## What kind of change does this PR introduce?
Docs update. Aligns documentation and style guides with the **Sign in /
Sign out / Sign up** platform standard.
Closes DOCS-1328. Related to
[#49874](https://github.com/supabase/supabase/pull/49874).
## What is the current behavior?
Docs style guides prefer _login_ / _log in_. Guide prose uses mixed
login and sign in wording.
## What is the new behavior?
- [WORD_LIST.md](apps/docs/WORD_LIST.md) and
[copywriting.mdx](apps/design-system/content/docs/copywriting.mdx)
document the sign in standard
- Design-system auth examples updated
- Guide prose and API reference spec descriptions updated
### Terminology
**Standard:** Use _sign in_, _sign out_, and _sign up_ as verbs. Use
_sign-in_, _sign-out_, and _sign-up_ as nouns and adjectives. Match
Studio UI labels (**Sign in**, **Sign out**, **Sign up**).
**Preserved intentionally:**
| Category | Keep as-is | Example |
| -------- | ---------- | ------- |
| Feature name | social login | `/social-login`, `features.mdx` heading,
OAuth provider section |
| URL slugs | `login` in paths | `/phone-login`, `/login-flows`,
`choosing-login-flow` |
| CLI | `supabase login` / `supabase logout` | Reference ids
`supabase-login` / `supabase-logout`; executable commands unchanged |
| SDK methods | `logout()` | Kotlin/Swift method names in API reference
titles and examples |
| Third-party UI | Provider product labels | Facebook Login, Kakao
Login, portal **Login** buttons |
| Postgres | Database terminology | login privileges, login credentials,
login via role |
| Audit/logging | Log prose | "Generates the following **log** in the
Postgres Logs" |
| Code and routes | Paths and filenames | `app/login/`, `Login.tsx`,
`demos/android-login` |
| External URLs | Third-party login pages | `dash.cloudflare.com/login`,
`console.neon.tech/login`, `vercel.com/login` |
| API identifiers | Event and field names | Audit actions
`login`/`logout`, `should_logout_user` |
## To test
- Run `pnpm lint:mdx` in `apps/docs`
- Spot-check `features.mdx`, `social-login.mdx`, and a provider guide
(e.g. Facebook, Kakao)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Standardized authentication terminology across guides, reference
material, CLI documentation, and copywriting guidance using “sign in,”
“sign out,” and “sign up.”
* Updated authentication instructions, headings, link text, examples,
and SSO guidance for clearer, more consistent wording.
* Corrected related grammar, spelling, hyphenation, and documentation
links while preserving established product names and implementation
commands.
* **Style**
* Refined code examples with consistent import ordering and spacing.
* **Examples**
* Updated authentication button and menu labels to “Sign in” and “Sign
out.”
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Updates docs based on recent SDK changes across three of the six tracked
SDKs. `supabase-py`, `supabase-kt`, and `supabase-csharp` were also
analyzed this cycle but had no doc-worthy changes (internal bug fixes /
dependency bumps only, or no new commits).
## Changes analyzed
| SDK | Repo | Commits | Latest tag |
|---|---|---|---|
| js | https://github.com/supabase/supabase-js | `485695ff7...21e410f56`
| v3.0.0-next.29 |
| dart | https://github.com/supabase/supabase-flutter |
`6979093...5447063` | yet_another_json_isolate-v2.1.1 |
| py | https://github.com/supabase/supabase-py | `3c98900...0490201` |
v3.0.0a1 |
| swift | https://github.com/supabase/supabase-swift |
`c24795d...51a083a` | v2.54.1 |
| kt | https://github.com/supabase-community/supabase-kt | (no new
commits) | 3.7.0 |
| csharp | https://github.com/supabase-community/supabase-csharp |
`572624e...ac057a2` | v1.5.0 |
## Documentation updates
- **`apps/docs/content/guides/auth/sessions/pkce-flow.mdx`** — new
"Overlapping flows" section documenting the experimental
`appendPkceFlowIdToRedirects` option and `flowId`-aware
`exchangeCodeForSession()`, added in supabase-js #2569, which fixes
concurrent PKCE flows (e.g. multiple tabs) clobbering each other's
stored code verifier.
