449 Commits

Include renames

Author	SHA1	Message	Date
Pedro RodriguesandClaude Opus 4.8	91b40f15ab	docs: how to fully remove account access when deleting a user (#48487) ... The [User Management → Deleting users](https://supabase.com/docs/guides/auth/managing-user-data) section warned that deleting a user does not sign them out, but did not say what to do about it. Adds a **Removing account access** subsection: revoke sessions before deleting, why a soft-delete flag or [ban](https://supabase.com/docs/reference/javascript/auth-admin-updateuserbyid) is not a substitute, and the residual [access-token window](https://supabase.com/docs/guides/auth/sessions) after revocation. Fills a docs gap surfaced by [supabase/agent-skills#194](https://github.com/supabase/agent-skills/pull/194) while investigating the [`investigate-auth-001-deleted-user-access`](https://github.com/supabase/evals/blob/main/evals/investigate-auth-001-deleted-user-access/PROMPT.md) eval scenario. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated the “Deleting users” guidance to specify deleting via `auth.admin.deleteUser()` (with `shouldSoftDelete: false`) and clarify that this cascades to sessions, invalidates refresh tokens, and blocks new access-token minting. * Rewrote the explanation to emphasize that it does not substitute for temporary bans or application-level “deleted” states. * Clarified the access-token window: already-issued stateless JWTs remain valid until `exp`, and recommended mitigations include short JWT expiry and enforcing session validation (via `session_id`) for sensitive actions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-30 13:22:10 +01:00
Miranda Limonczenko	abbf667084	fix(docs) Resolve local link paths caused that have redirects (#48453) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## Problem The Docs E2E link checker found broken links throughout docs, starting with `phone-login.mdx` pointing to `/docs/guides/cli/config` (404). Old links like `/docs/guides/cli/config` still work on the live site because `supabase.com` has redirects set up for them, but these links break on the docs preview site, which is what the E2E check tests against. These issues look clean on the live site, and I didn't catch them in my first pass because I was testing production instead of the preview. The E2E check only tests the ~20 pages a given PR happens to touch, so fixing the pages it flagged kept exposing more of the same problem one page at a time as each fix pulled in a new file. To stop chasing this incrementally, I cross-referenced every `/docs/guides/*` and `/docs/reference/*` redirect source in `apps/www/lib/redirects.js` against actual usage across all of `apps/docs`, and verified each candidate against the live preview. ## Solution Rather than updating the Docs E2E link checker, this PR resolves the links. **Why:** we own these docs, so keeping the links clean without redirects is keeping the house maintained. See [Broken Window Theory](https://blog.codinghorror.com/the-broken-window-theory/). Updated every link still using an old path to point straight at the current page instead of relying on a redirect. This covers old links like: - `/docs/guides/cli/config` → `/docs/guides/local-development/cli/config` - `/docs/guides/cli/getting-started` → `/docs/guides/local-development/cli/getting-started` - `/docs/guides/cli/local-development` → `/docs/guides/local-development/database-migrations` - `/docs/guides/cli/managing-environments` → `/docs/guides/deployment/managing-environments` - `/docs/guides/cli/seeding-your-database` → `/docs/guides/local-development/seeding-your-database` - bare `/docs/guides/cli` → `/docs/guides/local-development` - `/docs/guides/platform/compute-add-ons` → `/docs/guides/platform/compute-and-disk` - `/docs/guides/platform/shared-responsibility-model` → `/docs/guides/deployment/shared-responsibility-model` - `/docs/guides/database` → `/docs/guides/database/overview` - `/docs/reference/javascript`, `/docs/reference/dart`, `/docs/reference/kotlin`, `/docs/reference/python`, `/docs/reference/csharp` → their `/introduction` pages (the redirect's own destination, `/start`, turned out to be dead even on production — a separate bug in `redirects.js` I didn't touch here) - and about 35 more of the same pattern, listed in the commit messages Also fixed a handful of dead heading anchors found along the way (links that resolve to the right page but point at a `#section` that got renamed or moved), including the original `#bigquery` anchor and a few in `connecting-to-postgres.mdx` where content moved to its own dedicated page. Left alone on purpose: - `content/guides/cli.mdx` — this page has no route in the docs app at all (no `app/guides/cli/` directory), so it 404s even in production before the `www` redirect ever fires. Fixing its internal link wouldn't change that; it needs an actual routing/content decision, not a link fix. - A few candidates that already resolve fine as-is (`pg_partman`, bare `/docs/reference/api`, bare `/docs/reference/cli`) — confirmed via curl, left untouched. ## Manual testing 1. Confirmed every new link target actually exists by checking the destination file/page and matching heading anchors. 2. Cross-referenced every `/docs/guides/*` and `/docs/reference/*` redirect source in `apps/www/lib/redirects.js` against real usage in `apps/docs`, and curl-verified each old path (404) and new path (200) against the live PR preview before fixing it. 3. Ran the Docs E2E link checker locally against changed pages. 4. Spot-checked the original broken link from CI (`/docs/guides/cli/config`) to confirm it now points to a working page.	2026-07-29 14:47:17 -07:00
Miranda Limonczenko	0d465e7b5f	chore(ui): Remove 'tip' from Admonition (#48419) ... Closes FE-3966 ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## Problem - The admonition uses both 'tip' and 'note', but the visual distinction has long-ago collapsed. - 'Note' is used far more frequently than 'tip' - The two are very similar and it is confusing to know which one to use when they are visually identical ## Solution Collapse 'tip' and 'note' into one by removing all places where there is 'tip' and updating all references to 'tip' into 'note'. **Note:** This PR also resolves new broken links flagged by the E2E docs checker. It may move to another PR since E2Es keep erroring. ### Specific changes See below for an AI-generated list of changes: - **Type system** — removed `'tip'` from `AdmonitionType`, its `TYPE_TO_VARIANT`/`TYPE_LABEL` entries, and the test case in [`packages/ui-patterns/src/Admonition/](packages/ui-patterns/src/Admonition/) - **Remark plugin** — [remarkAdmonition.ts](apps/docs/lib/mdx/plugins/remarkAdmonition.ts) now maps mkdocs `tip` → `note` - **Lint allowlist** — `tip` dropped from `supa-mdx-lint.config.toml` - **Content migration** — all 109 files with `type="tip"` (across `apps/docs`, `apps/www`, `apps/studio`) converted to `type="note"`; zero remaining hits confirmed by repo-wide grep - **Style guide** — `CONTRIBUTING.md` and `contributing/content.mdx` updated to describe 4 admonition types instead of 5 ### Usage before implementation See the usage table that points toward 'note' as being dominant across all apps: Here's the usage table: | Location | `note` | `tip` | |---|---|---| | apps/docs | ~480 | ~143 | | apps/studio | 34 | 6 | | apps/www (blog) | 19 | 3 | | packages/ui-patterns (tests) | 3 | 1 (parametrized) | | design-system / ui-library / packages/ui / packages/common | 0–1 (test fixture only) | 0 | ## Preview links | App | Page | Search text (Ctrl+F) | Verify | |---|---|---|---| | docs | [/docs/guides/ai-tools/byo-mcp](https://docs-git-admonition-collapse-note-tip-supabase.vercel.app/docs/guides/ai-tools/byo-mcp) | official MCP TypeScript SDK | callout's aria-label="Note" | | docs | [/docs/guides/ai-tools/mcp](https://docs-git-admonition-collapse-note-tip-supabase.vercel.app/docs/guides/ai-tools/mcp) | MCP server is available at | callout's aria-label="Note" | | docs | [/docs/guides/ai/python-clients](https://docs-git-admonition-collapse-note-tip-supabase.vercel.app/docs/guides/ai/python-clients) | Click Connect at the top of any project page | callout's aria-label="Note" | | docs | [/docs/guides/auth/audit-logs](https://docs-git-admonition-collapse-note-tip-supabase.vercel.app/docs/guides/auth/audit-logs) | Disabling