and any type of CRUD apps. It separates app concerns into individual layers, each backed by a React context and respective provider object. For example, the auth layer represents a context served by a specific set of [`authProvider`](https://refine.dev/docs/tutorial/understanding-authprovider/index/) methods that carry out authentication and authorization actions such as logging in, logging out, getting roles data, etc. Similarly, the data layer offers another level of abstraction equipped with [`dataProvider`](https://refine.dev/docs/tutorial/understanding-dataprovider/index/) methods to handle CRUD operations at appropriate backend API endpoints.
-Refine provides hassle-free integration with Supabase backend with its supplementary [`@refinedev/supabase`](https://github.com/refinedev/refine/tree/main/packages/supabase) package. It generates `authProvider` and `dataProvider` methods at project initialization, so we don't need to expend much effort to define them ourselves. We just need to choose Supabase as our backend service while creating the app with `create refine-app`.
-
-
-
-It is possible to customize the `authProvider` for Supabase and as we'll see below, it can be tweaked from `src/authProvider.ts` file. In contrast, the Supabase `dataProvider` is part of `node_modules` and therefore is not subject to modification.
-
-
+Refine provides hassle-free integration with a Supabase backend with its supplementary [`@refinedev/supabase`](https://github.com/refinedev/refine/tree/main/packages/supabase) package. It generates `authProvider` and `dataProvider` methods at project initialization, so you don't need to spend much effort defining them yourself, choose Supabase as the backend service while creating the app with `create refine-app`.
<$Partial path="project_setup.mdx" variables={{ "framework": "refine", "tab": "frameworks" }} />
## Building the app
-Let's start building the Refine app from scratch.
+Start building the Refine app from scratch.
### Initialize a Refine app
-We can use [create refine-app](https://refine.dev/docs/tutorial/getting-started/headless/create-project/#launch-the-refine-cli-setup) command to initialize
+Use [create refine-app](https://refine.dev/docs/tutorial/getting-started/headless/create-project/#launch-the-refine-cli-setup) command to initialize
an app. Run the following in the terminal:
```bash
npm create refine-app@latest -- --preset refine-supabase
```
-In the above command, we are using the `refine-supabase` preset which chooses the Supabase supplementary package for our app. We are not using any UI framework, so we'll have a headless UI with plain React and CSS styling.
+The command above uses the `refine-supabase` preset which chooses the Supabase supplementary package for the app. There's no UI framework, so the app has a headless UI with plain React and CSS styling.
The `refine-supabase` preset installs the `@refinedev/supabase` package which out-of-the-box includes the Supabase dependency: [supabase-js](https://github.com/supabase/supabase-js).
-We also need to install `@refinedev/react-hook-form` and `react-hook-form` packages that allow us to use [React Hook Form](https://react-hook-form.com) inside Refine apps. Run:
+Install the `@refinedev/react-hook-form` and `react-hook-form` packages that to use [React Hook Form](https://react-hook-form.com) inside Refine apps. Run:
```bash
npm install @refinedev/react-hook-form react-hook-form
```
-With the app initialized and packages installed, at this point before we begin discussing Refine concepts, let's try running the app:
-
-```bash
-cd app-name
-npm run dev
-```
-
-We should have a running instance of the app with a Welcome page at `http://localhost:5173`.
-
-Let's move ahead to understand the generated code now.
-
### Refine `supabaseClient`
-The `create refine-app` generated a Supabase client for us in the `src/utility/supabaseClient.ts` file. It has two constants: `SUPABASE_URL` and `SUPABASE_KEY`. We want to replace them as `supabaseUrl` and `supabasePublishableKey` respectively and assign them our own Supabase server's values.
+The `create refine-app` generated a Supabase client in the `src/utility/supabaseClient.ts` file. It has two constants: `SUPABASE_URL` and `SUPABASE_KEY`. Replace them as `supabaseUrl` and `supabasePublishableKey` respectively and assign them your Supabase server's values.
-We'll update it with environment variables managed by Vite:
+Update it with environment variables managed by Vite:
-<$CodeTabs>
+<$CodeSample
+path="/user-management/refine-user-management/src/utility/supabaseClient.ts"
+lines={[[1, -1]]}
+meta="name=src/utility/supabaseClient.ts"
+/>
-```ts name=src/utility/supabaseClient.ts
-import { createClient } from '@refinedev/supabase'
-
-const supabaseUrl = import.meta.env.VITE_SUPABASE_URL
-const supabasePublishableKey = import.meta.env.VITE_SUPABASE_PUBLISHABLE_KEY
-
-export const supabaseClient = createClient(supabaseUrl, supabasePublishableKey, {
- db: {
- schema: 'public',
- },
- auth: {
- persistSession: true,
- },
-})
-```
-
-
-
-And then, we want to save the environment variables in a `.env.local` file. All you need are the API URL and the key that you copied [earlier](#get-api-details).
+Save the environment variables in a `.env.local` file. All you need are the API URL and the key that you copied [earlier](#get-api-details).
```bash .env.local
VITE_SUPABASE_URL=YOUR_SUPABASE_URL
VITE_SUPABASE_PUBLISHABLE_KEY=YOUR_SUPABASE_PUBLISHABLE_KEY
```
-The `supabaseClient` will be used in fetch calls to Supabase endpoints from our app. As we'll see below, the client is instrumental in implementing authentication using Refine's auth provider methods and CRUD actions with appropriate data provider methods.
+The `supabaseClient` fetches calls to Supabase endpoints from the app. The client is instrumental in implementing authentication using Refine's auth provider methods and CRUD actions with appropriate data provider methods.
One optional step is to update the CSS file `src/App.css` to make the app look nice.
You can find the full contents of this file [here](https://raw.githubusercontent.com/supabase/supabase/master/examples/user-management/refine-user-management/src/App.css).
-In order for us to add login and user profile pages in this App, we have to tweak the `()
-
- const { mutate: logOut } = useLogout()
-
- const {
- refineCore: { formLoading, query, onFinish },
- register,
- control,
- handleSubmit,
- } = useForm({
- refineCoreProps: {
- resource: 'profiles',
- action: 'edit',
- id: userIdentity?.id,
- redirect: false,
- onMutationError: (data) => alert(data?.message),
- },
- })
-
- return (
-
-
-
-
-
-
-
-
- )
-}
-
-export default App
-```
-
-
-
-Let's test the App by running the server again:
+Test the App by running the server again:
```bash
npm run dev
@@ -511,153 +223,24 @@ Every Supabase project is configured with [Storage](/docs/guides/storage) for ma
### Create an upload widget
-Let's create an avatar for the user so that they can upload a profile photo. We can start by creating a new component:
+Create an avatar for the user so that they can upload a profile photo. Add a new component:
Create and edit `src/components/avatar.tsx`:
-<$CodeTabs>
-
-```tsx name=src/components/avatar.tsx
-import { useEffect, useState } from 'react'
-import { supabaseClient } from '../utility/supabaseClient'
-
-type TAvatarProps = {
- url?: string
- size: number
- onUpload: (filePath: string) => void
-}
-
-export default function Avatar({ url, size, onUpload }: TAvatarProps) {
- const [avatarUrl, setAvatarUrl] = useState('')
- const [uploading, setUploading] = useState(false)
-
- useEffect(() => {
- if (url) downloadImage(url)
- }, [url])
-
- async function downloadImage(path: string) {
- try {
- const { data, error } = await supabaseClient.storage.from('avatars').download(path)
- if (error) {
- throw error
- }
- const url = URL.createObjectURL(data)
- setAvatarUrl(url)
- } catch (error: any) {
- console.log('Error downloading image: ', error?.message)
- }
- }
-
- async function uploadAvatar(event: React.ChangeEvent) {
- try {
- setUploading(true)
-
- if (!event.target.files || event.target.files.length === 0) {
- throw new Error('You must select an image to upload.')
- }
-
- const file = event.target.files[0]
- const fileExt = file.name.split('.').pop()
- const fileName = `${Math.random()}.${fileExt}`
- const filePath = `${fileName}`
-
- const { error: uploadError } = await supabaseClient.storage
- .from('avatars')
- .upload(filePath, file)
-
- if (uploadError) {
- throw uploadError
- }
- onUpload(filePath)
- } catch (error: any) {
- alert(error.message)
- } finally {
- setUploading(false)
- }
- }
-
- return (
-
Retrieve a project's secrets
Retrieve a project's pgsodium config | | `Secrets` | `Write` | Create or update a project's secrets
Update a project's pgsodium configuration | +| `Storage` | `Read` | Retrieve a project's storage buckets. | +| | diff --git a/apps/docs/content/guides/platform/backups.mdx b/apps/docs/content/guides/platform/backups.mdx index 55b43ec5041..a08c9585ebf 100644 --- a/apps/docs/content/guides/platform/backups.mdx +++ b/apps/docs/content/guides/platform/backups.mdx @@ -1,75 +1,39 @@ --- title: 'Database Backups' -description: 'Learn about the available backup methods for your Supabase project.' +description: 'Learn about backups for your Supabase project.' --- -Database backups are an integral part of any disaster recovery plan. Disasters come in many shapes and sizes. It could be as simple as accidentally deleting a table column, the database crashing, or even a natural calamity wiping out the underlying hardware a database is running on. The risks and impact brought by these scenarios can never be fully eliminated, but only minimized or even mitigated. Having database backups is a form of insurance policy. They are essentially snapshots of the database at various points in time. When disaster strikes, database backups allow the project to be brought back to any of these points in time, therefore averting the crisis. +We automatically back up all Free, Pro, Team, and Enterprise Plan projects on a daily basis. You can find backups in the [**Database** > **Backups**](/dashboard/project/_/database/backups/scheduled) section of the Dashboard. -
+Pro Plan projects can access the last 7 days of daily backups. Team Plan projects can access the last 14 days of daily backups, while Enterprise Plan projects can access up to 30 days of daily backups. If you need more frequent backups, consider enabling [Point-in-Time Recovery](#point-in-time-recovery). We recommend that free tier plan projects regularly export their data using the [Supabase CLI `db dump` command](/docs/reference/cli/supabase-db-dump) and maintain off-site backups.
-The Supabase team regularly monitors the status of backups. In case of any issues, you can [contact support](/dashboard/support/new). Also you can check out our [status page](https://status.supabase.com/) at any time.
+
+
+When you delete a project, we permanently remove all associated data, including any backups stored in S3. This action is irreversible, so consider it carefully before proceeding.
+
+
+
+
+
+For security purposes, daily backups do not store passwords for custom roles, and you will not find them in downloadable files. If you restore from a daily backup and use custom roles, you will need to reset their passwords after the restoration completes.
-Once a project is deleted all associated data will be permanently removed, including any backups stored in S3. This action is irreversible and should be carefully considered before proceeding.
+Database backups do not include objects you store via the Storage API, as the database only includes metadata about these objects. Restoring an old backup does not restore objects you deleted after that backup.
-## Types of backups
+## Backup and restore process
-Database backups can be categorized into two types: **logical** and **physical**. You can learn more about them [here](/blog/postgresql-physical-logical-backups).
+You can access daily backups in the [**Database** > **Backups**](/dashboard/project/_/database/backups/scheduled) section of the Dashboard and restore a project to any of the backups.
-
+You can restore your project to any of the backups. To generate a logical backup yourself, use the [Supabase CLI `db dump` command](/docs/reference/cli/supabase-db-dump).
-To enable physical backups, you have three options:
+## Managing backups programmatically
-- Enable [Point-in-Time Recovery (PITR)](#point-in-time-recovery)
-- [Increase your database size](/docs/guides/platform/database-size) to greater than 15GB
-- [Create a read replica](/docs/guides/platform/read-replicas)
-
-Once a project satisfies at least one of the requirements for physical backups then logical backups are no longer made. However, your project may revert back to logical backups if you remove add-ons.
-
-
-
-You can confirm your project's backup type by navigating to [**Database Backups > Scheduled backups**](/dashboard/project/_/database/backups/scheduled) and if you can download a backup then it is logical, otherwise it is physical.
-
-However, if your project has the Point-in-Time Recovery (PITR) add-on then the backups are physical and you can view them in [Database Backups > Point in time](/dashboard/project/_/database/backups/pitr).
-
-## Frequency of backups
-
-When deciding how often a database should be backed up, the key business metric Recovery Point Objective (RPO) should be considered. RPO is the threshold for how much data, measured in time, a business could lose when disaster strikes. This amount is fully dependent on a business and its underlying requirements. A low RPO would mean that database backups would have to be taken at an increased cadence throughout the day. Each Supabase project has access to two forms of backups, Daily Backups and Point-in-Time Recovery (PITR). The agreed upon RPO would be a deciding factor in choosing which solution best fits a project.
-
-
-
-If you enable PITR, Daily Backups will no longer be taken. PITR provides a finer granularity than Daily Backups, so it's unnecessary to run both.
-
-
-
-
-
-Database backups do not include objects stored via the Storage API, as the database only includes metadata about these objects. Restoring an old backup does not restore objects that have been deleted since then.
-
-
-
-## Daily backups
-
-All Pro, Team and Enterprise Plan Supabase projects are backed up automatically on a daily basis. In terms of Recovery Point Objective (RPO), Daily Backups would be suitable for projects willing to lose up to 24 hours worth of data if disaster hits at the most inopportune time. If a lower RPO is required, enabling Point-in-Time Recovery should be considered.
-
-
-
-For security purposes, passwords for custom roles are not stored in daily backups, and will not be found in downloadable files. As such, if you are restoring from a daily backup and are using custom roles, you will need to set their passwords once more following a completed restoration.
-
-
-
-### Backup process [#daily-backups-process]
-
-The Postgres utility [pg_dumpall](https://www.postgresql.org/docs/current/app-pg-dumpall.html) is used to perform daily backups. An SQL file is generated, zipped up, and sent to our storage servers for safe keeping.
-
-You can access daily backups in the [Scheduled backups](/dashboard/project/_/database/backups/scheduled) settings in the Dashboard. Pro Plan projects can access the last 7 days' worth of daily backups. Team Plan projects can access the last 14 days' worth of daily backups, while Enterprise Plan projects can access up to 30 days' worth of daily backups. Users can restore their project to any one of the backups. If you wish to generate a logical backup on your own, you can do so through the [Supabase CLI](/docs/reference/cli/supabase-db-dump).
-
-You can also manage backups programmatically using the Management API:
+You can also manage backups programmatically [using the Management API](/docs/reference/api/v1-list-all-backups):
```bash
# Get your access token from https://supabase.com/dashboard/account/tokens
@@ -80,7 +44,7 @@ export PROJECT_REF="your-project-ref"
curl -H "Authorization: Bearer $SUPABASE_ACCESS_TOKEN" \
"https://api.supabase.com/v1/projects/$PROJECT_REF/database/backups"
-# Restore from a PITR (not logical) backup (replace ISO timestamp with desired restore point)
+# Restore from a PITR backup (replace Unix timestamp with desired restore point)
curl -X POST "https://api.supabase.com/v1/projects/$PROJECT_REF/database/backups/restore-pitr" \
-H "Authorization: Bearer $SUPABASE_ACCESS_TOKEN" \
-H "Content-Type: application/json" \
@@ -89,126 +53,87 @@ curl -X POST "https://api.supabase.com/v1/projects/$PROJECT_REF/database/backups
}'
```
-#### Backup process for large databases
+### Restoration process
-Databases larger than 15GB[^1], if they're on a recent build[^2] of the Supabase platform, get automatically transitioned[^3] to use daily physical backups. Physical backups are a more performant backup mechanism that lowers the overhead and impact on the database being backed up, and also avoids holding locks on objects in your database for a long period of time. While restores are unaffected, the backups created using this method cannot be downloaded from the Backups section of the dashboard.