- **`apps/docs/spec/supabase_dart_v2.yml`** — `stream()` entry:
documented the new filter methods (`like`, `ilike`, `match`, `imatch`,
`isFilter`, `isDistinct`) and multi-filter chaining added in
supabase-flutter #1610, plus two behavioral caveats (filter
re-evaluation on UPDATE, primary-key-only DELETE payloads) and a new
example.
- **`apps/docs/spec/supabase_swift_v2.yml`**:
- `invoke()` entry: documented the new `timeoutInterval` override on
`FunctionInvokeOptions` (supabase-swift #1144), with a new example.
- Added missing `generate-link` and `signOut()` (admin) spec entries —
supabase-swift #1152 added these methods but Swift had no reference
entries for them, even though the shared nav ids already existed in
`common-client-libs-sections.json` for other SDKs.
## Test plan
- [x] `python3 -c "import yaml; yaml.safe_load(...)"` on both edited
YAML spec files — parses cleanly
- [x] `npx prettier --check` on all three changed files — passes
- [ ] Visual check of rendered reference pages for the new Swift
`generate-link` / `signOut` / timeout examples and the Dart `stream()`
multi-filter example (docs dev server)
---
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Documentation**
- Added guidance for experimental overlapping PKCE authentication flows,
including separating concurrent flows and exchanging their flow IDs.
- Expanded Dart streaming documentation with filter operators,
multiple-filter behavior, update semantics, delete payloads, and
chained-filter examples.
- Added Swift documentation for admin link generation, user sign-out,
and configurable Edge Function timeouts.
- Documented the default 150-second Edge Function idle timeout and
per-invocation timeout overrides.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
## Summary
Cross-referenced recent commits across all 6 SDK repos (supabase-js,
supabase-flutter, supabase-py, supabase-swift, supabase-kt,
supabase-csharp) against `apps/docs/spec/` and
`apps/docs/content/guides/`. Most recent commits were
CI/chore/release/patch-fix noise; the following genuine feature gaps
were found and fixed.
## Changes analyzed
- **supabase-swift**: `dryRun()`, `notIn()`, `maybeSingle()` (PR
supabase/supabase-swift#1114) and `signInWithWeb3()` (PR
supabase/supabase-swift#1138)
- **supabase-kt**: `dryRun()`, `notIn()`, `maybeSingle()` (PR
supabase-community/supabase-kt#1365)
## Documentation updates
- `apps/docs/spec/supabase_swift_v2.yml` — added `notin`, `dry-run`,
`maybe-single` filter/modifier entries and a `sign-in-with-web3` auth
entry (Web3/Ethereum/Solana sign-in was already documented for JS and
Dart, missing for Swift)
- `apps/docs/spec/supabase_kt_v3.yml` — added `notin`, `maybe-single`,
`dry-run` entries
- `apps/docs/spec/common-client-libs-sections.json` — registered nav
entries for the two brand-new cross-SDK ids (`notin`, `dry-run`);
`sign-in-with-web3` was already registered
## Explicitly out of scope
- **Kotlin `custom_claims_allowlist`** (added to
`CustomOAuthProvider`/`CustomProviderBuilder` in supabase-kt) — skipped.
The Kotlin spec has no admin custom-OAuth-provider section documented at
all yet (create/list/get/update/delete), so adding just this one field
would require authoring a whole new, currently-undocumented admin API
section from scratch — too large/risky to guess correctly in this pass.
Flagging for a follow-up.
- Dart's recently-shipped storage features (vector buckets,
analytics/Iceberg buckets, `purgeCache`, `downloadStream`,
`listPaginated`) were checked and are already fully documented in
`supabase_dart_v2.yml`.
- Swift/Kotlin lacking Storage vector-bucket/analytics-bucket docs — out
of scope, those SDKs didn't ship that feature in this commit range
(Dart-only so far).