Postgres storage reduces your database storage costs | callout's aria-label="Note" | | docs | [/docs/guides/database/tables](https://docs-git-admonition-collapse-note-tip-supabase.vercel.app/docs/guides/database/tables) | access a custom schema through the Supabase Data API | callout's aria-label="Note" | | docs | [/docs/guides/troubleshooting/edge-function-404-error-response](https://docs-git-admonition-collapse-note-tip-supabase.vercel.app/docs/guides/troubleshooting/edge-function-404-error-response) | Always configure an appropriate time frame | callout's aria-label="Note" (was single-quoted type='tip') | | www | [blog: cli-v2-config-as-code](https://zone-www-dot-com-git-admonition-collapse-note-tip-supabase.vercel.app/blog/cli-v2-config-as-code) | Detecting config drift | callout's aria-label="Note" | | www | [blog: cli-v2-config-as-code](https://zone-www-dot-com-git-admonition-collapse-note-tip-supabase.vercel.app/blog/cli-v2-config-as-code) | Setting Edge Function secrets | callout's aria-label="Note" | | www | [blog: nosql-mongodb-compatibility-with-ferretdb-and-flydotio](https://zone-www-dot-com-git-admonition-collapse-note-tip-supabase.vercel.app/blog/nosql-mongodb-compatibility-with-ferretdb-and-flydotio) | If your network supports IPv6 connections | callout's aria-label="Note" | Note: the `www` rows use the `zone-www-dot-com` preview host, not the `docs` one you gave — since blog pages are served from the www app, not docs. ## Manual testing 1. Open preview links for affected pages. 2. Inspect. Open console. 3. Paste the following in and see there is no 'Tip' on the page: ``` document.querySelectorAll('[role="alert"]').forEach(el => console.log(el.getAttribute('aria-label'), el.textContent.slice(0,60))) ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Standardized informational callouts across docs and tutorials from **“Tip”** to **“Note”**, updating multiple examples and guidance blocks. * Updated a few related doc references/links and conditional “Next steps” content. * **UI Updates** * Switched various in-app banners and notices to the **“Note”** style variant. * **Bug Fixes / Improvements** * Removed support for the retired **“Tip”** callout type and aligned docs linting, component behavior, and aria labeling to the remaining admonition types. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-29 09:26:50 -07:00
fadymak	19dfbd250a	feat(auth): expose access token expiry under auth settings (#48236) ... Exposes the access token expiry (`JWT_EXP`) under `Auth -> Sessions` settings as opposed to the Legacy JWT settings previously used. <img width="1632" height="1199" alt="Screenshot 2026-07-23 at 10 06 33" src="https://github.com/user-attachments/assets/85356e57-da95-404c-852a-21cf9cab2b74" /> <img width="1198" height="1119" alt="Screenshot 2026-07-23 at 10 06 19" src="https://github.com/user-attachments/assets/bfa64b3b-1902-45eb-83ed-ca8bc12673af" /> <img width="1237" height="513" alt="Screenshot 2026-07-23 at 10 03 44" src="https://github.com/user-attachments/assets/85779e9b-30f2-48c5-9faa-4c650d450227" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added an **Access Tokens** section to configure JWT expiration with dedicated Save/Cancel controls and success/error toasts. * Enforced a maximum JWT expiration value (must be **less than 604800 seconds**). * **Bug Fixes** * Updated the Sessions auth page text to better clarify configuration for access tokens, refresh tokens, and user sessions. * **Documentation** * Updated JWT expiration guidance to point to **Auth settings → Access Tokens** (replacing legacy JWT secret references). * **Chores** * Expanded automated tests covering Access Tokens saving and validation. * **Refactor** * Removed JWT expiration editing from the legacy JWT Secrets area, consolidating it under Access Tokens. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-27 10:13:10 +02:00
Miranda Limonczenko	359974d071	fix(docs) Fix local broken links (#48212) ... Closes DOCS-1202 ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## Problem We have broken local links in docs. I ran locally tests that crawl through all of our docs and flags broken local links. ## Solution This PR fixes local links where they were errored. The report I generated had false-positives, so there are fewer fixes than initially thought. ## Preview checklist Docs preview: https://docs-git-docs-fix-broken-local-links-supabase.vercel.app WWW preview (redirects): https://zone-www-dot-com-git-docs-fix-broken-local-links-supabase.vercel.app | Page | Live (broken) | Preview (fixed) | Where to look | | --- | --- | --- | --- | | Amazon Bedrock | [Live](https://supabase.com/docs/guides/ai/integrations/amazon-bedrock) | [Preview](https://docs-git-docs-fix-broken-local-links-supabase.vercel.app/docs/guides/ai/integrations/amazon-bedrock) | **You'll also need** → `A Postgres database with the pgvector extension` | | Getting started | [Live](https://supabase.com/docs/guides/getting-started) | [Preview](https://docs-git-docs-fix-broken-local-links-supabase.vercel.app/docs/guides/getting-started) | Tutorial cards → **Expo React Native Social Auth** | | Product security | [Live](https://supabase.com/docs/guides/security/product-security) | [Preview](https://docs-git-docs-fix-broken-local-links-supabase.vercel.app/docs/guides/security/product-security) | **Database** list → `Superuser access and unsupported operations` | | OAuth flows | [Live](https://supabase.com/docs/guides/auth/oauth-server/oauth-flows) | [Preview](https://docs-git-docs-fix-broken-local-links-supabase.vercel.app/docs/guides/auth/oauth-server/oauth-flows) | End of page, before **Next steps** → `OAuth methods in supabase-js` | | ElevenLabs TTS | [Live](https://supabase.com/docs/guides/functions/examples/elevenlabs-generate-speech-stream) | [Preview](https://docs-git-docs-fix-broken-local-links-supabase.vercel.app/docs/guides/functions/examples/elevenlabs-generate-speech-stream) | **Dependencies** → ElevenLabs `JavaScript SDK` | | ElevenLabs STT | [Live](https://supabase.com/docs/guides/functions/examples/elevenlabs-transcribe-speech) | [Preview](https://docs-git-docs-fix-broken-local-links-supabase.vercel.app/docs/guides/functions/examples/elevenlabs-transcribe-speech) | **Dependencies** → ElevenLabs `JavaScript SDK` | | Realtime error codes | [Live](https://supabase.com/docs/guides/realtime/error_codes) | [Preview](https://docs-git-docs-fix-broken-local-links-supabase.vercel.app/docs/guides/realtime/error_codes) | `RealtimeDisabledForTenant` → reference link | | Expo social auth redirect (legacy) | [Live](https://supabase.com/docs/guides/with-expo-social-auth) | [Preview](https://zone-www-dot-com-git-docs-fix-broken-local-links-supabase.vercel.app/docs/guides/with-expo-social-auth) | Should land on the Expo social auth quickstart | | Expo social auth redirect (old tutorials path) | [Live](https://supabase.com/docs/guides/getting-started/tutorials/with-expo-social-auth) | [Preview](https://zone-www-dot-com-git-docs-fix-broken-local-links-supabase.vercel.app/docs/guides/getting-started/tutorials/with-expo-social-auth) | Should land on the Expo social auth quickstart | ### Manual testing 1. For each row, open the **Live** link and find the linked text in **Where to look**. 2. Click the link and confirm it 404s or lands on the wrong page. 3. Open the matching **Preview** link, find the same linked text, and click it. 4. Confirm the preview link resolves to the correct destination: - Amazon Bedrock → `/docs/guides/database/extensions/pgvector` - Getting started → `/docs/guides/auth/quickstarts/with-expo-react-native-social-auth` - Product security → `/docs/guides/database/postgres/roles-superuser` - OAuth flows → `/docs/reference/javascript/auth-admin-oauth-server` - ElevenLabs TTS / STT → `https://github.com/elevenlabs/elevenlabs-js` - Realtime error codes → `/docs/guides/troubleshooting/realtime-project-suspended-for-exceeding-quotas` - Redirect rows → `/docs/guides/auth/quickstarts/with-expo-react-native-social-auth` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated links for pgvector, OAuth, ElevenLabs SDK, and database security guidance. * Corrected the Expo React Native social authentication tutorial link. * Updated Realtime troubleshooting references to the current documentation path. * **Bug Fixes** * Fixed redirects for Expo social authentication guides so legacy URLs reach the correct quickstart. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-22 11:49:04 -07:00