+When selecting a backup to restore to, choose the closest available backup made before your desired restore point. You can always choose earlier backups, but consider how many days of data you might lose.
-This class of physical backups only allows for recovery to a fixed time each day, similar to daily backups. You can upgrade to [PITR](#point-in-time-recovery) for access to more granular recovery options.
+The Dashboard prompts you for confirmation before proceeding with the restoration. The project is inaccessible during this process, so plan for downtime beforehand. Downtime depends on the size of the database—the larger it is, the longer the downtime will be.
-Once a database is transitioned to using physical backups, it continues to use physical backups, even if the database size falls back below the threshold for the transition.
+After you confirm, we trigger the process to restore the desired backup data to your project. The dashboard will display a notification once the restoration completes.
-[^1]: The threshold for transitioning will be slowly lowered over time. Eventually, all projects will be transitioned to using physical backups.
-[^2]: Projects created or upgraded after the 14th of July 2022 are eligible.
-[^3]: The transition to physical backups is handled transparently and does not require any user intervention. It involves a single restart of the database to pick up new configuration that can only be loaded at start; the expected downtime for the restart is a few seconds.
-
-### Restoration process [#daily-backups-restoration-process]
-
-When selecting a backup to restore to, select the closest available one made before the desired point in time to restore to. Earlier backups can always be chosen too but do consider the number of days' worth of data that could be lost.
-
-The Dashboard will then prompt for a confirmation before proceeding with the restoration. The project will be inaccessible following this. As such, do ensure to allot downtime beforehand. This is dependent on the size of the database. The larger it is, the longer the downtime will be. Once the confirmation has been given, the underlying SQL of the chosen backup is then run against the project. The Postgres utility [psql](https://www.postgresql.org/docs/current/app-psql.html) is used to facilitate the restoration. The Dashboard will display a notification once the restoration completes.
-
-If your project is using subscriptions or replication slots, you will need to drop them prior to the restoration, and re-create them afterwards. The slot used by Realtime is exempted from this, and will be handled automatically.
+If your project uses subscriptions or replication slots, you need to drop them before the restoration and re-create them afterwards. We exempt the slot used by Realtime from this requirement and handle it automatically.
{/* screenshot of the Dashboard of the project completing restoration */}
## Point-in-Time recovery
-Point-in-Time Recovery (PITR) allows a project to be backed up at much shorter intervals. This provides users an option to restore to any chosen point of up to seconds in granularity. Even with daily backups, a day's worth of data could still be lost. With PITR, backups could be performed up to the point of disaster.
+Point-in-Time Recovery (PITR) allows you to back up a project at shorter intervals, giving you the option to restore to any chosen point with up to seconds of granularity. Even with daily backups, you could still lose a day's worth of data. With PITR, you can back up to the point of disaster.
Pro, Team and Enterprise Plan projects can enable PITR as an add-on.
-Projects interested in PITR will also need to use at least a Small compute add-on, in order to ensure smooth functioning.
+Projects that want to use PITR must also use at least a Small compute add-on to ensure smooth functioning.
+
+
+
-If you enable PITR, Daily Backups will no longer be taken. PITR provides a finer granularity than Daily Backups, so it's unnecessary to run both.
+If you enable PITR, we will no longer take Daily Backups. PITR provides finer granularity than Daily Backups, so running both is unnecessary.
-When you disable PITR, all new backups will still be taken as physical backups only. Physical backups can still be used for restoration, but they are not available for direct download. If you need to download a backup after PITR is disabled, you’ll need to take a manual [logical backup using the Supabase CLI or pg_dump](/docs/guides/platform/migrating-within-supabase/backup-restore#backup-database-using-the-cli).
-
-
-
-If PITR has been disabled, logical backups remain available until they pass the backup retention period for your plan. After that window passes, only physical backups will be shown.
-
-
-
-### Backup process [#pitr-backup-process]
-
-As discussed [here](/blog/postgresql-physical-logical-backups), PITR is made possible by a combination of taking physical backups of a project, as well as archiving [Write Ahead Log (WAL)](https://www.postgresql.org/docs/current/wal-intro.html) files. Physical backups provide a snapshot of the underlying directory of the database, while WAL files contain records of every change made in the database.
-
-Supabase uses [WAL-G](https://github.com/wal-g/wal-g), an open source archival and restoration tool, to handle both aspects of PITR. On a daily basis, a snapshot of the database is taken and sent to our storage servers. Throughout the day, as database transactions occur, WAL files are generated and uploaded.
-
-By default, WAL files are backed up at two minute intervals. If these files cross a certain file size threshold, they are backed up immediately. As such, during periods of high amount of transactions, WAL file backups become more frequent. Conversely, when there is no activity in the database, WAL file backups are not made. Overall, this would mean that at the worst case scenario or disaster, the PITR achieves a Recovery Point Objective (RPO) of two minutes.
+### Backup process
-You can access PITR in the [Point in Time](/dashboard/project/_/database/backups/pitr) settings in the Dashboard. The recovery period of a project is indicated by the earliest and latest points of recoveries displayed in your preferred timezone. If need be, the maximum amount of this recovery period can be modified accordingly.
+You can access PITR in the [Point in Time](/dashboard/project/_/database/backups/pitr) settings in the Dashboard. The recovery period of a project is shown by the earliest and latest recovery points displayed in your preferred timezone. You can change the maximum recovery period if needed.
-Note that the latest restore point of the project could be significantly far from the current time. This occurs when there has not been any recent activity in the database, and therefore no WAL file backups have been made recently. This is perfectly fine as the state of the database at the latest point of recovery would still be indicative of the state of the database at the current time given that no transactions have been made in between.
+The latest restore point of the project could be significantly behind the current time. This occurs when the database has had no recent activity, and therefore we have not made any recent WAL file backups. However, the state of the database at the latest recovery point still reflects the current state of the database, given that no transactions have occurred in between.
-### Restoration process [#pitr-restoration-process]
+### Restoration process
-A date and time picker will be provided upon pressing the `Start a restore` button. The process will only proceed if the selected date and time fall within the earliest and latest points of recoveries.
+A date and time picker appears when you click the **Start a restore** button. The process only proceeds if the selected date and time fall within the earliest and latest recovery points.
-After locking in the desired point in time to recover to, The Dashboard will then prompt for a review and confirmation before proceeding with the restoration. The project will be inaccessible following this. As such, do ensure to allot for downtime beforehand. This is dependent on the size of the database. The larger it is, the longer the downtime will be. Once the confirmation has been given, the latest physical backup available is downloaded to the project and the database is partially restored. WAL files generated after this physical backup up to the specified point-in-time are then downloaded. The underlying records of transactions in these files are replayed against the database to complete the restoration. The Dashboard will display a notification once the restoration completes.
+After selecting your desired recovery point, the Dashboard prompts you to review and confirm before proceeding with the restoration. The project is inaccessible during this process, so plan for downtime beforehand. Downtime depends on the size of the database—the larger it is, the longer the downtime will be. After you confirm, we download the latest available physical backup to the project and partially restore the database. We then download the WAL files generated after this physical backup up to your specified point in time. We replay the underlying transaction records in these files against the database to complete the restoration. The Dashboard will display a notification once the restoration completes.
<$Show if="billing:all">
<$Partial path="billing/pricing/pricing_pitr.mdx" />
+### Downloading backups after disabling PITR
+
+When you disable PITR, we still take all new backups as physical backups only. You can still use physical backups for restoration, but they are not available for direct download. If you need to download a backup after disabling PITR, you need to take a manual [legacy logical backup using the Supabase CLI or pg_dump](/docs/guides/platform/migrating-within-supabase/backup-restore#backup-database-using-the-cli).
+
## Restore to a new project
See the [Duplicate Project docs](/docs/guides/platform/clone-project).
-
-## Troubleshooting
-
-### Logical backups
-
-#### `search_path` issues
-
-During the `pg_restore` process, the `search_path` is set to an empty string for predictability, and security. Using unqualified references to functions or relations can cause restorations using logical backups to fail, as the database will not be able to locate the function or relation being referenced. This can happen even if the database functions without issues during normal operations, as the `search_path` is usually set to include several schemas during normal operations. Therefore, you should always use schema-qualified names within your SQL code.
-
-You can refer to [an example PR](https://github.com/supabase/supabase/pull/28393/files) on how to update SQL code to use schema-qualified names.
-
-#### Invalid check constraints
-
-Postgres requires that [check constraints](https://www.postgresql.org/docs/current/ddl-constraints.html#DDL-CONSTRAINTS-CHECK-CONSTRAINTS) be:
-
-1. immutable
-1. not reference table data other than the new or updated row being checked
-
-Violating these requirements can result in numerous failure scenarios, including during logical restorations.
-
-Common examples of check constraints that can result in such failures are:
-
-- validating against the current time, e.g. that the row being inserted references a future event
-- validating the contents of a row against the contents of another table
-
-#### Views that reference themselves
-
-Views that directly or indirectly reference themselves will cause logical restores to fail due to cyclic dependency errors. These views are also invalid and unusable in Postgres, and any query against them will result in a runtime error.
-
-**Example:**
-
-```
--- Direct self-reference
-CREATE VIEW my_view AS
- SELECT * FROM my_view;
-
--- Indirect circular reference
-CREATE VIEW v1 AS SELECT * FROM v2;
-CREATE VIEW v2 AS SELECT * FROM v1;
-```
-
--- Drop the offending view from your database, or delete them from the logical backup to make it restorable.
-
-Postgres documentation [views](https://www.postgresql.org/docs/current/sql-createview.html)
diff --git a/apps/docs/content/guides/platform/manage-your-usage/log-drains.mdx b/apps/docs/content/guides/platform/manage-your-usage/log-drains.mdx
index dac00f80c61..fef7ebb55fc 100644
--- a/apps/docs/content/guides/platform/manage-your-usage/log-drains.mdx
+++ b/apps/docs/content/guides/platform/manage-your-usage/log-drains.mdx
@@ -36,7 +36,7 @@ Usage is shown as "Log Drain Hours" on your invoice.
### Pricing
-Log Drains are available as a project Add-On for all Team and Enterprise users. Each Log Drain costs
-The public flag (the last argument in `realtime.send(payload, event, topic, is_private))` only affects who can subscribe to the topic not who can read messages from the database.
+The public flag (the last argument in `realtime.send(payload, event, topic, is_private)`) only affects who can subscribe to the topic not who can read messages from the database.
-- Public (false) → Anyone can subscribe to that topic without authentication
-- Private (true) → Only authenticated clients can subscribe to that topic
+- Public (`false`) → Anyone can subscribe to that topic without authentication
+- Private (`true`) → Only authenticated clients can subscribe to that topic
-However, regardless of whether it's public or private, the Realtime service connects to your database as the authenticated Supabase Admin role.
+Regardless if it's public or private, the Realtime service connects to your database as the authenticated Supabase Admin role.
-For Authorization we insert a message and try to read it, and rollback the transaction to verify that the RLS policies set by the user are being respected by the user joining the channel, but this message isn't sent to the user. You can read more about it in the [Authorization docs](/docs/guides/realtime/authorization).
+For Authorization, we insert a message and try to read it, and rollback the transaction to verify that the Row Level Security (RLS) policies set by the user are being respected by the user joining the channel, but this message isn't sent to the user. You can read more about it in [Authorization](/docs/guides/realtime/authorization).
## Subscribe to messages
@@ -132,9 +132,9 @@ In most cases, you can get the correct key from [the Project's **Connect** dialo
-### Receiving Broadcast messages
+### Receive Broadcast messages
-You can provide a callback for the `broadcast` channel to receive messages. This example will receive any `broadcast` messages that are sent to `test-channel`:
+You can receive Broadcast messages by providing a callback to the channel.
-The realtime.send function in the database includes a flag that determines whether the broadcast is private or public, and client channels also have the same configuration. For broadcasts to work correctly, these settings must match a public broadcast will only reach public channels, and a private broadcast will only reach private ones.
+The `realtime.send()` function in the database includes a flag that determines whether the broadcast is private or public, and client channels also have the same configuration. For broadcasts to work correctly, these settings must match. A public broadcast only reaches public channels and a private broadcast only reaches private channels.
-By default, all database broadcasts are private, meaning clients must authenticate to receive them. If the database sends a public message but the client subscribes to a private channel, the message won't be delivered since private channels only accept signed, authenticated messages.
+By default, all database broadcasts are private, meaning clients must authenticate to receive them. If the database sends a public message but the client subscribes to a private channel, the message is not delivered because private channels only accept signed, authenticated messages.
-It's a common use case to broadcast messages when a record is created, updated, or deleted. We provide a helper function specific to this use case, `realtime.broadcast_changes()`. For more details, check out the [Subscribing to Database Changes](/docs/guides/realtime/subscribing-to-database-changes) guide.
+You can use the `realtime.broadcast_changes()` helper function to broadcast messages when a record is created, updated, or deleted. For more details, read [Subscribing to Database Changes](/docs/guides/realtime/subscribing-to-database-changes).
### Broadcast using the REST API
@@ -685,7 +685,7 @@ You can pass configuration options while initializing the Supabase Client.
>
- You can confirm that the Realtime servers have received your message by setting Broadcast's `ack` config to `true`.
+ You can confirm that the Realtime servers have received your message by setting Broadcast's `ack` setting to `true`.
{/* prettier-ignore */}
```js
@@ -881,20 +881,20 @@ You can also send a Broadcast message by making an HTTP request to Realtime serv
### How it works
-Broadcast Changes allows you to trigger messages from your database. To achieve it Realtime is directly reading your WAL (Write Append Log) file using a publication against the `realtime.messages` table so whenever a new insert happens a message is sent to connected users.
+Broadcast Changes allows you to trigger messages from your database. To achieve it, Realtime directly reads your Write-Ahead Log (WAL) file using a publication against the `realtime.messages` table. Whenever a new insert occurs, a message is sent to connected users.
-It uses partitioned tables per day which allows the deletion your previous messages in a performant way by dropping the physical tables of this partitioned table. Tables older than 3 days old are deleted.
+It uses partitioned tables per day, which allows performant deletion of your previous messages by dropping the physical tables of this partitioned table. Tables older than 3 days are deleted.
-Broadcasting from the database works like a client-side broadcast, using WebSockets to send JSON packages. [Realtime Authorization](/docs/guides/realtime/authorization) is required and enabled by default to protect your data.
+Broadcasting from the database works like a client-side broadcast, using WebSockets to send JSON payloads. [Realtime Authorization](/docs/guides/realtime/authorization) is required and enabled by default to protect your data.
-The database broadcast feature provides two functions to help you send messages:
+Broadcast Changes provides two functions to help you send messages:
-- `realtime.send` will insert a message into realtime.messages without a specific format.
-- `realtime.broadcast_changes` will insert a message with the required fields to emit database changes to clients. This helps you set up triggers on your tables to emit changes.
+- `realtime.send()` inserts a message into `realtime.messages` without a specific format.
+- `realtime.broadcast_changes()` inserts a message with the required fields to emit database changes to clients. This helps you set up triggers on your tables to emit changes.
### Broadcasting a message from your database
-The `realtime.send` function provides the most flexibility by allowing you to broadcast messages from your database without a specific format. This allows you to use database broadcast for messages that aren't necessarily tied to the shape of a Postgres row change.
+The `realtime.send()` function provides the most flexibility by allowing you to broadcast messages from your database without a specific format. This allows you to use database broadcast for messages that aren't necessarily tied to the shape of a Postgres row change.