## Test plan
- [x] `python3 -c "import yaml; yaml.safe_load(open(...))"` — both
edited YAML specs parse cleanly
- [x] `python3 -c "import json; json.load(open(...))"` — nav JSON parses
cleanly
- [ ] Visual check of the rendered reference pages for
`notIn`/`dryRun`/`maybeSingle`/`signInWithWeb3` on Swift and Kotlin
reference docs
---
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added documentation for `notIn()` query filtering across supported
Kotlin and Swift query operations.
* Documented `maybeSingle()` for safely handling zero-or-one query
results without raising a single-row error.
* Added guidance for `dryRun()` mutations, including rollback behavior
and returned results.
* Added Swift authentication documentation for Web3 sign-in with
Ethereum and Solana credentials.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
## Summary
Updates SDK reference docs and the client-side tracing guide based on
recent releases across all six Supabase SDKs.
## SDKs analyzed
| SDK | Repo | Latest commit | Latest tag |
|-----|------|--------------|------------|
| js | supabase/supabase-js | `e4e8864` | v3.0.0-next.29 |
| dart | supabase/supabase-flutter | `c3e3602` |
yet_another_json_isolate-v2.1.1 |
| py | supabase/supabase-py | `6570638` | v3.0.0a1 |
| swift | supabase/supabase-swift | `ebef170` | v2.51.0 |
| kt | supabase-community/supabase-kt | `e23df20` | 3.7.0-beta-1 |
| csharp | supabase-community/supabase-csharp | `3fad62f` | v1.1.2 |
## Documentation changes
### `apps/docs/spec/supabase_dart_v2.yml`
- **OAuth Server API**
([supabase-flutter#1561](https://github.com/supabase/supabase-flutter/pull/1561)):
Added `oauth-server-api` group stub and `listGrants()` / `revokeGrant()`
method entries, matching the existing `common-client-libs-sections.json`
nav IDs.
- **`listBuckets()` options**
([supabase-flutter#1557](https://github.com/supabase/supabase-flutter/pull/1557)):
Added example showing `ListBucketsOptions` with `search`, `limit`,
`offset`, `sortColumn`, and `sortOrder`.
### `apps/docs/spec/supabase_py_v2.yml`
- **`on_postgres_changes` `select` param**
([supabase-py#1524](https://github.com/supabase/supabase-py/pull/1524)):
Added `listening-to-selected-columns` example for the new `select=["id",
"name"]` parameter.
- **Expanded filter operators**
([supabase-py#1524](https://github.com/supabase/supabase-py/pull/1524)):
Updated `listening-to-row-level-changes` note to list all supported
operators (`eq`, `neq`, `lt`, `lte`, `gt`, `gte`, `in`, `like`, `ilike`,
`is`, `match`, `imatch`, `isdistinct`) plus `not.` prefix and comma-AND.
### `apps/docs/spec/supabase_swift_v2.yml`
- **OpenTelemetry tracing setup**
([supabase-swift#1101](https://github.com/supabase/supabase-swift/pull/1101)):
Added `initialize-client-with-opentelemetry` example under the
`initializing` section documenting the `OpenTelemetry` SwiftPM package
trait, provider wiring, and known `_invokeWithStreamedResponse`
limitation.
### `apps/docs/content/guides/telemetry/client-side-tracing.mdx`
- **Merged Swift and Dart tracing docs** into the existing JS guide
([supabase-swift#1101](https://github.com/supabase/supabase-swift/pull/1101),
[supabase-flutter#1564](https://github.com/supabase/supabase-flutter/pull/1564)).
- **Converted to tabbed layout** (`<Tabs queryGroup="language">`) with
JavaScript / Swift / Dart tabs, matching the pattern used across other
multi-SDK guides.
- Updated title to "Client-side tracing" and nav label accordingly.
## SDKs with no doc-worthy changes
- **js**: Bug fixes only (auth session clearing, realtime heartbeat
suppression) — no new API surface.