Ali Waseem	ac714e81ba	docs(tanstack): add a proper SSR quick start with cookie-based auth (#48105) ... ## Summary TanStack Start's quickstart only ever wired up an anonymous `supabase-js` client — no cookies, no `@supabase/ssr`, no auth. This ports the real `@supabase/ssr` client/server split and password-based auth flow (already shipped in `apps/ui-library`) into the quickstart and adds a matching tab to the SSR guide. ## Where this changed - `apps/docs/content/guides/getting-started/quickstarts/tanstack.mdx` — quickstart now installs the cookie-based auth flow via the Supabase UI Library registry and queries data through the SSR-aware server client. - `apps/docs/content/guides/auth/server-side/creating-a-client.mdx` — new TanStack Start tab (client/server setup + protecting routes). - `examples/auth/tanstack/` (new) — source files backing the `$CodeSample` snippets above, ported from `apps/ui-library`'s registry. ## Test plan - [x] Scaffolded a real TanStack Start app and ran the quickstart commands end-to-end - [x] Confirmed SSR loader + protected-route redirect work as documented - [x] `pnpm lint:mdx` and `pnpm build:guides-markdown` pass <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added TanStack Start SSR setup examples for Supabase, including browser and server client helpers with cookie-based session support. * Included a protected route example that checks authentication on the server and redirects unauthenticated users to the login page. * Added a server-side claims fetch helper for authorization checks. * **Documentation** * Expanded the “creating a client” guide with TanStack Start-specific route protection and environment variable examples. * Updated the TanStack Start quickstart to use the official CLI and refined server-side authorization guidance. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-22 12:00:05 -06:00
Katerina Skroumpelouandgithub-actions[bot]	dac5756295	docs(auth): add server-side package disambiguation guide (#47966) ... Adds a docs guide, "Choosing a server-side package", that explains when to use `supabase-js`, `@supabase/ssr`, or `@supabase/server` when working with Supabase from JavaScript on the server. It includes a decision table and a short code example for each, with one rule up front: cookie-based sessions in SSR frameworks use `@supabase/ssr`, per-request header auth in Edge Functions and other backend runtimes uses `@supabase/server`, and `supabase-js` is the base client both wrap. The guide is surfaced from the Auth overview page and the sidebar, and is cross-linked from the `supabase-js` and `@supabase/server` reference introductions so it is reachable from where developers start. It also states that the packages coexist and are not replacements for each other, and keeps combining `@supabase/server` with `@supabase/ssr` as an advanced section. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added a guide explaining how to choose between Supabase server-side JavaScript packages. - Added the guide to Auth navigation and the getting-started content listings. - Added links to the new guidance throughout relevant JavaScript and server documentation. - **Documentation** - Clarified when to use cookie-based sessions versus header-based authentication. - Added package comparisons, usage examples, advanced guidance, and related next steps. - Updated spelling support for framework names used in the documentation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-07-16 15:29:00 +03:00
Pedro Henrique	8d50a13d33	docs: note Apple Services ID must be first in Client IDs for web sign-in (#47707)	2026-07-16 12:52:14 +02:00
Chris StocktonandChris Stockton	c8d60097d9	fix(docs): before-user-created hook had invalid ipnet cmp (#47940) ... The comparison operator `<<` check if lhs is strictly contained by the rhs. Meaning a `/32` would return false for `/32` as the lhs is not contained, but equal to the rhs. The `<<=` is operator checks if a subnet is strictly contained or equal to which fixes the `/32` case. [1] https://www.postgresql.org/docs/17/functions-net.html#FUNCTIONS-NET <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated the `before-user-created` hook SQL example to use the correct IP/CIDR containment syntax for both allow and deny network checks. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Chris Stockton <chris.stockton@supabase.io>	2026-07-14 19:27:26 +00:00
Katerina SkroumpelouandMiranda Limonczenko	20649d2374	docs: fix confusing loader snippets in Remix and React Router SSR client guide (#47685) ... ## Summary Fixes the Remix and React Router sections of the SSR "creating a client" guide, which showed three separate `_index.tsx` snippets (Loader, Action, Component) with two different `loader` exports that cannot coexist in one route, leaving readers unsure which to use. Each framework now has a short intro plus a single coherent `_index.tsx`: one `loader` that creates the server client and returns the env vars, one `action`, and a browser-client component that reads those env vars via `useLoaderData`. Along the way this also fixes three React Router bugs: the invalid `'@react-router'` import, the dropped cookie `options` argument in `setAll`, and the incomplete `return ...` in the component. One thing worth a reviewer check: a loader that both sets cookies and returns data must return through the `json` (Remix) / `data` (React Router v7) helper with `{ headers }` rather than a plain object, so the `Set-Cookie` headers are preserved. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **Documentation** * Updated the server-side “creating a client” guide for Remix and React Router SSR examples. * Refreshed the example structure to a single end-to-end route setup with `loader`, `action`, and one default page component. * Improved SSR cookie and header handling to better match practical server/client behavior. * Passes the required Supabase URL and publishable key from the server to the browser so the client can be initialized with `useLoaderData`. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Miranda Limonczenko <miranda.limonczenko@supabase.io>	2026-07-13 15:06:15 +03:00
Andrey A.	f55cb25b9b	docs(auth): add a section about user invites (#47774)	2026-07-10 11:03:20 +02:00
Jeremias Menichelli	5066261dbd	[DOCS-1148] Improve prose for LLM readability (#47653)	2026-07-08 16:00:47 +02:00
Jeremias Menichelli	689b6991f0	fix: Remove always-open Accordion behavior (#47638)	2026-07-07 11:51:13 +02:00
Vaibhav	89bba95028	fix: password docs (#47561) ... - closes https://github.com/supabase/supabase/issues/47555 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated the password verification guide to use the `current_password` parameter name consistently. * Aligned the example code with the current parameter format for user password updates. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-06 12:26:56 +02:00
Gildas Garcia	4b7cb27ba9	chore: refactor docs tabs (#47557) ... ## Problem Now that `docs` is the only place where we use the deprecated `ui/Tabs`, we can move this component and the related HOC from `ui-patterns` in `docs` ## Solution - Move `ui/Tabs`, `ui-patterns/ComplexTabs/withQueryParams` and `ui-patterns/ComplexTabs/withSticky` to `docs` - Refactor `ui-patterns/ComplexTabs/withQueryParams` and `ui-patterns/ComplexTabs/withSticky` HOCs as hooks to make them easier to understand - Refactor `Tabs` accordingly No visual nor functional changes. ## How to test On https://docs-git-chore-refactor-docs-tabs-supabase.vercel.app/docs/guides/auth/passwords (Tabs are driven by URL and the flow tabs should have sticky headers even though there's a CSS bug already reported) - check that by default, the first tab in each tabs is active - change the tabs in different groups and validate it works - refresh the page and check that previously selected tabs are active (URL based selection) - In a new tab, visit https://docs-git-chore-refactor-docs-tabs-supabase.vercel.app/docs/guides/auth/passwords again and check that previously selected tabs are active (LocalStorage based selection) Do the same on https://docs-git-chore-refactor-docs-tabs-supabase.vercel.app/docs/guides/database/database-advisors (This one is driven by URL but does not have sticky tab headers) Do the same on https://docs-git-chore-refactor-docs-tabs-supabase.vercel.app/docs/guides/deployment/terraform/reference (this one is not driven by URL nor has sticky tab headers) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Docs tabs now persist and restore the active tab via URL query parameters. * Added optional “sticky” tab behavior that keeps the active panel in view. * Enhanced keyboard interaction for selecting tabs. * **Bug Fixes** * Improved active-tab initialization and synchronization when the URL query changes. * **Chores** * Refreshed the tabs UI implementation and styling to improve consistency and remove deprecated tab exports from shared UI packages. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-04 02:44:29 +10:00