```sql
SELECT realtime.send (
@@ -909,7 +909,7 @@ SELECT realtime.send (
#### Setup realtime authorization
-Realtime Authorization is required and enabled by default. To allow your users to listen to messages from topics, create an RLS (Row Level Security) policy:
+Realtime Authorization is required and enabled by default. To allow your users to listen to messages from topics, create an RLS policy:
```sql
CREATE POLICY "authenticated can receive broadcasts"
@@ -920,13 +920,13 @@ USING ( true );
```
-See the [Realtime Authorization](/docs/guides/realtime/authorization) docs to learn how to set up more specific policies.
+Read [Realtime Authorization](/docs/guides/realtime/authorization) to learn how to set up more specific policies.
#### Set up trigger function
-First, set up a trigger function that uses `realtime.broadcast_changes` to insert an event whenever it is triggered. The event is set up to include data on the schema, table, operation, and field changes that triggered it.
+First, set up a trigger function that uses the `realtime.broadcast_changes()` function to insert an event whenever it is triggered. The event is set up to include data on the schema, table, operation, and field changes that triggered it.
-For this example use case, we want to have a topic with the name `topic:` to which we're going to broadcast events.
+For this example, you're going broadcast events to a topic named `topic:`.
```sql
CREATE OR REPLACE FUNCTION public.your_table_changes()
@@ -948,7 +948,7 @@ END;
$$ LANGUAGE plpgsql;
```
-Of note are the Postgres native trigger special variables used:
+The Postgres native trigger special variables used are:
- `TG_OP` - the operation that triggered the function
- `TG_TABLE_NAME` - the table that caused the trigger
@@ -1000,7 +1000,7 @@ Broadcast Replay enables **private** channels to access messages that were sent
You can configure replay with the following options:
-- **`since`** (Required): The epoch timestamp in milliseconds (e.g., `1697472000000`), specifying the earliest point from which messages should be retrieved.
+- **`since`** (Required): The epoch timestamp in milliseconds (for example, `1697472000000`), specifying the earliest point from which messages should be retrieved.
- **`limit`** (Optional): The number of messages to return. This must be a positive integer, with a maximum value of 25.
:8000` | Base URL for accessing Supabase from the Internet |
-| `JWT_SECRET` | Your secret key | Legacy symmetric encryption key used to sign and verify JWTs |
-| `SUPABASE_ANON_KEY` | Your anon key | Client-side API key with limited permissions (`anon` role). |
-| `SUPABASE_SERVICE_ROLE_KEY` | Your service role key | Server-side API key with full database access (`service_role` role) |
-| `SUPABASE_DB_URL` | Postgres connection string | Can be used for direct database access |
+| Variable | Value | Purpose |
+| --------------------------- | --------------------------- | ------------------------------------------------------------------- |
+| `SUPABASE_URL` | `http://kong:8000` | Internal API gateway URL |
+| `SUPABASE_PUBLIC_URL` | `http://:8000` | Base URL for accessing Supabase from the Internet |
+| `JWT_SECRET` | Your secret key | Legacy symmetric encryption key used to sign and verify JWTs |
+| `SUPABASE_ANON_KEY` | Your anon key | Client-side API key with limited permissions (`anon` role). |
+| `SUPABASE_SERVICE_ROLE_KEY` | Your service role key | Server-side API key with full database access (`service_role` role) |
+| `SUPABASE_DB_URL` | Postgres connection string | Can be used for direct database access |
Here's an example function that queries a table using `@supabase/supabase-js`:
diff --git a/apps/docs/content/guides/self-hosting/self-hosted-oauth.mdx b/apps/docs/content/guides/self-hosting/self-hosted-oauth.mdx
new file mode 100644
index 00000000000..4297d06127c
--- /dev/null
+++ b/apps/docs/content/guides/self-hosting/self-hosted-oauth.mdx
@@ -0,0 +1,475 @@
+---
+title: 'Configure Social Login (OAuth) Providers'
+description: 'Set up social login (OAuth/OIDC) providers for self-hosted Supabase with Docker.'
+subtitle: 'Set up social login (OAuth/OIDC) providers for self-hosted Supabase with Docker.'
+---
+
+This guide covers the **server-side configuration** required to enable social login providers on a self-hosted Supabase instance running with Docker Compose. This applies to all OAuth and OIDC-based providers, including third-party identity providers like Keycloak.
+
+## Before you begin
+
+You need:
+
+- A working self-hosted Supabase installation. See [Self-Hosting with Docker](/docs/guides/self-hosting/docker).
+- `API_EXTERNAL_URL` set to the publicly reachable URL of your Supabase instance (e.g., `https://`).
+
+
+
+HTTPS is strongly recommended in production. Most OAuth providers reject `http://` callback URLs (except `localhost`).
+
+
+
+Your **OAuth callback URL** is built from `API_EXTERNAL_URL`. For example, if `API_EXTERNAL_URL` is `https://`, the callback URL will become:
+
+```
+https:///auth/v1/callback
+```
+
+You will have to register this URL with each OAuth provider.
+
+## OAuth request flow
+
+When a user signs in with an OAuth provider, the following flow occurs:
+
+1. Your app calls `supabase.auth.signInWithOAuth()` and the browser redirects to the Auth service
+2. API gateway (Kong) routes the request to the Auth container (`/auth/v1/authorize`)
+3. Auth redirects the user to the OAuth provider (e.g., Google) for consent
+4. The provider redirects back to `https:///auth/v1/callback`
+5. Auth exchanges the authorization code for tokens and redirects the user to your `SITE_URL` or an allowed redirect URL
+
+## Auth environment variables
+
+The Auth service (GoTrue) uses the prefix `GOTRUE_EXTERNAL_` followed by a provider name for all OAuth configuration. For example, when using Google:
+
+- `GOTRUE_EXTERNAL_GOOGLE_ENABLED`
+- `GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID`
+- `GOTRUE_EXTERNAL_GOOGLE_SECRET`
+- `GOTRUE_EXTERNAL_GOOGLE_REDIRECT_URI`
+
+## Step-by-step configuration
+
+The default `.env.example` and `docker-compose.yml` include commented-out placeholders for Google, GitHub, and Azure.
+
+### Step 1: Register your app with the provider
+
+1. Go to the OAuth provider's developer console and create an application.
+2. Set the **authorized redirect URL**, e.g., `https:///auth/v1/callback`
+3. Copy the **client ID** and **client secret** into your `.env` file.
+
+### Step 2: Configure variables in the `.env` file
+
+Uncomment the lines for your provider in `.env` and add your client ID and secret, e.g., for Google:
+
+```
+GOOGLE_ENABLED=true
+GOOGLE_CLIENT_ID=your-client-id
+GOOGLE_SECRET=your-client-secret
+```
+
+### Step 3: Enable the matching lines in `docker-compose.yml`
+
+Uncomment the corresponding `GOTRUE_EXTERNAL_` lines in the `auth` service's `environment`:
+
+```yaml
+auth:
+ environment:
+ # ... existing variables ...
+ GOTRUE_EXTERNAL_GOOGLE_ENABLED: ${GOOGLE_ENABLED}
+ GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID}
+ GOTRUE_EXTERNAL_GOOGLE_SECRET: ${GOOGLE_SECRET}
+ GOTRUE_EXTERNAL_GOOGLE_REDIRECT_URI: ${API_EXTERNAL_URL}/auth/v1/callback
+```
+
+
+
+For providers **not** pre-configured in the files (see the [full provider list](#other-supported-providers) below), add the lines manually following the same pattern: variables in `.env`, passthrough with `GOTRUE_EXTERNAL_PROVIDER_` in `docker-compose.yml`.
+
+
+
+### Step 4: Restart the auth service
+
+```sh
+docker compose up -d --force-recreate --no-deps auth
+```
+
+### Step 5: Verify the configuration
+
+Check that the provider is enabled:
+
+```sh
+curl -H 'apikey: your-anon-key' https:///auth/v1/settings
+```
+
+The response should include your provider under `external`:
+
+```
+{
+ "external": {
+ "google": true
+ }
+}
+```
+
+## Provider-specific setup
+
+
+
+
+
+**Google Cloud Console setup:**
+
+1. Go to [Google Cloud Console](https://console.cloud.google.com/)
+2. Create or select a project
+3. Select **Solutions** > **All products** in the navigation menu on the left
+4. Go to **APIs & services** > **OAuth consent screen** and click **Get started**
+5. Follow the configuration steps and add an **External** app
+6. Go to **APIs & Services** > **Credentials**
+7. Click **Create Credentials** > **OAuth client ID**
+8. Set application type to **Web application**
+9. Under **Authorized redirect URIs**, add: `https:///auth/v1/callback`
+10. Click **Create** and copy the client ID and client secret
+
+**`.env`:**
+
+```
+GOOGLE_ENABLED=true
+GOOGLE_CLIENT_ID=your-google-client-id.apps.googleusercontent.com
+GOOGLE_SECRET=your-google-client-secret
+```
+
+**`docker-compose.yml`:**
+
+```yaml
+auth:
+ environment:
+ # ... existing variables ...
+ GOTRUE_EXTERNAL_GOOGLE_ENABLED: ${GOOGLE_ENABLED}
+ GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID}
+ GOTRUE_EXTERNAL_GOOGLE_SECRET: ${GOOGLE_SECRET}
+ GOTRUE_EXTERNAL_GOOGLE_REDIRECT_URI: ${API_EXTERNAL_URL}/auth/v1/callback
+```
+
+
+
+
+
+**GitHub setup:**
+
+1. Go to [GitHub Developer Settings](https://github.com/settings/developers)
+2. Click **New OAuth app**
+3. Fill in **Homepage URL**, e.g., `https://`
+4. Set **Authorization callback URL** to: `https:///auth/v1/callback`
+5. Click **Register application**
+6. Copy the client ID, generate and copy a client secret
+
+**`.env`:**
+
+```
+GITHUB_ENABLED=true
+GITHUB_CLIENT_ID=your-github-client-id
+GITHUB_SECRET=your-github-client-secret
+```
+
+**`docker-compose.yml`:**
+
+```yaml
+auth:
+ environment:
+ # ... existing variables ...
+ GOTRUE_EXTERNAL_GITHUB_ENABLED: ${GITHUB_ENABLED}
+ GOTRUE_EXTERNAL_GITHUB_CLIENT_ID: ${GITHUB_CLIENT_ID}
+ GOTRUE_EXTERNAL_GITHUB_SECRET: ${GITHUB_SECRET}
+ GOTRUE_EXTERNAL_GITHUB_REDIRECT_URI: ${API_EXTERNAL_URL}/auth/v1/callback
+```
+
+
+
+
+
+**Azure Portal setup:**
+
+1. Go to [Azure Portal](https://portal.azure.com/)
+2. Go to **All services** > **Identity** > **App registrations** via the navigation menu on the left
+3. Click **New registration**
+4. Add application **Name**
+5. Under **Redirect URI**, select **Web** and enter: `https:///auth/v1/callback`
+6. Click **Register**
+7. Copy the **Application (client) ID**
+8. Click on **Client credentials** > **Add a certificate or secret**
+9. Click on **New client secret** and add a client secret
+10. Copy the secret value (not "secret ID")
+
+**`.env`:**
+
+```
+AZURE_ENABLED=true
+AZURE_CLIENT_ID=your-azure-application-client-id
+AZURE_SECRET=your-azure-client-secret
+## Optional: restrict to a specific tenant (defaults to 'common')
+# AZURE_URL=https://login.microsoftonline.com/your-tenant-id
+```
+
+**`docker-compose.yml`:**
+
+```yaml
+auth:
+ environment:
+ # ... existing variables ...
+ GOTRUE_EXTERNAL_AZURE_ENABLED: ${AZURE_ENABLED}
+ GOTRUE_EXTERNAL_AZURE_CLIENT_ID: ${AZURE_CLIENT_ID}
+ GOTRUE_EXTERNAL_AZURE_SECRET: ${AZURE_SECRET}
+ GOTRUE_EXTERNAL_AZURE_REDIRECT_URI: ${API_EXTERNAL_URL}/auth/v1/callback
+ ## Optional: uncomment for tenant-specific Azure login
+ # GOTRUE_EXTERNAL_AZURE_URL: ${AZURE_URL}
+```
+
+
+
+
+
+**Apple Developer setup:**
+
+1. Refer to [Apple Developer documentation](https://developer.apple.com/documentation/signinwithapple/configuring-your-environment-for-sign-in-with-apple) to learn how to enable App ID and create a Services ID
+2. Create a private key for sign in with Apple
+3. Generate a client secret JWT from your private key. See [Apple Developer documentation](https://developer.apple.com/documentation/accountorganizationaldatasharing/creating-a-client-secret) for details.
+
+**`.env`:**
+
+```
+APPLE_ENABLED=true
+APPLE_CLIENT_ID=com.example.your-services-id
+APPLE_SECRET=your-generated-jwt-client-secret
+```
+
+**`docker-compose.yml`:**
+
+```yaml
+auth:
+ environment:
+ # ... existing variables ...
+ GOTRUE_EXTERNAL_APPLE_ENABLED: ${APPLE_ENABLED}
+ GOTRUE_EXTERNAL_APPLE_CLIENT_ID: ${APPLE_CLIENT_ID}
+ GOTRUE_EXTERNAL_APPLE_SECRET: ${APPLE_SECRET}
+ GOTRUE_EXTERNAL_APPLE_REDIRECT_URI: ${API_EXTERNAL_URL}/auth/v1/callback
+```
+
+
+
+Apple uses `response_mode=form_post` for its OAuth flow. The Auth service handles this automatically - no additional configuration is needed.
+
+
+
+
+
+
+
+**Keycloak setup:**
+
+1. Open your Keycloak admin console
+2. Select (or create) the realm you want to use
+3. Go to **Clients** > **Create client**
+4. Set **Client type** to **OpenID Connect**
+5. Set **Client ID** (e.g., `supabase`)
+6. On the next screen, enable **Client authentication**
+7. Under **Valid redirect URIs**, add: `https:///auth/v1/callback`
+8. Save, then go to the **Credentials** tab and copy the **Client secret**
+
+**`.env` variables:**
+
+```
+KEYCLOAK_ENABLED=true
+KEYCLOAK_CLIENT_ID=supabase
+KEYCLOAK_SECRET=your-keycloak-client-secret
+## Required: your Keycloak realm URL
+KEYCLOAK_URL=https://keycloak.example.com/realms/myrealm
+```
+
+**`docker-compose.yml` passthrough:**
+
+```yaml
+auth:
+ environment:
+ # ... existing variables ...
+ GOTRUE_EXTERNAL_KEYCLOAK_ENABLED: ${KEYCLOAK_ENABLED}
+ GOTRUE_EXTERNAL_KEYCLOAK_CLIENT_ID: ${KEYCLOAK_CLIENT_ID}
+ GOTRUE_EXTERNAL_KEYCLOAK_SECRET: ${KEYCLOAK_SECRET}
+ GOTRUE_EXTERNAL_KEYCLOAK_REDIRECT_URI: ${API_EXTERNAL_URL}/auth/v1/callback
+ GOTRUE_EXTERNAL_KEYCLOAK_URL: ${KEYCLOAK_URL}
+```
+
+
+
+`KEYCLOAK_URL` is **required**. It must be the full realm URL (e.g., `https://keycloak.example.com/realms/myrealm`). The Auth service uses this to discover the OIDC endpoints (`.well-known/openid-configuration`). Without it, Keycloak login will not work.
