* docs: clarify requirement for combining restrictive policy with permissive policy
Adding a note like this would have saved me hours, explaining that a single 'restrictive' RLS policy alone will fail unless combined with another policy that returns true, ensuring the combined OR condition is satisfied. This clarifies the need for at least one policy to explicitly grant access when multiple RLS policies are in place.
* Update apps/docs/content/guides/auth/auth-anonymous.mdx
---------
Co-authored-by: Charis <26616127+charislam@users.noreply.github.com>
* docs: update React quickstart guide with recommended alternatives to create-react-app
- Removed deprecated 'npx create-react-app' command
- Added Next.js, React Router, and Expo alternatives
- Included React team's official deprecation notice link
* Removed multiple options and provided Vite as the recommendation.
---------
Co-authored-by: Karthika Jayaprakash <karthikajayaprakash@Karthikas-MacBook-Air.local>
* updated the auth email templates doc with .Email and .NewEmail template variables
* fixed a minor detail on the variable description text
* fixed a typo
* feat: add documentation and UI integration for Before User Created hook
- Added new guide: `before-user-created-hook.mdx`, documenting usage, inputs,
outputs, and multiple complete examples for HTTP and SQL.
- Updated navigation menu and hook index table to include the new hook.
- Hook is now listed as available on Free and Pro plans.
Studio changes:
- Registered `Before User Created` hook in `hooks.constants.ts` with proper
title, slug, and configuration keys.
- Enabled Docs button linking to hook guide in both `CreateHookSheet` and `HookCard` components.
- Extended hook listing page to support docs access via `secondaryActions`.
This hook allows developers to intercept and reject user creation across all
flows (email/password, OAuth, SSO, SAML, anonymous) - enabling custom signup
logic like domain allowlists, geofencing, or account gating.
* fix: add subnet to mdx lint allowed list
* fix: incorporate feedback and spelling changes
* feat: add allow/deny domain and CIDR examples to before-user-created hook
This commit enhances the documentation for the before-user-created auth hook:
- Adds production-ready SQL examples for blocking or allowing signups by email domain (signup_email_domains) and IP address or CIDR (signup_networks)
- Introduces enum-based classification (allow vs deny) for both domain and network restrictions
- Adds full migration-style snippets for easy copy/paste into Supabase SQL Editor
- Includes updated HTTP examples that delegate to Postgres functions via Supabase client rpc()
- Adds environment setup guidance and edge function scaffolding
* fix: pnpm format
---------
Co-authored-by: Chris Stockton <chris.stockton@supabase.io>
* Update auth-apple.mdx
Add notes on to add all custom identifier for expo development build
* fix lint error
---------
Co-authored-by: Charis Lam <26616127+charislam@users.noreply.github.com>
* refactor(docs): turn auth error codes table into data file
Take the Markdown error codes table and turn it into a data file
instead. This makes it easy to parse and reuse in other places besides
Markdown documents.
* Update apps/docs/content/errorCodes/authErrorCodes.toml
Co-authored-by: Terry Sutton <saltcod@gmail.com>
---------
Co-authored-by: Terry Sutton <saltcod@gmail.com>
* Added <$CodeTabs> to Pages Router tab
There was an inconsistency between the App Router and Pages Router page, which was only a small detail.
* Update apps/docs/content/guides/auth/server-side/nextjs.mdx
---------
Co-authored-by: Charis <26616127+charislam@users.noreply.github.com>
Correct the code examples for the Clerk third-party auth docs:
- Fix TypeScript error
- Change RLS policy check to accept both [Clerk v1 and v2
JWTs](https://clerk.com/docs/backend-requests/resources/session-tokens)
Pulled code samples from an example app that I've checked in to make
maintenance and testing easier in the future.
Eduardo Gurgel