Saxon FletcherandClaude Opus 4.8	fb02182e86	Color system (#47288) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES/NO ## What kind of change does this PR introduce? Bug fix, feature, docs update, ... ## What is the current behavior? Please link any relevant issues here. ## What is the new behavior? Feel free to include screenshots if it includes visual changes. ## Additional context Add any other context or screenshots. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Refreshed theming across the UI to use modern color expressions and shared theme variables (including OKLCH-based gradients), improving consistency for charts, code blocks, overlays, icons, and decorative backgrounds. * **Bug Fixes** * Improved light/dark color and gradient consistency across axis/grid styling, reference lines, buttons/badges, sidebar accents, loaders, and other visual components. * **Documentation** * Updated styling/theming guidance to align with the revised semantic token system and the updated theme variable usage patterns. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-03 15:00:43 +10:00
Lukas Klingsbo	bc1ad74cfe	docs: update Dart passkey docs for authenticator parameter (#47490) ... ## Summary Updates the Dart (`supabase_flutter`) passkey documentation to reflect [supabase-flutter#1444](https://github.com/supabase/supabase-flutter/pull/1444), which changed `registerPasskey()` and `signInWithPasskey()` to accept a `PasskeyAuthenticatorInterface` parameter instead of bundling the `passkeys` plugin directly. ## Changes - `apps/docs/content/guides/auth/passkeys.mdx` — updated the Dart tab under "Enable in the client" to show how to construct an authenticator (e.g. `PasskeyAuthenticator` from the `passkeys` package), and updated the `registerPasskey()` / `signInWithPasskey()` code samples to pass it. - `apps/docs/spec/supabase_dart_v2.yml` — added the new `authenticator` parameter to the `signInWithPasskey()` and `registerPasskey()` reference entries and updated their examples/notes. ## Test plan - [ ] Review rendered guide and reference pages for the Dart tab of the passkeys docs <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated Dart passkey authentication guides to reflect the latest usage pattern. * Passkey sign-in and registration now show a required authenticator being passed in. * Added clearer setup examples using a passkey authenticator implementation. * Clarified that the app must provide the authenticator when using passkey flows. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-02 16:37:44 +02:00
5 people	192a736d7f	docs: Remove two pane layout from quickstarts and rearrange the content (#47398) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary - **Documentation** - Reworked API settings content to recommend client libraries for auto-generated Data API endpoints, refreshed authentication/URL guidance, and streamlined API keys messaging. - Updated shared setup partials and restructured the database quickstart with clearer dashboard/management API steps and expanded SQL/RLS snippets. - Updated multiple framework quickstarts to use consistent section-based layouts and refreshed environment-variable instructions across guides. - **Chores** - Expanded MDX heading-case lint allowlist for common framework names (Astro, Flask, Node, Rails, TanStack Start). <!-- end of auto-generated comment: release notes by coderabbit.ai --> ## How to test Run the docs site locally: ```bash pnpm install pnpm dev:docs # serves on http://localhost:3001 ``` Then start with the **Next.js quickstart**, which exercises every change in this PR: 👉 http://localhost:3001/docs/guides/getting-started/quickstarts/nextjs Verify on that page: - [ ] **"Get API details"** section now renders **before** the "Declare environment variables" step, and shows the live **Project URL** + **publishable key** helper widgets (moved into the shared `api_settings.mdx` partial). - [ ] The shadcn/ui **"Explore Components"** CTA appears in the **"Query data"** section (not up top in the create-app step). - [ ] The API keys deprecation notice still renders, and there are no broken/empty partial includes. ### Where to find the rest All other framework quickstarts got the same treatment and live in the same folder — just swap the framework slug in the URL: `http://localhost:3001/docs/guides/getting-started/quickstarts/<framework>` `reactjs`, `vue`, `nuxtjs`, `astrojs`, `tanstack`, `solidjs`, `sveltekit`, `expo-react-native`, `flutter`, `kotlin`, `ios-swiftui`, `flask`, `hono`, `refine`, `redwoodjs`, `ruby-on-rails` Things that vary by framework (worth a quick spot-check across a couple): - **UI CTA** kept only on React-DOM frameworks (Next.js, React, TanStack, Astro); removed from non-React / React Native (Vue, Nuxt, SolidJS, SvelteKit, Expo). - **Mobile guides** (Flutter, Kotlin, iOS SwiftUI): the "Get API details" partial renders *after* the client-init code block, so the key helper widgets show below the snippet rather than beside it. - **Redwood, Hono, Refine, Laravel** Are quite different from the other quickstarts, so I didn't touch them as much and they need some further thought. Because the edited `api_settings.mdx` partial is shared, these non-quickstart pages also render it and are worth a glance: - Auth quickstarts: `/docs/guides/auth/quickstarts/{nextjs,react,react-native,astrojs}` - `/docs/guides/auth/server-side/creating-a-client` - `/docs/guides/realtime/getting_started` - Getting-started setup guides that pull in `project_setup.mdx` / `kotlin_project_setup.mdx` --------- Co-authored-by: awaseem <8704380+awaseem@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Miranda Limonczenko <miranda.limonczenko@supabase.io> Co-authored-by: Jeremias Menichelli <jmenichelli@gmail.com>	2026-07-02 11:10:47 +00:00
Joshen Lim	1de298ff31	Reinstate https://github.com/supabase/supabase/pull/45143 into latest master (#47433) ... ## Context Previous PR was [here](https://github.com/supabase/supabase/pull/45143) but it got stale with lots of conflicts so figured it'll be easier redo it off the latest master Moves policies page from Auth to Database under an Access Control section along with Roles. This moves all existing files, applies redirects, and updates urls to point to the new route <img width="274" height="412" alt="image" src="https://github.com/user-attachments/assets/7952c185-64ae-4355-ba36-45397efe1787" /> <img width="453" height="471" alt="image" src="https://github.com/user-attachments/assets/04b3dcb3-48a5-4049-9893-d01109fb46a9" /> ## To test - [ ] Verify that policies now live under Database correctly <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a quick navigation shortcut to open **Database > Policies (RLS)**. * **Bug Fixes** * Updated Policies and RLS-related links across the product to open the **Database policies** area (menus, command palette, context actions, alerts, and link-outs). * Added a permanent redirect from the old **auth policies** URL to the new **database policies** URL. * **Documentation** * Updated RLS Dashboard and security checklist instructions to reference **Database > Policies**. * **Tests** * Adjusted automated tests to validate the new Policies route. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-06-30 18:49:33 +08:00