+
+
+
+
+
+
+
+## Other supported providers
+
+Supabase Auth supports the following OAuth providers:
+
+| Provider | Env prefix | Additional variables | Docs |
+| ----------------- | ---------------- | ------------------------------- | --------------------------------------------------------------------- |
+| Apple | `APPLE_` | - | [Login with Apple](/docs/guides/auth/social-login/auth-apple) |
+| Azure (Microsoft) | `AZURE_` | `URL` (tenant URL) | [Login with Azure](/docs/guides/auth/social-login/auth-azure) |
+| Bitbucket | `BITBUCKET_` | - | [Login with Bitbucket](/docs/guides/auth/social-login/auth-bitbucket) |
+| Discord | `DISCORD_` | - | [Login with Discord](/docs/guides/auth/social-login/auth-discord) |
+| Facebook | `FACEBOOK_` | - | [Login with Facebook](/docs/guides/auth/social-login/auth-facebook) |
+| Figma | `FIGMA_` | - | [Login with Figma](/docs/guides/auth/social-login/auth-figma) |
+| GitHub | `GITHUB_` | `URL` (for GitHub Enterprise) | [Login with GitHub](/docs/guides/auth/social-login/auth-github) |
+| GitLab | `GITLAB_` | `URL` (for self-hosted GitLab) | [Login with GitLab](/docs/guides/auth/social-login/auth-gitlab) |
+| Google | `GOOGLE_` | - | [Login with Google](/docs/guides/auth/social-login/auth-google) |
+| Kakao | `KAKAO_` | - | [Login with Kakao](/docs/guides/auth/social-login/auth-kakao) |
+| Keycloak (OIDC) | `KEYCLOAK_` | `URL` (realm URL, **required**) | [Login with Keycloak](/docs/guides/auth/social-login/auth-keycloak) |
+| LinkedIn (OIDC) | `LINKEDIN_OIDC_` | - | [Login with LinkedIn](/docs/guides/auth/social-login/auth-linkedin) |
+| Notion | `NOTION_` | - | [Login with Notion](/docs/guides/auth/social-login/auth-notion) |
+| Slack (OIDC) | `SLACK_OIDC_` | - | [Login with Slack](/docs/guides/auth/social-login/auth-slack) |
+| Snapchat | `SNAPCHAT_` | - | - |
+| Spotify | `SPOTIFY_` | - | [Login with Spotify](/docs/guides/auth/social-login/auth-spotify) |
+| Twitch | `TWITCH_` | - | [Login with Twitch](/docs/guides/auth/social-login/auth-twitch) |
+| Twitter | `TWITTER_` | - | [Login with Twitter](/docs/guides/auth/social-login/auth-twitter) |
+| WorkOS | `WORKOS_` | - | [Login with WorkOS](/docs/guides/auth/social-login/auth-workos) |
+| Zoom | `ZOOM_` | - | [Login with Zoom](/docs/guides/auth/social-login/auth-zoom) |
+
+For each provider, you need at minimum `ENABLED`, `CLIENT_ID`, `SECRET`, and `REDIRECT_URI` in `.env` and `docker-compose.yml`.
+
+
+
+**LinkedIn (OIDC)** and **Slack (OIDC)** use multi-word env prefixes. The full Docker Compose variables are `GOTRUE_EXTERNAL_LINKEDIN_OIDC_CLIENT_ID` and `GOTRUE_EXTERNAL_SLACK_OIDC_CLIENT_ID` respectively - not `LINKEDIN_CLIENT_ID` or `SLACK_CLIENT_ID`.
+
+
+
+## Test the login flow
+
+You can test OAuth with the following minimal HTML page:
+
+- Save the code below to `index.html`
+- Start `python -m http.server 3000` in the same directory
+- Make sure `SITE_URL` is set to `http://localhost:3000` in your self-hosted Supabase `.env` configuration
+- Open your browser and go to `http://localhost:3000`
+
+```html
+
+
+
+
+
+`GOTRUE_EXTERNAL_SKIP_NONCE_CHECK` disables nonce validation on ID tokens, which weakens replay-attack protection. Treat it as a **short-lived troubleshooting workaround**, not a permanent fix:
+
+- Enable it only in the environment where you're debugging the issue.
+- Revert it as soon as the issue is resolved.
+- Prefer fixing the client-side nonce handling or switching to an OAuth flow (authorization code with PKCE) that avoids ID-token nonce issues entirely.
+
+
+
+To enable it, uncomment the following line in `docker-compose.yml`:
+
+```
+GOTRUE_EXTERNAL_SKIP_NONCE_CHECK: true
+```
+
+### Auth service fails to start
+
+Check the auth container logs:
+
+```sh
+docker compose logs auth
+```
+
+Common causes:
+
+- Missing required environment variable (e.g., `CLIENT_ID` or `SECRET` is empty)
+- Invalid `API_EXTERNAL_URL` (must be a valid URL with protocol)
+
+## Environment variable reference
+
+All OAuth-related environment variables for the `auth` service in `docker-compose.yml`:
+
+| Variable | Description | Required |
+| -------------------------------- | ------------------------------------------------------------------------ | -------- |
+| `GOTRUE_EXTERNAL_*_ENABLED` | Enable the provider (`true`/`false`) | Yes |
+| `GOTRUE_EXTERNAL_*_CLIENT_ID` | OAuth client ID from the provider | Yes |
+| `GOTRUE_EXTERNAL_*_SECRET` | OAuth client secret from the provider | Yes |
+| `GOTRUE_EXTERNAL_*_REDIRECT_URI` | Callback URL: `${API_EXTERNAL_URL}/auth/v1/callback` | Yes |
+| `GOTRUE_SITE_URL` | Default redirect URL after authentication (set via `SITE_URL` in `.env`) | Yes |
+
+## Additional resources
+
+- [Redirect URLs](/docs/guides/auth/redirect-urls)
+- [Auth server on GitHub](https://github.com/supabase/auth) (check README and `example.env`)
diff --git a/apps/docs/content/guides/self-hosting/self-hosted-phone-mfa.mdx b/apps/docs/content/guides/self-hosting/self-hosted-phone-mfa.mdx
new file mode 100644
index 00000000000..30d427e471f
--- /dev/null
+++ b/apps/docs/content/guides/self-hosting/self-hosted-phone-mfa.mdx
@@ -0,0 +1,225 @@
+---
+title: 'Configure Phone Login & MFA'
+description: 'Set up phone login SMS providers, OTP settings, and multi-factor authentication for self-hosted Supabase with Docker.'
+subtitle: 'Set up phone login SMS providers, OTP settings, and multi-factor authentication for self-hosted Supabase with Docker.'
+---
+
+This guide covers the **server-side configuration** for phone login and multi-factor authentication (MFA) on a self-hosted Supabase instance running with Docker Compose.
+
+For client-side implementation, see [Phone Login](/docs/guides/auth/phone-login) and [Multi-Factor Authentication](/docs/guides/auth/auth-mfa).
+
+## Before you begin
+
+You need:
+
+- A working self-hosted Supabase installation. See [Self-Hosting with Docker](/docs/guides/self-hosting/docker).
+- An account with an SMS provider (e.g., Twilio)
+
+Phone auth is **enabled by default** in the Docker setup (`ENABLE_PHONE_SIGNUP=true` in `.env`). However, without an SMS provider configured, the Auth service has no way to deliver OTP codes.
+
+## SMS provider configuration
+
+The default `.env.example` and `docker-compose.yml` include commented-out SMS provider placeholders. The example below uses Twilio - you'll need a Twilio account with an account SID, auth token, and message service SID. See [Twilio's documentation](https://www.twilio.com/docs/messaging) for how to obtain these credentials.
+
+To enable SMS delivery:
+
+### Step 1: Uncomment and configure the settings in `.env`
+
+```
+SMS_PROVIDER=twilio
+SMS_OTP_EXP=60
+SMS_OTP_LENGTH=6
+SMS_MAX_FREQUENCY=60s
+SMS_TEMPLATE=Your code is {{ .Code }}
+
+## Twilio credentials
+SMS_TWILIO_ACCOUNT_SID=your-account-sid
+SMS_TWILIO_AUTH_TOKEN=your-auth-token
+SMS_TWILIO_MESSAGE_SERVICE_SID=your-message-service-sid
+```
+
+### Step 2: Uncomment the matching lines in `docker-compose.yml`
+
+Uncomment the `GOTRUE_SMS_*` lines in the `auth` service's `environment` block:
+
+```yaml
+auth:
+ environment:
+ # ... existing variables ...
+ GOTRUE_SMS_PROVIDER: ${SMS_PROVIDER}
+ GOTRUE_SMS_OTP_EXP: ${SMS_OTP_EXP}
+ GOTRUE_SMS_OTP_LENGTH: ${SMS_OTP_LENGTH}
+ GOTRUE_SMS_MAX_FREQUENCY: ${SMS_MAX_FREQUENCY}
+ GOTRUE_SMS_TEMPLATE: ${SMS_TEMPLATE}
+ GOTRUE_SMS_TWILIO_ACCOUNT_SID: ${SMS_TWILIO_ACCOUNT_SID}
+ GOTRUE_SMS_TWILIO_AUTH_TOKEN: ${SMS_TWILIO_AUTH_TOKEN}
+ GOTRUE_SMS_TWILIO_MESSAGE_SERVICE_SID: ${SMS_TWILIO_MESSAGE_SERVICE_SID}
+```
+
+### Step 3: Restart the auth service
+
+```sh
+docker compose up -d --force-recreate --no-deps auth
+```
+
+### Step 4: Verify
+
+```sh
+docker compose exec auth env | grep GOTRUE_SMS
+```
+
+Confirm your provider and credentials appear in the output.
+
+
+
+For providers other than Twilio, add the provider-specific `GOTRUE_SMS_*` lines manually to `docker-compose.yml`.
+
+
+
+## OTP settings
+
+### Expiration
+
+
+
+The default OTP expiration is **60 seconds**. This is often too short for production use, consider increasing it.
+
+
+
+Set `SMS_OTP_EXP` in `.env` (value is in seconds):
+
+```
+# Set expiration to 5 minutes
+SMS_OTP_EXP=300
+```
+
+And ensure `GOTRUE_SMS_OTP_EXP: ${SMS_OTP_EXP}` is uncommented in `docker-compose.yml`.
+
+### Length
+
+The default OTP length is 6 digits. You can set it to any value between 6 and 10:
+
+```
+SMS_OTP_LENGTH=8
+```
+
+### Rate limiting
+
+`SMS_MAX_FREQUENCY` controls the minimum interval between SMS sends to the same phone number. The default is 60 seconds:
+
+```
+## Allow one SMS every 30 seconds
+SMS_MAX_FREQUENCY=30s
+```
+
+## Test OTPs for development
+
+To avoid sending real SMS during development, use `SMS_TEST_OTP` to map phone numbers to fixed OTP codes:
+
+```
+SMS_TEST_OTP=16505551234:123456,16505555678:654321
+```
+
+And uncomment `GOTRUE_SMS_TEST_OTP: ${SMS_TEST_OTP}` in `docker-compose.yml`.
+
+When a test phone number requests an OTP, the Auth service skips SMS delivery and accepts only the mapped code. Other phone numbers continue to use the real SMS provider.
+
+
+
+Remove test OTPs before deploying to production. You can also set an expiration with `SMS_TEST_OTP_VALID_UNTIL` (ISO 8601 datetime, e.g., `2026-12-31T23:59:59Z`) so they stop working automatically.
+
+
+
+## Multi-factor authentication (MFA)
+
+The Auth service supports three MFA factor types. Configure them by uncommenting variables in `.env` and the matching `GOTRUE_MFA_*` lines in `docker-compose.yml`.
+
+### App authenticator (TOTP)
+
+TOTP is **enabled by default** - users can enroll with apps like Google Authenticator or Authy without any additional configuration.
+
+To disable TOTP:
+
+```
+MFA_TOTP_ENROLL_ENABLED=false
+MFA_TOTP_VERIFY_ENABLED=false
+```
+
+### Phone MFA
+
+Phone MFA is **disabled by default** (opt-in). It uses the same SMS provider configuration as phone login.
+
+To enable:
+
+```
+MFA_PHONE_ENROLL_ENABLED=true
+MFA_PHONE_VERIFY_ENABLED=true
+```
+
+### Maximum enrolled factors
+
+By default, a user can enroll up to 10 MFA factors. To change this:
+
+```
+MFA_MAX_ENROLLED_FACTORS=5
+```
+
+## Troubleshooting
+
+### OTP expires too quickly
+
+The default `SMS_OTP_EXP` is 60 seconds. Increase it in `.env`:
+
+```
+SMS_OTP_EXP=300
+```
+
+Ensure `GOTRUE_SMS_OTP_EXP: ${SMS_OTP_EXP}` is uncommented in `docker-compose.yml`, then restart:
+
+```sh
+docker compose up -d --force-recreate --no-deps auth
+```
+
+### SMS not being delivered
+
+Check the auth container logs for errors:
+
+```sh
+docker compose logs auth --tail 50
+```
+
+Verify provider credentials reach the container:
+
+```sh
+docker compose exec auth env | grep GOTRUE_SMS
+```
+
+Common causes:
+
+- Provider credentials are in `.env` but the matching `GOTRUE_SMS_*` line is still commented out in `docker-compose.yml`
+- Provider credentials are wrong
+- Phone number format is wrong (use E.164 format: `+1234567890`)
+
+### Variables are configured in `.env` but not working
+
+Configuration variables from `.env` are **not** automatically available inside the container unless there's a matching passthrough definition in `docker-compose.yml`. Check, e.g., for:
+
+```sh
+docker compose exec auth env | grep -E 'GOTRUE_SMS|GOTRUE_MFA'
+```
+
+After changing the configuration environment variables, recreate the Auth service container:
+
+```sh
+docker compose up -d --force-recreate --no-deps auth
+```
+
+### Rate limit errors
+
+If users see "rate limit exceeded" errors, check `SMS_MAX_FREQUENCY` (minimum interval between sends) and the global rate limit `GOTRUE_RATE_LIMIT_SMS_SENT` (default: 30 per hour).
+
+### Additional resources
+
+- [Multi-Factor Authentication (Phone)](/docs/guides/auth/auth-mfa/phone)
+- [Multi-Factor Authentication (TOTP)](/docs/guides/auth/auth-mfa/totp)
+- [Auth server on GitHub](https://github.com/supabase/auth) (check README and `example.env`)
diff --git a/apps/docs/content/guides/self-hosting/self-hosted-proxy-https.mdx b/apps/docs/content/guides/self-hosting/self-hosted-proxy-https.mdx
new file mode 100644
index 00000000000..25723468ba8
--- /dev/null
+++ b/apps/docs/content/guides/self-hosting/self-hosted-proxy-https.mdx
@@ -0,0 +1,228 @@
+---
+title: 'Configure Reverse Proxy and HTTPS'
+description: 'Set up a reverse proxy with HTTPS for self-hosted Supabase.'
+subtitle: 'Set up a reverse proxy with HTTPS for self-hosted Supabase.'
+---
+
+HTTPS is required for production self-hosted Supabase deployments. This guide covers two production approaches using a reverse proxy in front of self-hosted Supabase API gateway, plus a self-signed certificate option for development environment.
+
+## Before you begin
+
+You need:
+
+- A working self-hosted Supabase installation. See [Self-Hosting with Docker](/docs/guides/self-hosting/docker).
+- A domain name with DNS pointing to your server's public IP address (to obtain Let's Encrypt certificate).
+- Ports 80 and 443 open.