- **kt**: PKCE for `resend()` — behavioral enhancement, no new spec
entry needed.
- **csharp**: Chore/compliance/maintenance only.
---
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added Dart “OAuth Server” API docs for listing OAuth grants and
revoking grants (including signed-in context and the `clientId`
parameter), with examples.
* Extended Dart Storage docs with a new `listBuckets` example using
`ListBucketsOptions` for filtering, pagination, and sorting.
* Updated Python Realtime docs with generalized PostgREST-style row
filter operators and added examples for listening to selected columns.
* Reworked the “Client-side tracing” guide across JS, Swift, and Dart,
including expanded configuration and troubleshooting (trace propagation
and `traceparent` details).
* Renamed the telemetry navigation label to “Client-side tracing.”
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## Problem
The Docs E2E link checker found broken links throughout docs, starting
with `phone-login.mdx` pointing to `/docs/guides/cli/config` (404).
Old links like `/docs/guides/cli/config` still work on the live site
because `supabase.com` has redirects set up for them, but these links
break on the docs preview site, which is what the E2E check tests
against. These issues look clean on the live site, and I didn't catch
them in my first pass because I was testing production instead of the
preview.
The E2E check only tests the ~20 pages a given PR happens to touch, so
fixing the pages it flagged kept exposing more of the same problem one
page at a time as each fix pulled in a new file. To stop chasing this
incrementally, I cross-referenced every `/docs/guides/*` and
`/docs/reference/*` redirect source in `apps/www/lib/redirects.js`
against actual usage across all of `apps/docs`, and verified each
candidate against the live preview.
## Solution
Rather than updating the Docs E2E link checker, this PR resolves the
links. **Why:** we own these docs, so keeping the links clean without
redirects is keeping the house maintained. See [Broken Window
Theory](https://blog.codinghorror.com/the-broken-window-theory/).
Updated every link still using an old path to point straight at the
current page instead of relying on a redirect. This covers old links
like:
- `/docs/guides/cli/config` →
`/docs/guides/local-development/cli/config`
- `/docs/guides/cli/getting-started` →
`/docs/guides/local-development/cli/getting-started`
- `/docs/guides/cli/local-development` →
`/docs/guides/local-development/database-migrations`
- `/docs/guides/cli/managing-environments` →
`/docs/guides/deployment/managing-environments`
- `/docs/guides/cli/seeding-your-database` →
`/docs/guides/local-development/seeding-your-database`
- bare `/docs/guides/cli` → `/docs/guides/local-development`
- `/docs/guides/platform/compute-add-ons` →
`/docs/guides/platform/compute-and-disk`
- `/docs/guides/platform/shared-responsibility-model` →
`/docs/guides/deployment/shared-responsibility-model`
- `/docs/guides/database` → `/docs/guides/database/overview`
- `/docs/reference/javascript`, `/docs/reference/dart`,
`/docs/reference/kotlin`, `/docs/reference/python`,
`/docs/reference/csharp` → their `/introduction` pages (the redirect's
own destination, `/start`, turned out to be dead even on production — a
separate bug in `redirects.js` I didn't touch here)
- and about 35 more of the same pattern, listed in the commit messages
Also fixed a handful of dead heading anchors found along the way (links
that resolve to the right page but point at a `#section` that got
renamed or moved), including the original `#bigquery` anchor and a few
in `connecting-to-postgres.mdx` where content moved to its own dedicated
page.
Left alone on purpose:
- `content/guides/cli.mdx` — this page has no route in the docs app at
all (no `app/guides/cli/` directory), so it 404s even in production
before the `www` redirect ever fires. Fixing its internal link wouldn't
change that; it needs an actual routing/content decision, not a link
fix.
- A few candidates that already resolve fine as-is (`pg_partman`, bare
`/docs/reference/api`, bare `/docs/reference/cli`) — confirmed via curl,
left untouched.
## Manual testing
1. Confirmed every new link target actually exists by checking the
destination file/page and matching heading anchors.