4 people	3dffdefd6e	fix(docs) Resolve 196 mdx lint warnings for just, quickly, actually, PostgreSQL (#47358) ... Closes DOCS-1057 Contributes to DOCS-1052 ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## Problem We have hundreds of MDX lint warnings in our docs going against style best practices. ## Solution Remove and replace in context the following: - PostgreSQL. There was only one. There was concern about exceptions, but I found none. - Just - Quickly - Actually ### What changed Edits follow the [Google developer documentation style guide](https://developers.google.com/style): concise, direct, active voice. The flagged words were removed when the sentence still read well, or replaced when meaning needed to be preserved. ### Common patterns | Flagged word | Approach | Example | |---|---|---| | **just** (filler) | Removed | "you just installed" → "you installed" | | **just** (limiting) | **only** | "just one row" → "only one row" | | **just like** | **like** / **the same as** | "function just like regular users" → "function like regular users" | | **not just** | **not only** | "not just errors" → "not only errors" | | **quickly** (performance) | **efficiently** or removed | "find rows quickly" → "find rows efficiently" | | **quickly** (time) | **soon** / **rapidly** / removed | "expires too quickly" → "expires too soon" | | **actually** (filler) | Removed | "actually execute" → "execute"; "is actually the most common" → "is the most common" | ## Tophatting 1. See the diff. 2. See that content continues to make sense in context. 3. Locally, `cd apps/docs` and run `pnpm run lint:mdx`. 4. Search for "just," "actually," "quickly", and "PostgreSQL" and see there are 0 warnings. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated wording across quickstarts, guides, and troubleshooting articles for grammar, clarity, and consistent step-by-step phrasing. * Clarified key concepts including Row Level Security policy evaluation across Supabase products, deferred foreign key constraint behavior, and when `EXPLAIN ANALYZE` executes queries (and related side effects). * Refined several troubleshooting instructions and added guidance to cap log payload size to reduce billed Logs Ingest volume. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Nik Richers <nrichers@gmail.com> Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>	2026-06-29 09:40:25 -07:00
Nik RichersandNik Richers	c7c6cca9ed	chore(docs): align Next.js quickstart demo with monorepo catalog (#47144) ... ## I have read the CONTRIBUTING.md file. YES ## What kind of change does this PR introduce? Docs update, example maintenance Closes DOCS-362. ## What is the current behavior? - Linear item: Next JS checks (DOCS-362) - `@supabase/ssr: "latest"` and unpinned `next` in nextjs-user-management - Duplicate `next.config.js` + `next.config.ts` - Auth quickstart linked to non-existent `/guides/auth/server-side/nextjs` ## What is the new behavior? - Pinned `next@16.2.6`, `@supabase/ssr@0.10.2` per monorepo catalog - Removed duplicate `next.config.js` - Auth quickstart links to `creating-a-client?framework=nextjs` - Audit skills moved to [supabase/docs-agent-skills](https://github.com/supabase/docs-agent-skills): [`audit-nextjs-docs`](https://github.com/supabase/docs-agent-skills/blob/main/.claude/skills/audit-nextjs-docs/SKILL.md), [`audit-quickstarts`](https://github.com/supabase/docs-agent-skills/blob/main/.claude/skills/audit-quickstarts/SKILL.md) ## Additional context - Verification (author): `npm install && npm run build` in nextjs-user-management — **pass** (Next.js 16.2.6) - Skill audit: no stale `middleware.ts` in Next docs paths; broken link fixed; duplicate config removed | Check | Result | |-------|--------| | Version matrix | Pass (pinned to catalog) | | proxy.ts / no middleware refs | Pass | | nextjs-user-management build | Pass | | Auth quickstart link | Fixed | ### Test plan - [ ] `cd examples/user-management/nextjs-user-management && npm install && npm run build` - [ ] `cd apps/docs && pnpm codegen:examples && pnpm lint:mdx` on changed MDX - [ ] Framework quickstart — `create-next-app -e with-supabase` and publishable key env vars - [ ] Auth quickstart — "Learn more" resolves (no 404) - [ ] Web app tutorial — code samples use `proxy.ts` - [ ] Start nextjs-user-management locally with `.env.local` — login/account flow - [ ] Install audit skills from [docs-agent-skills](https://github.com/supabase/docs-agent-skills) (`ln -sf ~/GitHub/supabase/docs-agent-skills/.claude/skills/audit-nextjs-docs ~/.claude/skills/audit-nextjs-docs` and same for `audit-quickstarts`), then run checklists in [audit-nextjs-docs](https://github.com/supabase/docs-agent-skills/blob/main/.claude/skills/audit-nextjs-docs/SKILL.md) and [audit-quickstarts](https://github.com/supabase/docs-agent-skills/blob/main/.claude/skills/audit-quickstarts/SKILL.md) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated resource links in authentication quickstart guides for improved navigation. * **Chores** * Updated dependencies in the Next.js user management example to latest stable versions. * Removed unused configuration settings from the example application. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Nik Richers <nik@validmind.ai>	2026-06-26 07:34:45 -07:00
Jonathan FultonandLukas Klingsbo	759dde2176	docs(auth): fix Dart signInWithOtp return type in email passwordless docs (#42339) ... ## What kind of change does this PR introduce? Bug fix for incorrect documentation. ## What is the current behavior? The Dart/Flutter examples in the email passwordless authentication documentation incorrectly show `signInWithOtp` returning an `AuthResponse`: ```dart final AuthResponse res = await supabase.auth.signInWithOtp(email: 'valid.email@supabase.io'); ``` However, according to the [official Flutter package documentation](https://pub.dev/documentation/supabase_flutter/latest/supabase_flutter/GoTrueClient/signInWithOtp.html), `signInWithOtp` returns `Future<void>`, not `AuthResponse`. ## What is the new behavior? Updated the Dart examples to correctly show that `signInWithOtp` returns `Future<void>`: ```dart await supabase.auth.signInWithOtp(email: 'valid.email@supabase.io'); ``` Also fixed a typo in the method name (`signinwithotp` -> `signInWithOtp`). ## Additional context - [Flutter Package Docs - signInWithOtp](https://pub.dev/documentation/supabase_flutter/latest/supabase_flutter/GoTrueClient/signInWithOtp.html) - shows return type is `Future<void>` - [Flutter Package Docs - verifyOTP](https://pub.dev/documentation/supabase_flutter/latest/supabase_flutter/GoTrueClient/verifyOTP.html) - this method returns `AuthResponse` Fixes #39447 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated passwordless email authentication guide with corrected API method naming conventions in code examples. Examples now properly reference the current public API standards, ensuring developers follow best practices when implementing email-based authentication flows. <sub>✏️ Tip: You can customize this high-level summary in your review settings.</sub> <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Lukas Klingsbo <lukas.klingsbo@gmail.com>	2026-06-26 09:52:32 +00:00
Chris ChinchillaandMiranda Limonczenko	3c26fd071b	docs: Improve readability of page elements by LLM and AI tools (#47275) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Improved AI, database, storage, and platform guides with clearer explanations and more detailed workflow steps. * Added descriptive captions and accessible alt text for multiple diagrams and benchmark charts. * Expanded MFA, connection, replication, partitioning, and integration docs with clearer decision points and setup/login flow guidance. * Clarified database schema and seed-data examples to better explain how tables and relationships fit together. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Miranda Limonczenko <miranda.limonczenko@supabase.io>	2026-06-25 07:03:34 +00:00