+
+## Set up HTTPS
+
+Below are two options for adding a reverse proxy with automatic HTTPS in front of your self-hosted Supabase: **Caddy** (simpler, zero-config TLS) and **Nginx + Let's Encrypt** (more control over proxy settings). Both sit in front of Kong and terminate TLS, so internal traffic stays on HTTP.
+
+
+
+If you already run [HAProxy](https://www.haproxy.com/), [Traefik](https://traefik.io/), [Nginx Proxy Manager](https://nginxproxymanager.com/), or another reverse proxy for your infrastructure, you can use it instead of Caddy or Nginx above. The key requirements are:
+
+- Proxy to Kong on port `8000` (or `:8000` if the proxy runs outside the Docker network)
+- Enable WebSocket support (required for Realtime)
+- Proxy traffic to Storage directly to the container, bypassing Kong
+- Add `X-Forwarded` headers to all requests
+- Comment out Kong's host port bindings in `docker-compose.yml` if the proxy runs in the same Docker network
+- Update `SUPABASE_PUBLIC_URL`, `API_EXTERNAL_URL`, and `SITE_URL` in `.env` to your HTTPS URL
+
+
+
+### Step 1: Remove public port bindings for API gateway
+
+Comment out Kong's host port mappings in `docker-compose.yml` so that it's not exposed to the Internet:
+
+```yaml
+kong:
+ # ...
+ ports:
+ # - ${KONG_HTTP_PORT}:8000/tcp
+ # - ${KONG_HTTPS_PORT}:8443/tcp
+```
+
+Kong remains accessible to other containers on the internal Docker network.
+
+### Step 2: Update environment variables
+
+Update the URL configuration in your `.env` file to use your HTTPS domain:
+
+```
+SUPABASE_PUBLIC_URL=https://
+API_EXTERNAL_URL=https://
+SITE_URL=https://
+```
+
+Change the following to your domain name and a **valid** email address:
+
+```
+PROXY_DOMAIN=your-domain.example.com
+CERTBOT_EMAIL=admin@your-domain.example.com
+```
+
+### Step 3: Start the reverse proxy
+
+Pick one of the options below and use the corresponding Docker Compose overlay.
+
+
+
+[Caddy](https://caddyserver.com/) automatically provisions and renews Let's Encrypt TLS certificates with zero configuration. It also handles HTTP-to-HTTPS redirects, WebSocket upgrades, and HTTP/2 and HTTP/3 out of the box.
+
+Start Caddy by using the pre-configured `docker-compose.caddy.yml` overlay:
+
+```sh
+docker compose -f docker-compose.yml -f docker-compose.caddy.yml up -d
+```
+
+Caddy configuration is in `volumes/proxy/caddy/Caddyfile`.
+
+
+
+
+This option uses a 3rd party Nginx Docker image ([`jonasal/nginx-certbot`](https://github.com/JonasAlfredsson/docker-nginx-certbot)), which includes Certbot for automatic Let's Encrypt certificate issuance and renewal in a single container.
+
+Start Nginx by using the pre-configured `docker-compose.nginx.yml` overlay:
+
+```sh
+docker compose -f docker-compose.yml -f docker-compose.nginx.yml up -d
+```
+
+Nginx configuration template is in `volumes/proxy/nginx/supabase-nginx.conf.tpl`. On container startup, `${NGINX_SERVER_NAME}` is substituted using the environment variable from the `.env` file. The [`jonasal/nginx-certbot`](https://github.com/JonasAlfredsson/docker-nginx-certbot) image reads the resolved `server_name` to determine which domain to request a Let's Encrypt certificate for.
+
+HTTP-to-HTTPS redirects are handled automatically by the `jonasal/nginx-certbot` image.
+
+
+
+
+### Step 4: Verify HTTPS connection
+
+```sh
+curl -I https:///auth/v1/
+```
+
+You should receive a `401` response confirming you could connect to Auth.
+
+## Self-signed certificates (development only)
+
+
+
+Self-signed certificates trigger browser warnings and are rejected by most OAuth providers. Use this approach only in development environment or internal networks.
+
+
+
+For development or internal networks where you cannot use Let's Encrypt, you can configure Kong to serve HTTPS directly using self-signed certificates.
+
+### Step 1: Generate a self-signed certificate
+
+Change `` in the example below, and create certificates with `openssl`:
+
+```sh
+openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
+ -keyout volumes/api/server.key \
+ -out volumes/api/server.crt \
+ -subj "/CN=" && \
+ chmod 640 volumes/api/server.key && \
+ chgrp 65533 volumes/api/server.key
+```
+
+{/* supa-mdx-lint-disable-next-line Rule001HeadingCase */}
+
+### Step 2: Configure Kong for SSL
+
+Comment out Kong's HTTP port mapping in `docker-compose.yml`:
+
+```yaml
+kong:
+ # ...
+ ports:
+ # - ${KONG_HTTP_PORT}:8000/tcp
+```
+
+Uncomment the certificate volume mounts and SSL environment variables in `docker-compose.yml`:
+
+```yaml
+kong:
+ # ... existing configuration ...
+ volumes:
+ - ./volumes/api/kong.yml:/home/kong/temp.yml:ro,z
+ - ./volumes/api/server.crt:/home/kong/server.crt:ro
+ - ./volumes/api/server.key:/home/kong/server.key:ro
+ environment:
+ # ... existing environment variables ...
+ KONG_SSL_CERT: /home/kong/server.crt
+ KONG_SSL_CERT_KEY: /home/kong/server.key
+```
+
+### Step 3: Update configuration variables in `.env`
+
+Edit your `.env` file to use HTTPS with the Kong HTTPS port:
+
+```
+SUPABASE_PUBLIC_URL=https://:8443
+API_EXTERNAL_URL=https://:8443
+SITE_URL=https://:8443
+```
+
+### Step 4: Restart and verify
+
+```sh
+docker compose down && docker compose up -d
+```
+
+```sh
+curl -I -k https://:8443/auth/v1/
+```
+
+The `-k` flag tells curl to accept the self-signed certificate.
+
+## Troubleshooting
+
+### Certificate not issued
+
+If Caddy or Certbot fails to obtain a certificate:
+
+- Verify that ports 80 and 443 are open on your firewall
+- Verify that your domain's DNS A record points to your server's public IP
+- Check proxy logs via `docker logs supabase-caddy` or `docker logs supabase-nginx`
+- Let's Encrypt has [rate limits](https://letsencrypt.org/docs/rate-limits/) - if you hit them, wait before retrying
+
+### WebSocket connection failed
+
+If Realtime subscriptions fail to connect:
+
+- **Caddy** handles WebSocket upgrades automatically - check that Kong is healthy
+- **Nginx** requires explicit `Upgrade` and `Connection` headers on the `/realtime/v1/` location. Verify your `nginx.conf` includes these headers as shown above
+
+### OAuth callback URL mismatch
+
+If OAuth redirects fail with a callback URL error:
+
+- Verify `API_EXTERNAL_URL` in `.env` is set to your HTTPS URL
+- Verify the callback URL registered with your OAuth provider matches `API_EXTERNAL_URL` followed by `/auth/v1/callback`
+- After changing `API_EXTERNAL_URL`, restart all services with `docker compose down && docker compose up -d`
+
+### Mixed content warnings
+
+If the browser console shows mixed content errors:
+
+- Verify `SUPABASE_PUBLIC_URL` is set to your HTTPS URL
+- Verify `SITE_URL` is also set to HTTPS
+- Clear your browser cache after making changes
+
+### ERR_CERT_AUTHORITY_INVALID
+
+This is expected when using self-signed certificates. For production, use Caddy or Nginx with Let's Encrypt. If you need to use self-signed certificates, add the certificate to your system's trust store or use a browser flag to bypass the warning.
+
+## Additional resources
+
+- [Caddy documentation](https://caddyserver.com/docs/)
+- [Nginx documentation](https://nginx.org/en/docs/) (on nginx.org)
+- [docker-nginx-certbot on GitHub](https://github.com/JonasAlfredsson/docker-nginx-certbot)
diff --git a/apps/docs/content/guides/telemetry/log-drains.mdx b/apps/docs/content/guides/telemetry/log-drains.mdx
index 9bf926f643d..9b5b8adfdd0 100644
--- a/apps/docs/content/guides/telemetry/log-drains.mdx
+++ b/apps/docs/content/guides/telemetry/log-drains.mdx
@@ -4,7 +4,7 @@ title: 'Log Drains'
description: 'Getting started with Supabase Log Drains'
---
-Log drains will send all logs of the Supabase stack to one or more desired destinations. It is only available for customers on Team and Enterprise Plans. Log drains is available in the dashboard under [Project Settings > Log Drains](/dashboard/project/_/settings/log-drains).
+Log drains send all logs of the Supabase stack to one or more desired destinations. It is only available for customers on Pro, Team and Enterprise Plans. Log drains are available in the dashboard under [Project Settings > Log Drains](/dashboard/project/_/settings/log-drains).
You can read about the initial announcement [here](/blog/log-drains) and vote for your preferred drains in [this discussion](https://github.com/orgs/supabase/discussions/28324?sort=top).
diff --git a/apps/docs/content/troubleshooting/all-about-supabase-egress-a_Sg_e.mdx b/apps/docs/content/troubleshooting/all-about-supabase-egress-a_Sg_e.mdx
index ecbb16f8bea..203e64a42dd 100644
--- a/apps/docs/content/troubleshooting/all-about-supabase-egress-a_Sg_e.mdx
+++ b/apps/docs/content/troubleshooting/all-about-supabase-egress-a_Sg_e.mdx
@@ -9,7 +9,7 @@ database_id = "ba593989-12b5-464f-8ede-a525e1ca2ffb"
**What is Egress?**
-Egress (also known as bandwidth) is any amount of network packets/bytes being streamed back to a connected client. Means, the data that is leaving the Supabase platform. Egress in Supabase includes any calls through PostgREST, to Storage, Realtime, Auth, Edge Functions, Database and Supavisor.
+Egress (also known as bandwidth) is any amount of network packets/bytes being streamed to a connected client from your project. Means, the data that is leaving the Supabase platform. Egress in Supabase includes any calls through PostgREST, to Storage, Realtime, Auth, Edge Functions, Database and Supavisor.
You can read about Unified egress, included quota, and how to check the egress usage here: https://supabase.com/docs/guides/platform/manage-your-usage/egress. Additionally, the [project reports](/dashboard/project/_/observability) have a few egress related stats. You can create a custom report to look into daily egress.
diff --git a/apps/docs/content/troubleshooting/supabase-storage-inefficient-folder-operations-and-hierarchical-rls-challenges-b05a4d.mdx b/apps/docs/content/troubleshooting/supabase-storage-inefficient-folder-operations-and-hierarchical-rls-challenges-b05a4d.mdx
index c4fdf405942..d666ff718b3 100644
--- a/apps/docs/content/troubleshooting/supabase-storage-inefficient-folder-operations-and-hierarchical-rls-challenges-b05a4d.mdx
+++ b/apps/docs/content/troubleshooting/supabase-storage-inefficient-folder-operations-and-hierarchical-rls-challenges-b05a4d.mdx
@@ -20,3 +20,45 @@ To overcome these limitations and implement robust folder management with hierar
- **Implement RLS policies on `storage.objects`.** These policies must `JOIN` with your custom metadata table to enforce hierarchical access permissions based on your defined folder structure.
- **Handle batch folder operations via your metadata table.** For operations like moving or renaming folders, update the relevant entries in your custom metadata table. Note that actual file paths in Storage are not directly altered by these operations.
- **Optimize RLS policies for performance.** `JOIN`s in RLS policies can lead to performance degradation, especially with large datasets. Ensure proper indexing on your custom metadata table and consider using `SECURITY DEFINER` functions to optimize policy execution.
+
+## Alternative approach: Using the S3 protocol for bulk operations
+
+Supabase Storage also supports an S3-compatible API. This allows you to use tools like the AWS CLI to perform bulk file operations such as downloading, moving, or reorganizing objects more efficiently.
+
+Install the AWS CLI by following the [AWS CLI installation guide](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html).
+
+Create S3 credentials in Supabase using the [Supabase S3 authentication guide](/docs/guides/storage/s3/authentication?queryGroups=language&language=credentials).
+
+Configure an AWS CLI profile using the credentials you generated in Supabase. The profile name can be anything, but it must match the value used in the following commands.
+
+```shell
+aws configure --profile supabase-s3
+```
+
+Download files from a bucket or prefix:
+
+```shell
+aws s3 cp s3://bucket-name/folder-name ./download-target
+--profile supabase-s3
+--endpoint-url https://.supabase.co/storage/v1/s3
+--recursive
+--region
+```
+
+- Replace `bucket-name` with your bucket name.
+- Replace `folder-name` with the prefix you want to download, or omit it to download the entire bucket.
+- Replace `` with your Supabase project reference.
+- Replace `` with your project's region (for example `eu-central-1`).
+- `./download-target` is the local directory where files will be saved.
+
+Move or rename files using the `mv` command. Because folders in Supabase Storage are implemented as prefixes, renaming a folder is effectively moving objects from one prefix to another.
+
+```shell
+aws s3 mv s3://bucket-name-one/folder-name-one s3://bucket-name-two/folder-name-two
+--profile supabase-s3
+--endpoint-url https://.supabase.co/storage/v1/s3
+--recursive
+--region
+```
+
+This method is useful for large-scale downloads, migrations, or reorganizing files within a bucket.
diff --git a/apps/docs/features/docs/GuidesMdx.template.tsx b/apps/docs/features/docs/GuidesMdx.template.tsx
index 76fbe6d397c..97758032965 100644
--- a/apps/docs/features/docs/GuidesMdx.template.tsx
+++ b/apps/docs/features/docs/GuidesMdx.template.tsx
@@ -5,7 +5,7 @@ import ReactMarkdown from 'react-markdown'
import { cn } from 'ui'
import Breadcrumbs from '~/components/Breadcrumbs'
-import GuidesTableOfContents from '~/components/GuidesTableOfContents'
+import GuidesSidebar from '~/components/GuidesSidebar'
import { TocAnchorsProvider } from '~/features/docs/GuidesMdx.client'
import { MDXRemoteBase } from '~/features/docs/MdxBase'
import type { WithRequired } from '~/features/helpers.types'
@@ -71,7 +71,7 @@ const GuideTemplate = ({ meta, content, children, editLink, mdxOptions }: GuideT
'relative',
'transition-all ease-out',
'duration-100',
- hideToc ? 'col-span-12' : 'col-span-12 md:col-span-9'
+ 'col-span-12 md:col-span-9'
)}
>
- {!hideToc && (
-
)
diff --git a/apps/docs/features/docs/MdxBase.shared.tsx b/apps/docs/features/docs/MdxBase.shared.tsx
index 7c82b3a5d56..3502b92392d 100644
--- a/apps/docs/features/docs/MdxBase.shared.tsx
+++ b/apps/docs/features/docs/MdxBase.shared.tsx
@@ -96,6 +96,13 @@ const components = {
),
pre: CodeBlock,
+ /**
+ * Force inline code tags to go sync, this prevents Heading anchor resolution fail due to
+ * our CodeBlock component being async. We need to find a better solution for more future
+ * proof MDX rendering. Definitely improving the anchors utility in the ui/Heading component
+ * plus having a more resilient highlighting strategy.