2. Cross-referenced every `/docs/guides/*` and `/docs/reference/*`
redirect source in `apps/www/lib/redirects.js` against real usage in
`apps/docs`, and curl-verified each old path (404) and new path (200)
against the live PR preview before fixing it.
3. Ran the Docs E2E link checker locally against changed pages.
4. Spot-checked the original broken link from CI
(`/docs/guides/cli/config`) to confirm it now points to a working page.
## Summary
Updates reference specs based on new stable releases in two SDK repos
(JS spec is auto-generated and was excluded).
## Changes analyzed
| SDK | Repo | Stable tag range |
|-----|------|-----------------|
| dart | supabase/supabase-flutter |
`supabase_flutter-v2.15.0...supabase_flutter-v2.15.4` |
| swift | supabase/supabase-swift | `v2.48.0...v2.49.0` |
## Documentation updates
### Dart (supabase_flutter-v2.15.0 → v2.15.4)
- **`supabase_dart_v2.yml`**: Updated `deleteUser()` — added
`shouldSoftDelete: bool` parameter with example
- **`supabase_dart_v2.yml`**: Updated `from.createSignedUrl()` — added
`download: DownloadBehavior?` parameter with example
- **`supabase_dart_v2.yml`**: Updated `from.getPublicUrl()` — added
`download: DownloadBehavior?` parameter with example
- **`supabase_dart_v2.yml`**: Added new `from-create-signed-upload-url`
entry with `upsert: bool` parameter (was missing from the Dart spec)
### Swift (v2.48.0 → v2.49.0)
- **`supabase_swift_v2.yml`**: Updated `explain()` — added note on
`ExplainFormat` enum (`.text`/`.json`), added JSON format example
- **`supabase_swift_v2.yml`**: Updated `createBucket()` and
`updateBucket()` examples — `BucketOptions(public:)` renamed to
`BucketOptions(isPublic:)`
- **`supabase_swift_v2.yml`**: Updated `createSignedURL()` and
`getPublicURL()` download examples — `download: Bool` replaced by
`download: DownloadBehavior?` (`.withOriginalName` / `.named()`)
---
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added guidance for soft-deleting users, including a new example.
* Documented download behavior for signed URLs and public URLs,
including original or custom filenames.
* Added documentation and examples for generating signed upload URLs,
with optional overwrite support.
* Expanded query plan documentation to show JSON output.
* Updated storage examples to match the latest option names and
recommended usage.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude <noreply@anthropic.com>
## Summary
Updates docs based on stable releases in `supabase/supabase-swift`.
## Changes analyzed
- **SDK**: swift
- **Repo**: https://github.com/supabase/supabase-swift
- **Stable tag range**: `v2.47.2...v2.48.0`
- **Commits**:
`716e0de6e7e0ec8eba54c6c4dfb8e980b3d51370...e5020ae5a1d01c46cc60fb5eb01157666d7214b6`
## Documentation updates
### `apps/docs/spec/supabase_swift_v2.yml`
- Added `sign-in-with-passkey` entry —
`signInWithPasskey(presentationAnchor:)` high-level helper (iOS
16+/macOS 13+, experimental)
- Added `register-passkey` entry —
`registerPasskey(presentationAnchor:)` high-level helper (iOS 16+/macOS
13+, experimental)
- Added `passkey-api` group stub with 7 lower-level method entries:
- `passkey-list` — `listPasskeys()`
- `passkey-update` — `renamePasskey(id:friendlyName:)`
- `passkey-delete` — `deletePasskey(id:)`
- `passkey-start-registration` — `getPasskeyRegistrationOptions()`
- `passkey-verify-registration` —
`verifyPasskeyRegistration(challengeId:credentialResponse:)`
- `passkey-start-authentication` — `getPasskeyAuthenticationOptions()`
- `passkey-verify-authentication` —
`verifyPasskeyAuthentication(challengeId:credentialResponse:)`
- Updated `auth-mfa-api` overview notes to mention WebAuthn MFA
(experimental)
- Updated `mfa-enroll` notes and added `enrollWebAuthnFactor` example
- Updated `mfa-verify` notes and added `verifyWebAuthnFactor` example
### `apps/docs/content/guides/auth/passkeys.mdx`
- Added Swift tabs to: Enable in the client, Register a passkey, Sign in
with a passkey, Two-step API, Manage passkeys
- Updated SDK version note to include `supabase-swift` v2.48.0
- Updated reference links to include Swift
All new Swift passkey APIs are gated behind `@_spi(Experimental) import
Supabase`.