4 people	32d1bdd534	fix(studio): reduce doc link density in auth email template builder (#47250) ... ## I have read the CONTRIBUTING.md file. YES ## What kind of change does this PR introduce? - Studio UI update (auth email template builder) - Docs update (hosted email templates guide + local dev cross-link) Closes DOCS-1086. ## What is the current behavior? - Linear item: Reduce link density in the template builder UI - Page header shows a **Terminology** link and **Docs** button (local development guide) - Template variables footer shows **Terminology** · **Local development** - Local development editing is only mentioned in one sentence on the hosted docs page; easy to miss once Studio no longer links there directly ## What is the new behavior? - Page header: **Docs** button only → `/guides/auth/auth-email-templates` - Template variables: single **Terminology** link → `#terminology` (variable pills still have hover tooltips) - Hosted docs: **Editing email templates** split into hosted vs local/self-hosted, with a callout linking to the local development guide - Local dev guide: opening paragraph links back to the hosted guide for shared terminology and patterns ### Proof: Template builder has fewer outbound doc links | Before | After | |--------|-------| | Header Terminology + Docs (local dev guide); footer Terminology · Local development <img width="1440" height="1100" alt="image" src="https://github.com/user-attachments/assets/3325f43b-5830-4b85-ba56-2ba4c5b04bcd" /> | Docs button only (hosted guide); single Terminology link above variables <img width="1440" height="1100" alt="image" src="https://github.com/user-attachments/assets/90c8cfff-89bd-46d5-b336-2f9dd50d37e3" /> | **Before (`origin/master`)** - Header: **Terminology** link + **Docs** button → local development guide - Template variables: **Terminology** · **Local development** **After (this PR)** - Header: **Docs** button only → [Email templates](https://docs-git-nikrichers-docs-1086-reduce-link-densi-bf6705-supabase.vercel.app/docs/guides/auth/auth-email-templates) (preview) - Template variables: single **Terminology** link → [Terminology](https://supabase.com/docs/guides/auth/auth-email-templates#terminology) - Local development path documented at [Editing email templates](https://docs-git-nikrichers-docs-1086-reduce-link-densi-bf6705-supabase.vercel.app/docs/guides/auth/auth-email-templates#editing-email-templates) (preview; replacing the in-builder Local development link) **Capture notes:** Content-area screenshots were captured locally from component markup because the template editor body requires platform auth config in self-hosted Studio. Local files: worktree `.pr-screenshots/template-builder-links-{before,after}.png`. ### Proof: Docs clarify local development path **Verified:** Vercel docs preview (pass) · `supa-mdx-lint` (pass) | Page | Before (production) | After (PR preview) | |------|---------------------|--------------------| | Email templates — Editing | [Editing email templates](https://supabase.com/docs/guides/auth/auth-email-templates#editing-email-templates) | [Editing email templates](https://docs-git-nikrichers-docs-1086-reduce-link-densi-bf6705-supabase.vercel.app/docs/guides/auth/auth-email-templates#editing-email-templates) | | Customizing email templates | [Customizing email templates](https://supabase.com/docs/guides/local-development/customizing-email-templates) | [Customizing email templates](https://docs-git-nikrichers-docs-1086-reduce-link-densi-bf6705-supabase.vercel.app/docs/guides/local-development/customizing-email-templates) | ## Additional context ### Test plan - [ ] Open **Authentication → Emails → Confirm sign up** on a hosted project - [ ] Confirm header has **Docs** only (no Terminology link) - [ ] Confirm **Docs** opens `/docs/guides/auth/auth-email-templates` - [ ] In source view, confirm template variables show one **Terminology** link (no Local development) - [ ] Hover variable pills — tooltips still explain each placeholder - [ ] Compare [production Editing email templates](https://supabase.com/docs/guides/auth/auth-email-templates#editing-email-templates) vs [preview](https://docs-git-nikrichers-docs-1086-reduce-link-densi-bf6705-supabase.vercel.app/docs/guides/auth/auth-email-templates#editing-email-templates) — hosted vs local/self-hosted sections and local dev callout are clear - [ ] Compare [production Customizing email templates](https://supabase.com/docs/guides/local-development/customizing-email-templates) vs [preview](https://docs-git-nikrichers-docs-1086-reduce-link-densi-bf6705-supabase.vercel.app/docs/guides/local-development/customizing-email-templates) — intro links back to hosted email templates guide <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **Documentation** * Clarified how to edit authentication email templates for hosted vs. self-hosted and local development setups. * Added clearer navigation to template terminology and customization guidance, with updated examples and notes. * **New Features** * Updated the email template UI to use centralized documentation links for the terminology section. * **Tests** * Added coverage to ensure the “Terminology” docs anchor stays consistent. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Nik Richers <nik@validmind.ai> Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-25 08:50:05 +02:00
Chris Chinchilla	f3c4ead337	docs: Make easier images more readable by AI tools (#47132) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What is this PR? This PR makes some images easier to understand by AI tools. Some are removed as they served minimal purposes. Some are replaced with mermaid versions instead, which are more understandable by AI tools. Next steps after this PR are to continue migrating harder images as well as improving the text around images in general. ## Testing ``` pnpm install pnpm dev --filter=docs # or: cd apps/docs && pnpm dev ``` Then visit each converted page and verify: Diagrams render as Mermaid (not a broken image / raw code fence) in both light and dark mode: - /docs/guides/auth/auth-mfa/phone, /totp - /docs/guides/database/connecting-to-postgres - /docs/guides/platform/read-replicas (inside the accordion) - /docs/guides/storage/schema/design - /docs/guides/local-development/seeding-your-database - /docs/guides/auth/signing-keys (image gone, prose + table intact)	2026-06-24 11:50:26 +02:00
3 people	0aa7b4965f	chore(docs) Remove instances of let's to resolve mdx lint warnings (#47013) ... Contributes to DOCS-1052 Contributes to DOCS-1057 ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Resolves linting warning for "let's" and adds an exception for product name. ## Tophatting 1. Read the diff and see if changes make sense in context. 2. Run `pnpm lint:mdx`, search for "let's" and see no instances. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated instructional copy across multiple AI, authentication, database, functions, realtime, storage, and troubleshooting guides to improve clarity and consistency. * Replaced conversational phrasing (for example, “Let’s…/Let’s see…”) with direct imperatives, tightened example lead-ins, and adjusted a few step explanations for readability. * Refreshed some tutorial text and code-sample presentation in guides (no behavioral changes). * Added/adjusted minor MDX lint guidance in a couple of documents. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Nik Richers <nrichers@gmail.com>	2026-06-17 11:24:59 -07:00
Miranda LimonczenkoandChris Chinchilla	58cb199db0	chore(docs) Replace utilize with use (#47010) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Resolves utilize lint warnings. ## What is the current behavior? Utilize lint warnings are present. ## Tophatting To see that this issue is resolved: 1. See the diff for content clarity. 2. Run `pnpm lint:mdx` to see no more remaining utilize errors. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Documentation - Improved documentation clarity and consistency across platform guides, including AI going-to-prod, custom claims/RLS RBAC, authentication (anonymous, Web3, social login), and database connection/configuration. - Refined technical wording throughout database, realtime, storage, billing, performance, telemetry, and troubleshooting guides (for example, standardizing phrasing like “use” vs “utilize”). - Updated select guidance for clearer wording on database pre-warming and clarified the scope of the Postgres logging note. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>	2026-06-17 09:28:09 -07:00
fadymak	5babf1092a	feat(auth): accept Android app origins for WebAuthn RP origins (#47043) ... Allow `android:apk-key-hash:<base64url SHA-256>` entries in `WEBAUTHN_RP_ORIGINS` alongside https/localhost-http origins. Non-http(s) origins are matched as-is downstream and Android is responsible to binding the origin to the RP ID via digital asset links.	2026-06-17 18:10:30 +02:00