+ */
+ code: (props: any) =>
-
+
Docs
- {doc.title}
- {doc.title}
{doc.description && ( diff --git a/apps/design-system/components/pager.tsx b/apps/design-system/components/pager.tsx index b5c6eb39a0d..b7b1620b8ea 100644 --- a/apps/design-system/components/pager.tsx +++ b/apps/design-system/components/pager.tsx @@ -71,3 +71,27 @@ export function flatten(links: NavItemWithChildren[]): NavItem[] { }, []) .filter((link) => !link?.disabled) } + +export interface BreadcrumbSegment { + title: string + href?: string +} + +export function getBreadcrumbSegments(doc: Doc): BreadcrumbSegment[] { + const segments: BreadcrumbSegment[] = [{ title: 'Docs', href: '/docs' }] + + for (const section of docsConfig.sidebarNav) { + const flatItems = flatten(section.items ?? []) + const inSection = flatItems.some((item) => item.href === doc.slug) + if (!inSection || !section.title) continue + + const sectionLanding = flatItems.find((item) => item.priority) ?? flatItems[0] + const isOnLanding = sectionLanding?.href === doc.slug + if (sectionLanding?.href && !isOnLanding) { + segments.push({ title: section.title, href: sectionLanding.href }) + } + break + } + + return segments +} diff --git a/apps/design-system/content/docs/components/alert-dialog.mdx b/apps/design-system/content/docs/components/alert-dialog.mdx index 0968428ea14..7c35e586b3c 100644 --- a/apps/design-system/content/docs/components/alert-dialog.mdx +++ b/apps/design-system/content/docs/components/alert-dialog.mdx @@ -99,6 +99,7 @@ This enforced decision helps prevent accidental dismissal of critical warnings o - **Keep content concise:** AlertDialogDescription renders as a single paragraph and must not contain block-level elements such as lists, multiple paragraphs, or complex layouts. - **Use for critical decisions only:** Reserve Alert Dialog for destructive or irreversible actions, or for warnings that require explicit acknowledgement. +- **Use for dirty-form discard confirmation:** A short discard-confirmation step after a dirty form dismissal attempt (backdrop, Escape, or `Cancel`) is a valid Alert Dialog pattern. In Studio, prefer `DiscardChangesConfirmationDialog` for this flow. - **Always provide a cancel action:** Include AlertDialogCancel so users can safely back out, in addition to supporting the Escape key. - **Avoid rich content:** If the dialog requires detailed explanations, callouts, or form inputs, use [Confirmation Modal](../fragments/confirmation-modal) or [Dialog](../components/dialog) instead. diff --git a/apps/design-system/content/docs/components/dialog.mdx b/apps/design-system/content/docs/components/dialog.mdx index 108d9852e05..3dffe213230 100644 --- a/apps/design-system/content/docs/components/dialog.mdx +++ b/apps/design-system/content/docs/components/dialog.mdx @@ -58,6 +58,7 @@ import { - **Use for non-critical interactions:** Dialog is appropriate when dismissal has no serious consequences. - **Design for cancellation**: Assume users may close the dialog without completing the action. +- **Guard dirty forms on dismissal:** For form dialogs, keep `Dialog` dismissible but intercept close attempts when the form is dirty and show a discard-confirmation dialog (for example, Studio's `DiscardChangesConfirmationDialog` pattern via `useConfirmOnClose`). - **Keep focus contained**: Dialog content should remain scoped to a single task or flow. - **Avoid destructive confirmations**: If the dialog’s primary purpose is to confirm a risky action, use a confirmation-focused pattern instead. - **Compose freely**: Dialog is intentionally unopinionated. Build custom layouts, forms, or step-based flows as needed. diff --git a/apps/design-system/content/docs/fragments/confirmation-modal.mdx b/apps/design-system/content/docs/fragments/confirmation-modal.mdx index dfe727fa171..e613c83444f 100644 --- a/apps/design-system/content/docs/fragments/confirmation-modal.mdx +++ b/apps/design-system/content/docs/fragments/confirmation-modal.mdx @@ -10,6 +10,8 @@ Use Confirmation Modal when the user needs extra context to make a decision, suc If the confirmation can be expressed as a single short paragraph, use [Alert Dialog](../components/alert-dialog). If the action is highly destructive and requires explicit typed intent, use [Text Confirm Dialog](../fragments/text-confirm-dialog). See [Modality](../ui-patterns/modality) for broader guidance on choosing the appropriate pattern. +For dirty-form dismissal in dialogs/sheets, prefer the dedicated discard-confirmation pattern (`DiscardChangesConfirmationDialog` + `useConfirmOnClose`) rather than creating new local `CloseConfirmationModal` wrappers. The ad-hoc `CloseConfirmationModal` wrapper pattern is deprecated for new implementations. ++ AI Tools +
+
+
+
+
+
+
+ )
+}
+
+export default GuidesSidebar
+export { GuidesSidebar }
+export type { TOCHeader }
diff --git a/apps/docs/components/GuidesTableOfContents.tsx b/apps/docs/components/GuidesTableOfContents.tsx
deleted file mode 100644
index ebb1fd4158f..00000000000
--- a/apps/docs/components/GuidesTableOfContents.tsx
+++ /dev/null
@@ -1,55 +0,0 @@
-'use client'
-
-import { usePathname } from 'next/navigation'
-import { isFeatureEnabled } from 'common'
-import { cn } from 'ui'
-import { ExpandableVideo } from 'ui-patterns/ExpandableVideo'
-import { Toc, TOCItems, TOCScrollArea } from 'ui-patterns/Toc'
-import { Feedback } from '~/components/Feedback'
-import { useTocAnchors } from '../features/docs/GuidesMdx.state'
-
-interface TOCHeader {
- id?: string
- text: string
- link: string
- level: number
-}
-
-const GuidesTableOfContents = ({ className, video }: { className?: string; video?: string }) => {
- const pathname = usePathname()
- const { toc } = useTocAnchors()
-
- const showFeedback = isFeatureEnabled('feedback:docs')
-
- const tocVideoPreview = `https://img.youtube.com/vi/${video}/0.jpg`
-
- return (
-
+ {video && (
+
+
+
+
+ )}
+
+
+
+ )}
+ {showFeedback && (
+
+
+ )}
+
+
+ {!hideToc && toc.length !== 0 && (
+ + On this page +
+
-
- )
-}
-
-export default GuidesTableOfContents
-export type { TOCHeader }
diff --git a/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts b/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts
index 6fca567215c..0ca56c33284 100644
--- a/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts
+++ b/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts
@@ -1,8 +1,9 @@
-import type { ComponentProps } from 'react'
// End of third-party imports
import { isFeatureEnabled } from 'common/enabled-features'
+import type { ComponentProps } from 'react'
import type { IconPanel } from 'ui-patterns/IconPanel'
+
import type { GlobalMenuItems, NavMenuConstant, NavMenuSection } from '../Navigation.types'
const {
@@ -1049,6 +1050,10 @@ export const database: NavMenuConstant = {
name: 'Partitioning your tables',
url: '/guides/database/partitions' as `/${string}`,
},
+ {
+ name: 'Migrating to pg_partman',
+ url: '/guides/database/migrating-to-pg-partman' as `/${string}`,
+ },
{
name: 'Managing connections',
url: '/guides/database/connection-management' as `/${string}`,
@@ -1249,6 +1254,10 @@ export const database: NavMenuConstant = {
name: 'pg_net: Async Networking',
url: '/guides/database/extensions/pg_net' as `/${string}`,
},
+ {
+ name: 'pg_partman: Partition management',
+ url: '/guides/database/extensions/pg_partman' as `/${string}`,
+ },
{
name: 'pg_plan_filter: Restrict Total Cost',
url: '/guides/database/extensions/pg_plan_filter' as `/${string}`,
@@ -2841,10 +2850,19 @@ export const self_hosting: NavMenuConstant = {
name: 'How-to Guides',
items: [
{ name: 'Self-Hosted Functions', url: '/guides/self-hosting/self-hosted-functions' },
- { name: 'Restore from Platform', url: '/guides/self-hosting/restore-from-platform' },
+ {
+ name: 'Add Reverse Proxy with HTTPS',
+ url: '/guides/self-hosting/self-hosted-proxy-https',
+ },
+ {
+ name: 'Restore Project from Platform',
+ url: '/guides/self-hosting/restore-from-platform',
+ },
{ name: 'Configure S3 Storage', url: '/guides/self-hosting/self-hosted-s3' },
{ name: 'Copy Storage from Platform', url: '/guides/self-hosting/copy-from-platform-s3' },
- { name: 'Enabling MCP server', url: '/guides/self-hosting/enable-mcp' },
+ { name: 'Configure Social Login (OAuth)', url: '/guides/self-hosting/self-hosted-oauth' },
+ { name: 'Configure Phone Login & MFA', url: '/guides/self-hosting/self-hosted-phone-mfa' },
+ { name: 'Enable MCP server', url: '/guides/self-hosting/enable-mcp' },
],
},
{
diff --git a/apps/docs/content/guides/api/rest/auto-generated-docs.mdx b/apps/docs/content/guides/api/rest/auto-generated-docs.mdx
index 7357392b588..dce84addd9c 100644
--- a/apps/docs/content/guides/api/rest/auto-generated-docs.mdx
+++ b/apps/docs/content/guides/api/rest/auto-generated-docs.mdx
@@ -6,13 +6,15 @@ description: 'Supabase provides documentation that updates automatically.'
Supabase generates documentation in the [Dashboard](/dashboard) which updates as you make database changes.
-1. Go to the [API](/dashboard/project/_/api) page in the Dashboard.
-2. Select any table under **Tables and Views** in the sidebar.
-3. Switch between the JavaScript and the cURL docs using the tabs.
+1. Go to the [Project Settings](/dashboard/project/_/settings/general) page in the Dashboard.
+2. Select Data API -> Docs
+3. Select any table under **Tables and Views** in the sidebar.
+4. Switch between the JavaScript and the cURL docs using the tabs.
+5. You may also select the SUPABASE_KEY to use.
diff --git a/apps/docs/content/guides/auth/oauth-server/getting-started.mdx b/apps/docs/content/guides/auth/oauth-server/getting-started.mdx
index b65a671d198..0efdc4068e2 100644
--- a/apps/docs/content/guides/auth/oauth-server/getting-started.mdx
+++ b/apps/docs/content/guides/auth/oauth-server/getting-started.mdx
@@ -495,11 +495,11 @@ Store the client secret securely. It will only be shown once. If you lose it, yo
When a client exchanges an authorization code or refreshes a token, it must authenticate with the token endpoint. The `token_endpoint_auth_method` controls how this authentication happens:
-| Method | Description | Used by |
-| --- | --- | --- |
-| `none` | No client authentication. Only `client_id` is sent in the request body. | Public clients (required) |
-| `client_secret_basic` | Client credentials sent via HTTP Basic auth (`Authorization: Basic
- {video && (
-
-
-
-
- )}
-
-
-
- )}
- {showFeedback && (
-
-
- )}
- {toc.length !== 0 && (
- - On this page -
-
-
- )
-}
-```
-
-
-
-Notice we are using the [`useLogin()`](https://refine.dev/docs/api-reference/core/hooks/authentication/useLogin/) Refine auth hook to grab the `mutate: login` method to use inside `handleLogin()` function and `isLoading` state for our form submission. The `useLogin()` hook conveniently offers us access to `authProvider.login` method for authenticating the user with OTP.
+The [`useLogin()`](https://refine.dev/docs/api-reference/core/hooks/authentication/useLogin/) Refine auth hook to grab the `mutate: login` method to use inside `handleLogin()` function and `isLoading` state for the form submission. The `useLogin()` hook conveniently offers access to `authProvider.login` method for authenticating the user with OTP.
### Account page
-After a user is signed in we can allow them to edit their profile details and manage their account.
+After a user is signed in, allow them to edit their profile details and manage their account.
-Let's create a new component for that in `src/components/account.tsx`.
+Create a new component for that in `src/components/account.tsx`.
-<$CodeTabs>
+<$CodeSample
+path="/user-management/refine-user-management/src/components/account.tsx"
+lines={[[1, 3], [8, 43], [69, -1]]}
+meta="name=src/components/account.tsx"
+/>
-```tsx name=src/components/account.tsx
-import { BaseKey, useGetIdentity, useLogout } from '@refinedev/core'
-import { useForm } from '@refinedev/react-hook-form'
-
-interface IUserIdentity {
- id?: BaseKey
- username: string
- name: string
-}
-
-export interface IProfile {
- id?: string
- username?: string
- website?: string
- avatar_url?: string
-}
-
-export default function Account() {
- const { data: userIdentity } = useGetIdentity
-
- Supabase + Refine
-Sign in via magic link with your email below
- -
-
-
- )
-}
-```
-
-
-
-Notice above that, we are using three Refine hooks, namely the [`useGetIdentity()`](https://refine.dev/docs/api-reference/core/hooks/authentication/useGetIdentity/), [`useLogOut()`](https://refine.dev/docs/api-reference/core/hooks/authentication/useLogout/) and [`useForm()`](https://refine.dev/docs/packages/documentation/react-hook-form/useForm/) hooks.
+This uses three Refine hooks, namely the [`useGetIdentity()`](https://refine.dev/docs/api-reference/core/hooks/authentication/useGetIdentity/), [`useLogOut()`](https://refine.dev/docs/api-reference/core/hooks/authentication/useLogout/) and [`useForm()`](https://refine.dev/docs/packages/documentation/react-hook-form/useForm/) hooks.
`useGetIdentity()` is a auth hook that gets the identity of the authenticated user. It grabs the current user by invoking the `authProvider.getIdentity` method under the hood.
`useLogOut()` is also an auth hook. It calls the `authProvider.logout` method to end the session.
-`useForm()`, in contrast, is a data hook that exposes a series of useful objects that serve the edit form. For example, we are grabbing the `onFinish` function to submit the form with the `handleSubmit` event handler. We are also using `formLoading` property to present state changes of the submitted form.
+`useForm()`, in contrast, is a data hook that exposes a series of useful objects that serve the edit form. For example, grabbing the `onFinish` function to submit the form with the `handleSubmit` event handler. It also uses `formLoading` property to present state changes of the submitted form.
-The `useForm()` hook is a higher-level hook built on top of Refine's `useForm()` core hook. It fully supports form state management, field validation and submission using React Hook Form. Behind the scenes, it invokes the `dataProvider.getOne` method to get the user profile data from our Supabase `/profiles` endpoint and also invokes `dataProvider.update` method when `onFinish()` is called.
+The `useForm()` hook is a higher-level hook built on top of Refine's `useForm()` core hook. It fully supports form state management, field validation and submission using React Hook Form. Behind the scenes, it invokes the `dataProvider.getOne` method to get the user profile data from the Supabase `/profiles` endpoint and also invokes `dataProvider.update` method when `onFinish()` is called.
### Launch!
-Now that we have all the components in place, let's define the routes for the pages in which they should be rendered.
+Now that you have all the components in place, define the routes for the pages in which they should be rendered.
Add the routes for `/login` with the `
- {avatarUrl ? (
- 
- ) : (
-
- )}
-
- )
-}
-```
-
-
+<$CodeSample
+path="/user-management/refine-user-management/src/components/avatar.tsx"
+lines={[[1, -1]]}
+meta="name=src/components/avatar.tsx"
+/>
### Add the new widget
-And then we can add the widget to the Account page at `src/components/account.tsx`:
+And then add the widget to the Account page at `src/components/account.tsx`:
-<$CodeTabs>
-
-```tsx name=src/components/account.tsx
-// Import the new components
-import { Controller } from 'react-hook-form'
-import Avatar from './avatar'
-
-// ...