---
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Documentation
* Expanded Swift SDK passkeys documentation to cover enabling,
registering, signing in, managing, and Admin-related notes.
* Added experimental Swift guidance for WebAuthn/passkeys, including
updated minimum SDK version requirements.
* Extended MFA to support WebAuthn/passkeys enrollment and verification
(in addition to existing methods).
* Added reference documentation for low-level passkey APIs to support
custom authentication flows.
## Chores
* Updated documentation linting spell-check allow list to include
**visionOS**.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude <noreply@anthropic.com>
## Description
Replaces legacy `anon` / `service_role` key references with the new
`publishable` / `secret` naming across SDK spec files under
`apps/docs/spec/`. Mirrors the rename table established by
[supabase-js#2280](https://github.com/supabase/supabase-js/pull/2280),
so the auto-generated reference docs at
supabase.com/docs/reference/{js,dart,kotlin,python,swift} stay
consistent with the SDK source.
## Files changed
| File | Highlights |
| --- | --- |
| `supabase_js_v2.yml` | Rename example vars `anon_key` →
`publishable_key`, `service_role_key` → `secret_key`; admin notes use
`secret`. |
| `supabase_dart_v2.yml` | Rename `anonKey` param → `publishableKey`
(matches the live Flutter SDK — see
[supabase-flutter/supabase.dart#L81](https://github.com/supabase/supabase-flutter/blob/main/packages/supabase_flutter/lib/src/supabase.dart#L81));
update call-site; example var `serviceRoleKey` → `secretKey`; admin
notes use `secret`. |
| `supabase_kt_v2.yml`, `supabase_kt_v3.yml` | Replace
`'publishable-or-anon-key'` placeholders with `'your-publishable-key'`;
admin notes use `secret`; fix `importAuthToken(\"service_role\")` →
`importAuthToken(\"your-secret-key\")` (the Kotlin SDK's
`importAuthToken(accessToken: String, …)` takes a JWT, not a role name).
|
| `supabase_py_v2.yml` | All `service_role` references → `secret`;
example var `service_role_key` → `secret_key`. |
| `supabase_swift_v2.yml` | Replace placeholders with
`'your-publishable-key'`; admin notes use `secret`; example var
`serviceRoleKey` → `secretKey`. |
| `storage_v0_config.yaml` | Rewrite `ANON_KEY` / `SERVICE_KEY` env var
**descriptions** in publishable/secret terms. **Env var names kept** —
see below. |
## Why the storage env var names are unchanged
`storage_v0_config.yaml` documents the env vars used to configure the
storage server (multi-tenant deployments). The `id` and `title` fields
must match the actual env var names the binary reads. The storage server
still reads its config from env vars literally named `ANON_KEY` and
`SERVICE_KEY`:
-
[`storage/src/config.ts#L614`](https://github.com/supabase/storage/blob/master/src/config.ts#L614)
— `getOptionalConfigFromEnv('SERVICE_KEY')`
-
[`storage/src/config.ts#L625`](https://github.com/supabase/storage/blob/master/src/config.ts#L625)
— `getOptionalConfigFromEnv('ANON_KEY')`
There is no `PUBLISHABLE_KEY` / `SECRET_KEY` reader on master. Renaming
the doc IDs would break self-hosted deployments — users following the
docs would set the wrong env var and the storage server would silently
fall back to generating its own JWT. Until the storage server itself
adds publishable/secret env support, only descriptions can be updated.