Katerina SkroumpelouandChris Chinchilla	6eb40f17a7	docs: purge safeGetSession + getUser from auth example code (#47042) ... Sweeps the example code that creating-a-client.mdx and other auth docs pull via $CodeSample, so the rendered pages match the "use getClaims()" guidance. Also adds Database type stubs and parameterizes SupabaseClient<Database> across SvelteKit and Hono examples. Fixes #40985 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **Documentation** * Updated OAuth server getting-started guide to use a claims-based consent/auth gate and preserve the authorization identifier on redirect. * Added the `auth_methods` partial across framework sections in the server-side “creating a client” guide. * **Refactor** * Updated authentication examples for Hono, Next.js, and SvelteKit to rely on JWT claims for logged-in checks and protected routes. * Streamlined example auth state and UI rendering to use claims-derived information. * **Type Updates** * Improved TypeScript typing for Supabase clients and app auth data across examples, including generated database type stubs. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>	2026-06-17 17:53:27 +02:00
Jeremias Menichelli	90b15736aa	chore: Repurpose CostWarning component as partial only (#46996)	2026-06-17 16:51:02 +02:00
Katerina Skroumpelou	8b05c769fb	docs: add Nuxt/SolidStart server routes, fix stale getClaims docs (#47001) ... Resolves four docs gaps surfaced in #40985. The Nuxt SSR example in `creating-a-client.mdx` now uses `getClaims()` instead of `getUser()`, matching the file's own guidance at `:253`. The SvelteKit tutorial drops a stale `event.locals.safeGetSession` reference whose linked `app.d.ts` no longer declares one. The Nuxt and SolidJS tutorials each gain a new server-route section using `@supabase/server` (h3 adapter for Nuxt, `createSupabaseContext` for SolidStart), addressing the original complaint that those tutorials had no server setup at all. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Enhanced Nuxt 3 getting-started tutorial with new guidance on adding server routes, validating auth sessions, and using Supabase middleware for protected (and optional public) endpoints. * Updated the Nuxt Server route Supabase SSR example to validate authentication using token claims during server-side refresh. * Added a SolidJS → SolidStart SSR/API migration section, including an example protected profile route and how to make it public. * Refined SvelteKit tutorial wording around TypeScript-related session handling and updated terminology. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-06-17 14:32:54 +03:00
Guilherme SouzaandClaude	0c9d90051f	docs: Update documentation from swift SDK changes (#47024) ... ## Summary Updates docs based on stable releases in `supabase/supabase-swift`. ## Changes analyzed - **SDK**: swift - **Repo**: https://github.com/supabase/supabase-swift - **Stable tag range**: `v2.47.2...v2.48.0` - **Commits**: `716e0de6e7e0ec8eba54c6c4dfb8e980b3d51370...e5020ae5a1d01c46cc60fb5eb01157666d7214b6` ## Documentation updates ### `apps/docs/spec/supabase_swift_v2.yml` - Added `sign-in-with-passkey` entry — `signInWithPasskey(presentationAnchor:)` high-level helper (iOS 16+/macOS 13+, experimental) - Added `register-passkey` entry — `registerPasskey(presentationAnchor:)` high-level helper (iOS 16+/macOS 13+, experimental) - Added `passkey-api` group stub with 7 lower-level method entries: - `passkey-list` — `listPasskeys()` - `passkey-update` — `renamePasskey(id:friendlyName:)` - `passkey-delete` — `deletePasskey(id:)` - `passkey-start-registration` — `getPasskeyRegistrationOptions()` - `passkey-verify-registration` — `verifyPasskeyRegistration(challengeId:credentialResponse:)` - `passkey-start-authentication` — `getPasskeyAuthenticationOptions()` - `passkey-verify-authentication` — `verifyPasskeyAuthentication(challengeId:credentialResponse:)` - Updated `auth-mfa-api` overview notes to mention WebAuthn MFA (experimental) - Updated `mfa-enroll` notes and added `enrollWebAuthnFactor` example - Updated `mfa-verify` notes and added `verifyWebAuthnFactor` example ### `apps/docs/content/guides/auth/passkeys.mdx` - Added Swift tabs to: Enable in the client, Register a passkey, Sign in with a passkey, Two-step API, Manage passkeys - Updated SDK version note to include `supabase-swift` v2.48.0 - Updated reference links to include Swift All new Swift passkey APIs are gated behind `@_spi(Experimental) import Supabase`. --- 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Documentation * Expanded Swift SDK passkeys documentation to cover enabling, registering, signing in, managing, and Admin-related notes. * Added experimental Swift guidance for WebAuthn/passkeys, including updated minimum SDK version requirements. * Extended MFA to support WebAuthn/passkeys enrollment and verification (in addition to existing methods). * Added reference documentation for low-level passkey APIs to support custom authentication flows. ## Chores * Updated documentation linting spell-check allow list to include **visionOS**. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-06-17 08:05:05 -03:00
Guilherme Souza	f4c3e26fd7	docs: Update documentation from dart SDK changes (#47006) ... ## Summary Updates docs based on stable releases in `supabase/supabase-flutter`. ## Changes analyzed - **SDK**: dart - **Repo**: https://github.com/supabase/supabase-flutter - **Stable tag range**: `supabase_flutter-v2.14.1...supabase_flutter-v2.15.0` - **Commits**: `81c1590728a5e08bebdc152bd59a7c1e7644c8b2...9030650b74e253020f8c614b3bfb2c993b6061af` ## Documentation updates `apps/docs/spec/supabase_dart_v2.yml` — adds entries for the new passkey APIs landed in `supabase_flutter-v2.15.0` ([gotrue#1392](https://github.com/supabase/supabase-flutter/pull/1392), [supabase_flutter#1408](https://github.com/supabase/supabase-flutter/pull/1408)): - `signInWithPasskey()` / `registerPasskey()` — high-level helpers on `supabase_flutter` that drive the full WebAuthn ceremony. - `auth.passkey.*` — server side of the WebAuthn ceremony: `list`, `update`, `delete`, `startRegistration`, `verifyRegistration`, `startAuthentication`, `verifyAuthentication`. - `auth.admin.passkey.*` — admin endpoints: `listPasskeys`, `deletePasskey`. `apps/docs/content/guides/auth/passkeys.mdx` — adds Dart code examples to every passkey section (Enable in the client, Register, Sign in, Two-step API, Manage, Admin API) and points the reference links at both the JavaScript and Dart specs. Bumps the "Requires" admonition to include `supabase_flutter v2.15.0`. Other v2.14.2 / v2.15.0 changes that did not require doc updates: - `feat(realtime): protocol format 2.0.0` — protocol versions are already documented in `realtime/protocol.mdx`; the SDK now defaults to v2.0.0 but exposes a `version: RealtimeProtocolVersion.v1` opt-out, which is an SDK detail rather than a docs change. - `fix(gotrue): support asymmetric JWTs in getClaims` — bug fix to the existing `auth.getClaims` (no new API). - The rest are bug fixes and internal refactors (storage `createSignedUrls` null handling, postgrest stack traces, gotrue refresh-token races, PKCE email-change, realtime deaf-socket guards, lint/test/CI hygiene). `common-client-libs-sections.json` already contains entries for every new spec `id`, so the sidebar nav picks them up automatically. --- 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added Dart language examples to passkey authentication guide covering client initialization, user registration, sign-in workflows, two-step ceremony flows, and passkey management operations * Updated Dart client specification to document new passkey authentication functions and admin-level passkey management capabilities <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-06-17 06:12:54 -03:00
5 people	608040b8cb	chore(docs) Resolve 'simple' style warnings where applicable (#46966) ... Contributes to DOCS-1052 ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Resolves MDX linting errors related to "simple" where it applies. There was a couple cases that did not apply. For example, a product with "Simple" in the name. These changes are made in context, either by removing or using a more descriptive synonym like "minimal" or "basic". ## Tophatting 1. Read each of the diffs. 2. See that the text still makes sense in context. For extra due diligence, you can run `pnpm lint:mdx` locally and see the 'simple' errors that remain and whether they are worth addressing. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **Documentation** * Updated many guide, tutorial, and troubleshooting pages with clearer “basic”/“minimal” wording across setup steps, local testing instructions, security cautions, and RLS guidance. * Refined headings, example descriptions, and inline comments for consistency (including deployment, MCP, metrics API, and search/function phrasing). * Improved readability with small snippet formatting tweaks (whitespace plus import/comment ordering) and added a self-hosting debugging note for Envoy admin endpoints via a short-lived `curl` container. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Chris Chinchilla <chris.ward@supabase.io> Co-authored-by: Nik Richers <nrichers@gmail.com>	2026-06-16 21:45:55 +00:00