-
-return (
-
-
-
-
-
-
-
-)
-```
-
-
+<$CodeSample
+path="/user-management/refine-user-management/src/components/account.tsx"
+lines={[[1, -1]]}
+meta="name=src/components/account.tsx"
+/>
At this stage, you have a fully functional application!
diff --git a/apps/docs/content/guides/integrations/build-a-supabase-oauth-integration/oauth-scopes.mdx b/apps/docs/content/guides/integrations/build-a-supabase-oauth-integration/oauth-scopes.mdx
index ef13b111f2c..2e749fc4da2 100644
--- a/apps/docs/content/guides/integrations/build-a-supabase-oauth-integration/oauth-scopes.mdx
+++ b/apps/docs/content/guides/integrations/build-a-supabase-oauth-integration/oauth-scopes.mdx
@@ -39,3 +39,5 @@ You can update scopes of your OAuth app at any time, but existing OAuth app user
| `Rest` | `Write` | Update a project's PostgREST configuration |
| `Secrets` | `Read` | Retrieve a project's API keysRetrieve a project's secrets
Retrieve a project's pgsodium config | | `Secrets` | `Write` | Create or update a project's secrets
Update a project's pgsodium configuration | +| `Storage` | `Read` | Retrieve a project's storage buckets. | +| | diff --git a/apps/docs/content/guides/platform/backups.mdx b/apps/docs/content/guides/platform/backups.mdx index 55b43ec5041..a08c9585ebf 100644 --- a/apps/docs/content/guides/platform/backups.mdx +++ b/apps/docs/content/guides/platform/backups.mdx @@ -1,75 +1,39 @@ --- title: 'Database Backups' -description: 'Learn about the available backup methods for your Supabase project.' +description: 'Learn about backups for your Supabase project.' --- -Database backups are an integral part of any disaster recovery plan. Disasters come in many shapes and sizes. It could be as simple as accidentally deleting a table column, the database crashing, or even a natural calamity wiping out the underlying hardware a database is running on. The risks and impact brought by these scenarios can never be fully eliminated, but only minimized or even mitigated. Having database backups is a form of insurance policy. They are essentially snapshots of the database at various points in time. When disaster strikes, database backups allow the project to be brought back to any of these points in time, therefore averting the crisis. +We automatically back up all Free, Pro, Team, and Enterprise Plan projects on a daily basis. You can find backups in the [**Database** > **Backups**](/dashboard/project/_/database/backups/scheduled) section of the Dashboard. -
+
+
+ As [covered in this blog post](/blog/postgresql-physical-logical-backups), a combination of physical backups and [Write Ahead Log (WAL)](https://www.postgresql.org/docs/current/wal-intro.html) file archiving makes PITR possible. Physical backups provide a snapshot of the underlying directory of the database, while WAL files contain records of every change the database processes.
+
+ We use [WAL-G](https://github.com/wal-g/wal-g), an open source archival and restoration tool, to handle both aspects of PITR. Daily, we take a snapshot of the database and send it to our storage servers. Throughout the day, as database transactions occur, we generate and upload WAL files.
+
+ By default, we back up WAL files at two-minute intervals. If these files exceed a certain file size threshold, we back them up immediately. During periods of high transaction volume, WAL file backups therefore become more frequent. Conversely, when the database has no activity, we do not make WAL file backups. Overall, in the worst case scenario, PITR achieves a Recovery Point Objective (RPO) of two minutes.
+
+
+
+
+Supabase OAuth Test
+ + + + + + + +``` + +For detailed client-side integration, see [Social Login](/docs/guides/auth/social-login). + +## Troubleshooting + +### "Provider not enabled" or provider shows `false` in `/auth/v1/settings` + +- Check that `GOTRUE_EXTERNAL_*_ENABLED` is set to `true` in `docker-compose.yml` +- Verify the `.env` variable is not empty, e.g., check with `docker compose exec auth env | grep GOOGLE` + +### Variables added to `.env` but provider still not working + +Configuration variables from `.env` are **not** automatically available inside the container unless there's a matching passthrough definition in `docker-compose.yml`. Check, e.g., for: + +``` +GOTRUE_EXTERNAL_GOOGLE_ENABLED: ${GOOGLE_ENABLED} +``` + +Run `docker compose exec auth env | grep GOTRUE_EXTERNAL` to verify the variables are reaching the container. + +### `SITE_URL` or redirect URL errors after login + +After a successful OAuth login, the Auth service redirects to `SITE_URL` or a URL from `ADDITIONAL_REDIRECT_URLS`. Ensure: + +- `SITE_URL` in `.env` is set to your application's URL +- If your app uses a different redirect URL, add it to `ADDITIONAL_REDIRECT_URLS` (comma-separated) + +{/* supa-mdx-lint-disable-next-line Rule001HeadingCase */} + +### Nonce check failure on mobile (Google Sign In) + +When using Google Sign In on mobile with ID tokens, nonce verification may fail because mobile SDKs don't always support the nonce flow that the Auth service expects. + +{props.children},
Price,
}
diff --git a/apps/docs/features/ui/guide/Guide.tsx b/apps/docs/features/ui/guide/Guide.tsx
index e0179dd7ab3..9fa9b8c31c3 100644
--- a/apps/docs/features/ui/guide/Guide.tsx
+++ b/apps/docs/features/ui/guide/Guide.tsx
@@ -3,7 +3,7 @@
import { createContext, useContext, type ReactNode } from 'react'
import { cn } from 'ui'
-import GuidesTableOfContents from '~/components/GuidesTableOfContents'
+import GuidesTableOfContents from '~/components/GuidesSidebar'
import { TocAnchorsProvider } from '~/features/docs/GuidesMdx.client'
import { type GuideFrontmatter } from '~/lib/docs'
diff --git a/apps/docs/internals/generate-guides-markdown.ts b/apps/docs/internals/generate-guides-markdown.ts
new file mode 100644
index 00000000000..c07cb27bcb2
--- /dev/null
+++ b/apps/docs/internals/generate-guides-markdown.ts
@@ -0,0 +1,165 @@
+import fs from 'fs'
+import path from 'path'
+import { globby } from 'globby'
+import matter from 'gray-matter'
+
+const PARTIALS_DIR = path.join(process.cwd(), 'content', '_partials')
+
+/**
+ * Reads <$Partial path="..." /> tags and replaces them with the file contents.
+ * Recurses to handle nested partials.
+ */
+async function inlinePartials(content: string): Promise
@@ -251,102 +237,107 @@ export const Pagination = ({ enableForeignRowsQuery = true }: PaginationProps) =
return (
diff --git a/apps/studio/components/interfaces/Billing/Usage/UsageWarningAlerts/DiskIOBandwidthWarnings.tsx b/apps/studio/components/interfaces/Billing/Usage/UsageWarningAlerts/DiskIOBandwidthWarnings.tsx
index 000e1b92573..10a3c784423 100644
--- a/apps/studio/components/interfaces/Billing/Usage/UsageWarningAlerts/DiskIOBandwidthWarnings.tsx
+++ b/apps/studio/components/interfaces/Billing/Usage/UsageWarningAlerts/DiskIOBandwidthWarnings.tsx
@@ -4,7 +4,7 @@ import { Admonition } from 'ui-patterns'
// [Joshen] In the future, conditionals should be from resource exhaustion endpoint as single source of truth
interface DiskIOBandwidthWarningsProps {
- isFreePlan: boolean
+ hasAccessToComputeSizes: boolean
hasLatest: boolean
upgradeUrl: string
currentBillingCycleSelected: boolean
@@ -13,7 +13,7 @@ interface DiskIOBandwidthWarningsProps {
}
export const DiskIOBandwidthWarnings = ({
- isFreePlan,
+ hasAccessToComputeSizes,
hasLatest,
currentBillingCycleSelected,
upgradeUrl,
@@ -34,7 +34,7 @@ export const DiskIOBandwidthWarnings = ({
@@ -58,7 +58,7 @@ export const DiskIOBandwidthWarnings = ({
@@ -81,7 +81,7 @@ export const DiskIOBandwidthWarnings = ({
@@ -105,7 +105,7 @@ export const DiskIOBandwidthWarnings = ({
diff --git a/apps/studio/components/interfaces/Billing/Usage/UsageWarningAlerts/RAMWarnings.tsx b/apps/studio/components/interfaces/Billing/Usage/UsageWarningAlerts/RAMWarnings.tsx
index d2099e53b20..c2c37f79ef8 100644
--- a/apps/studio/components/interfaces/Billing/Usage/UsageWarningAlerts/RAMWarnings.tsx
+++ b/apps/studio/components/interfaces/Billing/Usage/UsageWarningAlerts/RAMWarnings.tsx
@@ -6,12 +6,16 @@ import { DOCS_URL } from 'lib/constants'
import { AlertDescription_Shadcn_, Alert_Shadcn_, Button } from 'ui'
interface RAMWarningsProps {
- isFreePlan: boolean
+ hasAccessToComputeSizes: boolean
upgradeUrl: string
severity?: 'warning' | 'critical' | null
}
-export const RAMWarnings = ({ isFreePlan, upgradeUrl, severity }: RAMWarningsProps) => {
+export const RAMWarnings = ({
+ hasAccessToComputeSizes,
+ upgradeUrl,
+ severity,
+}: RAMWarningsProps) => {
if (severity === 'warning') {
return (
- {isLoading && (
- Failed to retrieve count: {error?.message}
+
+ ) : !isForeignTableSelected ? (
+ ', label: 'Not equal', group: 'comparison' },
+ { value: 'is', label: 'Is', group: 'setNull' },
]
const BOOLEAN_OPERATORS: OperatorDefinition[] = [
{ value: '=', label: 'Equals', group: 'comparison' },
{ value: '<>', label: 'Not equal', group: 'comparison' },
+ { value: 'is', label: 'Is', group: 'setNull' },
]
export function columnToFilterProperty(column: SupaColumn): FilterProperty {
diff --git a/apps/studio/components/grid/components/header/sort/SortPopoverPrimitive.tsx b/apps/studio/components/grid/components/header/sort/SortPopoverPrimitive.tsx
index bbb8df4e78b..ee26db7e751 100644
--- a/apps/studio/components/grid/components/header/sort/SortPopoverPrimitive.tsx
+++ b/apps/studio/components/grid/components/header/sort/SortPopoverPrimitive.tsx
@@ -10,16 +10,16 @@ import { isEqual } from 'lodash'
import { ChevronDown, List } from 'lucide-react'
import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
import {
- type RoleImpersonationState,
useRoleImpersonationStateSnapshot,
+ type RoleImpersonationState,
} from 'state/role-impersonation-state'
import { useTableEditorTableStateSnapshot } from 'state/table-editor-table'
import {
Button,
+ Popover_Shadcn_,
PopoverContent_Shadcn_,
PopoverSeparator_Shadcn_,
PopoverTrigger_Shadcn_,
- Popover_Shadcn_,
} from 'ui'
import ConfirmationModal from 'ui-patterns/Dialogs/ConfirmationModal'
@@ -72,7 +72,6 @@ export const SortPopoverPrimitive = ({
const { data: countData } = useTableRowsCountQuery(
{
projectRef: project?.ref,
- connectionString: project?.connectionString,
tableId: snap.table.id,
filters,
enforceExactCount: snap.enforceExactCount,
diff --git a/apps/studio/components/interfaces/App/CommandMenu/ContextSearchCommands.tsx b/apps/studio/components/interfaces/App/CommandMenu/ContextSearchCommands.tsx
index 9cd507530de..8e61ba4731a 100644
--- a/apps/studio/components/interfaces/App/CommandMenu/ContextSearchCommands.tsx
+++ b/apps/studio/components/interfaces/App/CommandMenu/ContextSearchCommands.tsx
@@ -1,25 +1,26 @@
'use client'
-import { useMemo } from 'react'
-import { Database } from 'lucide-react'
+import { IS_PLATFORM } from 'common'
+import { useIsFeatureEnabled } from 'hooks/misc/useIsFeatureEnabled'
+import { useSelectedProjectQuery } from 'hooks/misc/useSelectedProject'
import { Auth, EdgeFunctions, Storage } from 'icons'
+import { Database } from 'lucide-react'
+import { useMemo } from 'react'
import type { ICommand } from 'ui-patterns/CommandMenu'
import {
CommandHeader,
CommandInput,
CommandWrapper,
PageType,
+ useQuery,
useRegisterCommands,
useRegisterPage,
useSetPage,
- useQuery,
} from 'ui-patterns/CommandMenu'
+
import { COMMAND_MENU_SECTIONS } from './CommandMenu.utils'
-import { useSelectedProjectQuery } from 'hooks/misc/useSelectedProject'
-import { orderCommandSectionsByPriority } from './ordering'
import { ContextSearchResults } from './ContextSearchResults'
-import { useFlag, IS_PLATFORM } from 'common'
-import { useIsFeatureEnabled } from 'hooks/misc/useIsFeatureEnabled'
+import { orderCommandSectionsByPriority } from './ordering'
import type { SearchContextValue } from './SearchContext.types'
interface SearchContextOption {
@@ -81,7 +82,6 @@ function ContextSearchPage({
}
export function useContextSearchCommands() {
- const enableSearchEntitiesCommandMenu = useFlag('enableSearchEntitiesCommandMenu')
const { data: project } = useSelectedProjectQuery()
const setPage = useSetPage()
@@ -147,6 +147,6 @@ export function useContextSearchCommands() {
useRegisterCommands(COMMAND_MENU_SECTIONS.QUERY, contextCommands, {
orderSection: orderCommandSectionsByPriority,
sectionMeta: { priority: 3 },
- enabled: !IS_PLATFORM || (enableSearchEntitiesCommandMenu && !!project),
+ enabled: !IS_PLATFORM || !!project,
})
}
diff --git a/apps/studio/components/interfaces/App/CommandMenu/CreateCommands.tsx b/apps/studio/components/interfaces/App/CommandMenu/CreateCommands.tsx
index cce80055c86..4885b327494 100644
--- a/apps/studio/components/interfaces/App/CommandMenu/CreateCommands.tsx
+++ b/apps/studio/components/interfaces/App/CommandMenu/CreateCommands.tsx
@@ -1,6 +1,6 @@
'use client'
-import { IS_PLATFORM, useFlag } from 'common'
+import { IS_PLATFORM } from 'common'
import { SIDEBAR_KEYS } from 'components/layouts/ProjectLayout/LayoutSidebar/LayoutSidebarProvider'
import {
Clock5,
@@ -25,13 +25,13 @@ import {
} from 'lucide-react'
import dynamic from 'next/dynamic'
import { useMemo } from 'react'
+import type { CommandOptions, ICommand } from 'ui-patterns/CommandMenu'
import {
PageType,
useRegisterCommands,
useRegisterPage,
useSetCommandMenuOpen,
} from 'ui-patterns/CommandMenu'
-import type { CommandOptions, ICommand } from 'ui-patterns/CommandMenu'
import { COMMAND_MENU_SECTIONS } from './CommandMenu.utils'
import {
@@ -51,14 +51,12 @@ const Graphql = dynamic(() => import('icons').then((mod) => mod.Graphql))
const CREATE_STUDIO_ENTITY = 'Create Studio Entity'