(Same reasoning for not bumping `storage_v0_config.yaml` →
`storage_v1_config.yaml`: the `_v0_` tracks the storage server's own API
version, paired with `storage_v0_openapi.json` downloaded from
`supabase.github.io/storage/api.json`. The server hasn't shipped a v1
API.)
## What we deliberately did NOT rename
Per the same rules established in supabase-js#2280:
- **JWT role claims** like `role: 'anon'` / `role: 'service_role'` —
these are functional Postgres role names in JWT payloads, not key
labels.
- **Real SDK identifiers** that haven't been renamed in the source (we
only rename in the doc when the underlying SDK rename has shipped). The
Dart `anonKey` rename was safe to apply because the Flutter SDK already
ships `publishableKey` as the preferred named parameter (with `anonKey`
`@Deprecated`).
## Out of scope
- **All `*_v1.yml` SDK spec files** (`supabase_js_v1`,
`supabase_dart_v1`, `supabase_kt_v1`, `supabase_swift_v1`). Older SDK
versions, not worth churning.
- **`cli_v1_commands.yaml`**. This file is auto-generated by the CLI
repo's release workflow
([`cli/tools/bumpdoc/main.go`](https://github.com/supabase/cli/blob/develop/tools/bumpdoc/main.go))
and the example outputs come from
[`cli/docs/templates/examples.yaml`](https://github.com/supabase/cli/blob/develop/docs/templates/examples.yaml)
— embedded in the CLI binary at build time. Any edits we make here would
be clobbered by the next CLI release. The fix needs to land upstream in
the CLI repo (note: the CLI itself already ships publishable/secret
naming in \`supabase status\` output — see
[`cli/internal/status/status.go#L40-L44`](https://github.com/supabase/cli/blob/develop/internal/status/status.go#L40-L44)
— but the doc-generation template is stale).
- **`supabase_csharp_v0.yml` / `supabase_csharp_v1.yml`** — checked,
already neutral. Both files use a generic `SUPABASE_KEY` env var with no
`anon` / `service_role` references.
- **Renaming the legacy Dart `anonKey` parameter itself** — that's an
SDK-side change. The Flutter SDK already exposes `publishableKey` as the
preferred parameter; full removal of `anonKey` will happen in a future
major version per the SDK's own deprecation comment.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Standardized API key naming across SDK docs: use publishable (client)
and secret (server/admin) key terminology
* Updated server-side admin examples and warnings to require secret keys
and emphasize never exposing them in client code
* Unified initialization examples across JavaScript, Dart, Kotlin,
Python, and Swift
* Corrected Storage spec metadata to point to the proper configuration
file
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Replaces "stored procedures" with "functions" for everything related to
the Data API.
## Additional context
It's not accurate to call database functions "stored procedures". It may
have been that way before Postgres 11, but now it causes confusion
because PostgREST allows functions and not stored procedures.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Standardized terminology across docs, SDK guides, CLI/config specs,
examples, UI, and config comments to use "database functions" instead of
"stored procedures".
* Updated API docs, CLI/config descriptions, Studio UI labels, help
text, empty-state and navigation copy, RPC documentation, and example
text for consistency.
* Adjusted explanatory text and error/help messages to reflect the
revised terminology.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
This PR updates documentation based on recent changes across multiple
SDK repositories since the last run on 2026-01-22.
## Changes Analyzed
| SDK | Repository | Commits | Latest Tag |
|-----|-----------|---------|------------|
| **js** | supabase/supabase-js | 40 | v2.95.4-canary.2 |
| **dart** | supabase/supabase-flutter | 4 | - |
| **py** | supabase/supabase-py | 12 | v2.28.0 |
| **swift** | supabase/supabase-swift | 14 | v2.41.1 |
| **kt** | supabase-community/supabase-kt | 36 | 3.3.0 |
| **csharp** | supabase-community/supabase-csharp | 1 | v1.1.2 |
## Documentation Updates
### JavaScript SDK (`supabase_js_v2.yml`)
- Added optional `jwt` parameter documentation to
`mfa.getAuthenticatorAssuranceLevel()`
- Added `timeout` and `urlLengthLimit` options to `PostgrestClient`
constructor with example
### Kotlin SDK (`supabase_kt_v3.yml`)
- Added new `getClaims()` API section with description, parameters, and
3 examples
- Added `channel` parameter to OTP `signInWith` config for WhatsApp
support
- Added WhatsApp OTP sign-in example
### Python SDK (`supabase_py_v2.yml`)
- Added `from_.list_v2()` method documentation with cursor-based
pagination support
- Includes `SearchV2Options` parameter documentation and pagination
example
- Added note about new User model fields (`is_sso_user`, `deleted_at`,
`banned_until`) on `get_user`
### Swift SDK (`supabase_swift_v2.yml`)
- Added breaking change note for `mfa.unenroll()`: response now uses
`id` instead of `factorId` (since v2.41.1)
### Phone Login Guide (`phone-login.mdx`)
- Added Kotlin WhatsApp OTP example to the sign-in section
### SDKs with no documentation updates needed
- **Dart**: Only CI and realtime type-cast fix (no user-facing API
changes)
- **C#**: Only README badge fix
## Test plan
- [ ] Verify YAML spec files parse correctly
- [ ] Review rendered documentation for new sections
- [ ] Confirm code examples match actual SDK APIs
---
Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This PR updates the Swift SDK documentation to reflect new features from recent merged PRs in supabase-swift:
## Documentation Updates
### PR #812: getClaims method
- Added documentation for new `getClaims()` method for JWT verification
- Supports both symmetric (HS256) and asymmetric (RS256) JWTs
- Includes global JWKS caching with 10-minute TTL
- Handles key rotation gracefully
- Examples: current session, custom JWT, expired tokens, custom JWKS
### PR #809: OAuth 2.1 client admin endpoints
- Added documentation for OAuth 2.1 client administration endpoints
- New methods: `listClients()`, `createClient()`, `getClient()`, `deleteClient()`, `regenerateClientSecret()`
- All methods under `admin.oauth` namespace requiring `service_role` key
- Includes pagination support for listing clients
### PR #806: forceFunctionRegion query parameter
- Updated `invoke()` documentation to mention both `x-region` header and `forceFunctionRegion` query parameter
- Both are set when a region is specified for better function routing
### PR #805: broadcast replay configuration
- Added example for configuring broadcast with replay support
- Shows `ReplayOption` with `since` and `limit` parameters
- Demonstrates how to detect replayed messages via `meta` field
### PR #795: maxAffected method
- Already documented in previous commit (7c29f852c0)
- No changes needed
## Files Updated
- apps/docs/spec/supabase_swift_v2.yml
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
* docs: add missing Swift client functions to specification
Add comprehensive documentation for 26 previously undocumented Swift functions:
- feat: add 17 database filter functions (eq, neq, gt, gte, lt, lte, like, ilike, is, in, contains, containedBy, overlaps, range functions, textSearch)
- feat: add 5 Admin API functions (getUserById, listUsers, createUser, updateUserById, inviteUserByEmail)
- feat: add 2 session management functions (startAutoRefresh, stopAutoRefresh)
- feat: add 2 storage signed URL functions (createSignedUploadUrl, uploadToSignedUrl)
These functions exist in the Swift library but were missing from the documentation spec,
causing a perceived gap compared to the JavaScript client. All additions include proper
Swift syntax examples, async/await patterns, and comprehensive usage documentation.
Closes alignment gap between Swift and JavaScript client documentation.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* fix params
---------
Co-authored-by: Claude <noreply@anthropic.com>
* Move the spec/parser package into packages folder.
* Fix the spec generation with the new paths.
* Remove the spec folder from prettierignore.
* Run prettier on the spec folder (without regenerating, that's should be done by the product teams).
Danny White