export function useCreateCommands(options?: CommandOptions) {
- const enableCreateCommands = useFlag('enablecreatecommands')
const setIsOpen = useSetCommandMenuOpen()
const {
ref,
setPage,
openSidebar,
snap,
- authenticationOauth21,
authEnabled,
edgeFunctionsEnabled,
storageEnabled,
@@ -184,7 +182,7 @@ export function useCreateCommands(options?: CommandOptions) {
},
]
: []),
- ...(IS_PLATFORM && authenticationOauth21
+ ...(IS_PLATFORM
? [
{
id: 'create-oauth-app',
@@ -207,7 +205,6 @@ export function useCreateCommands(options?: CommandOptions) {
passwordVerificationHook,
passwordVerificationHookEnabled,
beforeUserCreatedHook,
- authenticationOauth21,
]
)
@@ -453,7 +450,7 @@ export function useCreateCommands(options?: CommandOptions) {
},
{
deps: [sections],
- enabled: enableCreateCommands,
+ enabled: true,
}
)
@@ -471,7 +468,7 @@ export function useCreateCommands(options?: CommandOptions) {
...options,
orderSection: (sections) => sections,
sectionMeta: { priority: 3 },
- enabled: enableCreateCommands,
+ enabled: true,
}
)
}
diff --git a/apps/studio/components/interfaces/App/CommandMenu/CreateCommands.utils.tsx b/apps/studio/components/interfaces/App/CommandMenu/CreateCommands.utils.tsx
index 58d54a6af07..c3493239a28 100644
--- a/apps/studio/components/interfaces/App/CommandMenu/CreateCommands.utils.tsx
+++ b/apps/studio/components/interfaces/App/CommandMenu/CreateCommands.utils.tsx
@@ -1,4 +1,4 @@
-import { useFlag, useParams } from 'common'
+import { useParams } from 'common'
import type { Hook } from 'components/interfaces/Auth/Hooks/hooks.constants'
import { HOOKS_DEFINITIONS } from 'components/interfaces/Auth/Hooks/hooks.constants'
import { extractMethod, isValidHook } from 'components/interfaces/Auth/Hooks/hooks.utils'
@@ -74,7 +74,7 @@ export function getIntegrationCommandName(integration: IntegrationDefinition): s
case 'cron':
return 'Create Cron Job'
case 'webhooks':
- return 'Create Webhook'
+ return 'Create Database Webhook'
case 'queues':
return 'Create Queue'
default:
@@ -89,9 +89,6 @@ export function useCreateCommandsConfig() {
const { openSidebar } = useSidebarManagerSnapshot()
const snap = useAiAssistantStateSnapshot()
- // Auth
- const authenticationOauth21 = useFlag('EnableOAuth21')
-
const {
projectAuthAll: authEnabled,
projectEdgeFunctionAll: edgeFunctionsEnabled,
@@ -182,7 +179,6 @@ export function useCreateCommandsConfig() {
setPage,
openSidebar,
snap,
- authenticationOauth21,
authEnabled,
edgeFunctionsEnabled,
storageEnabled,
diff --git a/apps/studio/components/interfaces/App/FeaturePreview/FeaturePreviewContext.tsx b/apps/studio/components/interfaces/App/FeaturePreview/FeaturePreviewContext.tsx
index ee4a43ef84a..d18f61dcfbf 100644
--- a/apps/studio/components/interfaces/App/FeaturePreview/FeaturePreviewContext.tsx
+++ b/apps/studio/components/interfaces/App/FeaturePreview/FeaturePreviewContext.tsx
@@ -120,6 +120,12 @@ export const useIsJitDbAccessEnabled = () => {
return jitDbAccessEnabled && flags[LOCAL_STORAGE_KEYS.UI_PREVIEW_JIT_DB_ACCESS]
}
+export const useIsPlatformWebhooksEnabled = () => {
+ const { flags } = useFeaturePreviewContext()
+ const platformWebhooksEnabled = useFlag('platformWebhooks')
+ return platformWebhooksEnabled && flags[LOCAL_STORAGE_KEYS.UI_PREVIEW_PLATFORM_WEBHOOKS]
+}
+
export const useIsTableFilterBarEnabled = () => {
const { flags } = useFeaturePreviewContext()
return flags[LOCAL_STORAGE_KEYS.UI_PREVIEW_TABLE_FILTER_BAR]
diff --git a/apps/studio/components/interfaces/App/FeaturePreview/FeaturePreviewModal.tsx b/apps/studio/components/interfaces/App/FeaturePreview/FeaturePreviewModal.tsx
index 361b5d16bbe..2e5788fa439 100644
--- a/apps/studio/components/interfaces/App/FeaturePreview/FeaturePreviewModal.tsx
+++ b/apps/studio/components/interfaces/App/FeaturePreview/FeaturePreviewModal.tsx
@@ -25,11 +25,13 @@ import { Branching2Preview } from './Branching2Preview'
import { CLSPreview } from './CLSPreview'
import { useFeaturePreviewContext, useFeaturePreviewModal } from './FeaturePreviewContext'
import { JitDbAccessPreview } from './JitDbAccessPreview'
+import { PlatformWebhooksPreview } from './PlatformWebhooksPreview'
import { PgDeltaDiffPreview } from './PgDeltaDiffPreview'
import { QueueOperationsPreview } from './QueueOperationsPreview'
import { TableFilterBarPreview } from './TableFilterBarPreview'
import { UnifiedLogsPreview } from './UnifiedLogsPreview'
import { useFeaturePreviews } from './useFeaturePreviews'
+import { useLocalStorageQuery } from '@/hooks/misc/useLocalStorage'
const FEATURE_PREVIEW_KEY_TO_CONTENT: {
[key: string]: ReactNode
@@ -43,6 +45,7 @@ const FEATURE_PREVIEW_KEY_TO_CONTENT: {
[LOCAL_STORAGE_KEYS.UI_PREVIEW_QUEUE_OPERATIONS]: isDirty,
+ onClose,
+ })
const statements = useMemo(() => {
let permissionChanges: string[] = []
@@ -239,7 +250,7 @@ export const CreateHookSheet = ({
form.reset({
hookType: definition.title,
- enabled: authConfig?.[definition.enabledKey] || true,
+ enabled: isCreating ? true : authConfig?.[definition.enabledKey],
selectedType: values.type,
httpsValues: {
url: (values.type === 'https' && values.url) || '',
@@ -270,7 +281,7 @@ export const CreateHookSheet = ({
}, [authConfig, title, visible, definition])
return (
- onClose()}>
+
-
-
- )}
+ Loading records count...
-
+ }
+ type="outline"
+ className="px-1.5"
+ disabled={page <= 1 || isLoading}
+ onClick={onPreviousPage}
+ />
- {isSuccess && (
- <>
-
+
}
- type="outline"
- className="px-1.5"
- disabled={page <= 1 || isLoading}
- onClick={onPreviousPage}
- />
-
-
- {!isForeignTableSelected && (
-
+
+
+ {isLoading ? (
+ } />
+ ) : isError ? (
+ Page
+ + setValue(e.target.value)} + onKeyDown={(e) => { + const parsedValue = Number(value) + if ( + (e.code === 'Enter' || e.code === 'NumpadEnter') && + !Number.isNaN(parsedValue) && + parsedValue >= 1 + ) { + onPageChange(parsedValue) + } + }} + /> + + {isSuccess && hasCountData && ( +of {totalPages.toLocaleString()}
+ )} + + } + type="outline" + className="px-1.5" + disabled={isLastPage} + onClick={onNextPage} + /> + +Page
- setValue(e.target.value)} - onKeyDown={(e) => { - const parsedValue = Number(value) - if ( - (e.code === 'Enter' || e.code === 'NumpadEnter') && - !Number.isNaN(parsedValue) && - parsedValue >= 1 && - parsedValue <= maxPages - ) { - onPageChange(parsedValue) - } - }} + type="text" + className="w-7" + loading={isFetching} + icon={of {totalPages.toLocaleString()}
- - } - type="outline" - className="px-1.5" - disabled={page >= maxPages || isLoading} - onClick={onNextPage} - /> - -
-
-
- }
- onClick={() => {
- // Show warning if either NOT a table entity, or table rows estimate is beyond threshold
- if (rowsCountEstimate === null || count > THRESHOLD_COUNT) {
- setIsConfirmFetchExactCountModalOpen(true)
- } else snap.setEnforceExactCount(true)
- }}
- />
-
-
- This is an estimated value as your table has more than{' '}
- {THRESHOLD_COUNT.toLocaleString()} rows.
- - Click to retrieve the exact count of the table. - -
-
- )}
-
+
+ - {`${countString} ${count === 0 || count > 1 ? `records` : 'record'}`}{' '} - {data.is_estimate ? '(estimated)' : ''} -
- - {data.is_estimate && ( -- - Click to retrieve the exact count of the table. - -
+ {hasCountData && (
+
+
+ }
+ onClick={() => {
+ // Show warning if either NOT a table entity, or table rows estimate is beyond threshold
+ if (rowsCountEstimate === null || count === -1 || count > THRESHOLD_COUNT) {
+ setIsConfirmFetchExactCountModalOpen(true)
+ } else {
+ snap.setEnforceExactCount(true)
+ }
+ }}
+ />
+
+
+ {hasCountData
+ ? `This is an estimated value as your table has more than ${THRESHOLD_COUNT.toLocaleString()} rows.`
+ : `Count not automatically loaded as your table has more than ${THRESHOLD_COUNT.toLocaleString()} rows.`}{' '}
+
+ Click to retrieve the exact count of the table. +
+
+ )}
+
+ ) : null}
+ {`${countString} ${count === 0 || count > 1 ? `records` : 'record'}`}{' '} + {data.is_estimate ? '(estimated)' : ''} +
)} - - )} - {isError && ( -- Error fetching records count. Please refresh the page. -
- )} + {data.is_estimate && ( ++ Click to retrieve the exact count of the table. +
+
+ )
+}
diff --git a/apps/studio/components/interfaces/App/FeaturePreview/useFeaturePreviews.ts b/apps/studio/components/interfaces/App/FeaturePreview/useFeaturePreviews.ts
index c836053ce04..ea5083c1df6 100644
--- a/apps/studio/components/interfaces/App/FeaturePreview/useFeaturePreviews.ts
+++ b/apps/studio/components/interfaces/App/FeaturePreview/useFeaturePreviews.ts
@@ -20,6 +20,7 @@ export const useFeaturePreviews = (): FeaturePreview[] => {
const tableEditorNewFilterBar = useFlag('tableEditorNewFilterBar')
const pgDeltaDiffEnabled = useFlag('pgdeltaDiff')
const jitDbAccessEnabled = useFlag('jitDbAccess')
+ const platformWebhooksEnabled = useFlag('platformWebhooks')
return [
{
@@ -68,6 +69,15 @@ export const useFeaturePreviews = (): FeaturePreview[] => {
isDefaultOptIn: false,
enabled: jitDbAccessEnabled,
},
+ {
+ key: LOCAL_STORAGE_KEYS.UI_PREVIEW_PLATFORM_WEBHOOKS,
+ name: 'Platform webhooks',
+ discussionsUrl: undefined,
+ isNew: true,
+ isPlatformOnly: true,
+ isDefaultOptIn: false,
+ enabled: platformWebhooksEnabled,
+ },
{
key: LOCAL_STORAGE_KEYS.UI_PREVIEW_API_SIDE_PANEL,
name: 'Project API documentation',
diff --git a/apps/studio/components/interfaces/Auth/AuthProvidersForm/ProviderForm.tsx b/apps/studio/components/interfaces/Auth/AuthProvidersForm/ProviderForm.tsx
index daf0e8bbe13..594b16b7d37 100644
--- a/apps/studio/components/interfaces/Auth/AuthProvidersForm/ProviderForm.tsx
+++ b/apps/studio/components/interfaces/Auth/AuthProvidersForm/ProviderForm.tsx
@@ -1,11 +1,4 @@
import { PermissionAction } from '@supabase/shared-types/out/constants'
-import { Check } from 'lucide-react'
-import { useTheme } from 'next-themes'
-import { useQueryState } from 'nuqs'
-import { useEffect, useState } from 'react'
-import ReactMarkdown from 'react-markdown'
-import { toast } from 'sonner'
-
import { useParams } from 'common'
import { Markdown } from 'components/interfaces/Markdown'
import { ButtonTooltip } from 'components/ui/ButtonTooltip'
@@ -13,17 +6,23 @@ import { DocsButton } from 'components/ui/DocsButton'
import { ResourceItem } from 'components/ui/Resource/ResourceItem'
import type { components } from 'data/api'
import { useAuthConfigUpdateMutation } from 'data/auth/auth-config-update-mutation'
-import { useProjectSettingsV2Query } from 'data/config/project-settings-v2-query'
-import { useCustomDomainsQuery } from 'data/custom-domains/custom-domains-query'
import { useAsyncCheckPermissions } from 'hooks/misc/useCheckPermissions'
import { useSelectedOrganizationQuery } from 'hooks/misc/useSelectedOrganization'
import { BASE_PATH } from 'lib/constants'
+import { Check } from 'lucide-react'
+import { useTheme } from 'next-themes'
+import { useQueryState } from 'nuqs'
+import { useEffect, useState } from 'react'
+import ReactMarkdown from 'react-markdown'
+import { toast } from 'sonner'
import { Button, Form, Input, Sheet, SheetContent, SheetFooter, SheetHeader, SheetTitle } from 'ui'
import { Admonition } from 'ui-patterns'
+
import { NO_REQUIRED_CHARACTERS } from '../Auth.constants'
import { AuthAlert } from './AuthAlert'
import type { Provider } from './AuthProvidersForm.types'
import FormField from './FormField'
+import { useProjectApiUrl } from '@/data/config/project-endpoint-query'
interface ProviderFormProps {
config: components['schemas']['GoTrueConfigResponse']
@@ -42,6 +41,8 @@ export const ProviderForm = ({ config, provider, isActive }: ProviderFormProps)
const [open, setOpen] = useState(false)
const { mutate: updateAuthConfig, isPending: isUpdatingConfig } = useAuthConfigUpdateMutation()
+ const { data: endpoint } = useProjectApiUrl({ projectRef })
+
const { can: canUpdateConfig } = useAsyncCheckPermissions(
PermissionAction.UPDATE,
'custom_config_gotrue'
@@ -67,12 +68,6 @@ export const ProviderForm = ({ config, provider, isActive }: ProviderFormProps)
}
const isFreePlan = organization?.plan.id === 'free'
- const { data: settings } = useProjectSettingsV2Query({ projectRef })
- const protocol = settings?.app_config?.protocol ?? 'https'
- const endpoint = settings?.app_config?.endpoint
- const apiUrl = `${protocol}://${endpoint}`
-
- const { data: customDomainData } = useCustomDomainsQuery({ projectRef })
const INITIAL_VALUES = (() => {
const initialValues: { [x: string]: string | boolean } = {}
@@ -247,11 +242,7 @@ export const ProviderForm = ({ config, provider, isActive }: ProviderFormProps)
readOnly
disabled
label="Callback URL (for OAuth)"
- value={
- customDomainData?.customDomain?.status === 'active'
- ? `https://${customDomainData.customDomain?.hostname}/auth/v1/callback`
- : `${apiUrl}/auth/v1/callback`
- }
+ value={`${endpoint}/auth/v1/callback`}
descriptionText={
+ Configure webhook endpoints and review deliveries from both project and organization + settings pages. +
+-
+
-
+ Project scope:{' '}
+
Project Webhooks +
+ -
+ Organization scope:{' '}
+
Organization Webhooks +
+
-
+
+ {statements.length > 0 && (
+ - The following statements will be executed on the selected function: -
-
+
+ )}
) : (
+ The following statements will be executed on the selected function: +
+
@@ -470,7 +484,9 @@ export const CreateHookSheet = ({
className="rounded-l-none text-xs"
onClick={() => {
const authHookSecret = generateAuthHookSecret()
- form.setValue('httpsValues.secret', authHookSecret)
+ form.setValue('httpsValues.secret', authHookSecret, {
+ shouldDirty: true,
+ })
}}
>
Generate secret
@@ -494,7 +510,7 @@ export const CreateHookSheet = ({
)}
-