Kimaswa Emmanuel YusufuandChris Chinchilla	64085b2d0c	docs: fix broken code examples and wrong identifiers in guides (#46755) ... A handful of code samples in the guides either don't run or contradict the surrounding text. I found these reading through the docs. - `database/debugging-performance`: `insert into books` targets a table that's never created. The table made just above is `instruments`. - `database/drizzle`: the `db.ts` snippet references an undefined `host`. The variable in scope is `connectionString`. - `database/postgres/column-level-security`: the `create table` is missing a comma after `created_at ... now()`, so it won't parse. - `database/postgres/first-row-in-group`: `distinct on (team)` with `order by id, ...` is rejected by Postgres (the DISTINCT ON column has to lead the ORDER BY). Ordered by `team, points desc` so it returns one row per team. - `database/postgres/data-deletion`: reversed markdown link `(text)[url]`, plus "parititioning" misspelled. - `database/extensions/pg_plan_filter`: prose says `statement_cost_filter`, but the real parameter (used everywhere else in the file) is `statement_cost_limit`. - `auth/auth-hooks/mfa-verification-hook`: the insert and on-conflict update use `last_refreshed_at`, but the table column is `last_failed_at`. - `telemetry/advanced-log-filtering`: the "ends with" example writes `'$port=12345'`. The `$` anchor needs to come after the literal: `'port=12345$'`. - `ai/examples/headless-vector-search`: uses `${projectURL}` but the const is `projectUrl`. - `getting-started/quickstarts/redwoodjs`: prose says `scripts/seeds.ts`, but the code block and Redwood use `scripts/seed.ts`. - `getting-started/tutorials/with-flutter`: two code-fence headers have a stray trailing `"`. - `local-development/cli/testing-and-linting`: stray backtick in "Edge` Functions". <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Corrected code examples across multiple guides including vector search, authentication hooks, database guides, and quickstarts * Fixed SQL syntax errors, variable names, and table references in example snippets * Resolved typos, broken links, and formatting inconsistencies in guide text * Clarified parameter names and script references in documentation * Updated code fence syntax in tutorials for proper rendering <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>	2026-06-12 16:08:41 +00:00
Kimaswa Emmanuel YusufuandChris Chinchilla	d35e8081d0	docs: fix invalid syntax and wrong identifiers in code examples (#46694) ... Reading through the guides and troubleshooting docs I found a set of code examples that don't parse or run as written. Each is a small, self-contained fix: - **troubleshooting/postgres-logs**: the `regexp_contains(...)` call was missing its closing parenthesis. - **troubleshooting/rls-performance**: the PL/pgSQL `return` statement was missing its terminating semicolon. - **troubleshooting/supavisor-faq**: the `CREATE USER ... WITH PASSWORD` string literal was unterminated (missing closing quote). - **troubleshooting/google-auth-fails**: missing comma between `provider` and `options` in the `signInWithOAuth` object literal. - **integrations/supabase-for-platforms**, **database/extensions/pg_graphql**, **deployment/branching/working-with-branches**: missing commas between JSON properties. - **database/extensions/pgjwt**: the default algorithm was written `'HSA256'`; the real default is `'HS256'` (used in both `sign` and `verify`). - **auth/auth-email-passwordless** (Dart): `signinwithotp` should be `signInWithOtp`. - **auth/third-party/firebase-auth**: `async function setRoleCustomClaim() => {` mixed a function declaration with arrow syntax. - **storage/management/copy-move-objects**: the storage helper is `storage.foldername(name)`, not `storage.folder(name)`. - **troubleshooting/hsnw-index**: prose referred to `maintance_work_mem`; the setting is `maintenance_work_mem` (the SQL in the same file spells it correctly). - **troubleshooting/pgcron-debugging**: a stray double quote inside the `cron.job_run_details` code span. 13 files, all one-line fixes. Happy to split if you'd prefer. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Corrected code examples across authentication, database, storage, and troubleshooting guides * Fixed method naming and syntax errors in code snippets (Dart auth, Node.js Firebase, SQL functions) * Updated API signatures and variable names for accuracy * Improved JSON formatting in example payloads * Corrected typos in documentation text <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>	2026-06-08 15:09:08 +00:00
Chris Chinchilla	ddba257686	docs: Couple of random anon leftovers (#46732) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES/ <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Documentation * Updated project variables guidance to include publishable and secret keys alongside existing options. * Updated code examples across multiple frameworks to use publishable keys instead of anon keys. * Updated tool descriptions to reflect publishable key terminology. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-06-08 13:55:57 +00:00
Taryn KingandChris Chinchilla	7693d6ceda	docs(auth hooks): clarify hook name must match available hooks (#40220) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update ## What is the current behavior? Auth hooks documentation doesn't explicitly state that the hook name configured in `config.toml` must correspond to available hooks to prevent errors, which has caused confusion for some users. ## What is the new behavior? Doc includes mention that hook name must correspond to available hooks. ## Additional context <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added clarification note regarding authentication hook configuration requirements, specifying that hook names in configuration files must correspond to available hook types. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>	2026-06-08 10:37:10 +00:00
Chris Chinchillaandfadymak	e4f824b835	docs: Strengthen keys note (#46578) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Consolidated API key deprecation guidance into a reusable notice for consistent messaging across docs. Announces deprecation of legacy anon/service_role JWT-secret keys by end of 2026, instructs switching to sb_publishable_xxx / sb_secret_xxx, and provides steps to locate and copy both new and legacy keys. Applied across auth, getting-started, API, and realtime guides. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: fadymak <dev@fadymak.com>	2026-06-04 11:56:23 +02:00
Jeremias Menichelli	b4448fedd2	fix(content): Remove map calls. Improve md extraction. (#46511)	2026-06-01 15:55:06 +02:00
Tomás Pozoandfadymak	19944c1e4e	docs: note minimum supabase-js version for passkeys (#46491) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Update passkeys docs to note the min required `supabase-js` version ## What is the current behavior? No mention of what `supabase-js` version is required ## What is the new behavior? Add note with the min `supabase-js` version. ## Additional context <img width="949" height="537" alt="Screenshot 2026-05-28 at 23 29 04" src="https://github.com/user-attachments/assets/96427b23-146b-4373-a1a6-db2a1f7d2da4" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated passkey authentication guide with version requirement information clarifying the minimum library version needed for passkey support. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46491?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: fadymak <dev@fadymak.com>	2026-05-29 13:11:41 +00:00
fadymak	d9d6a422a7	feat(docs): passkey registration and authentication (#46340) ... Adds documentation for Passkey registration and authentication flows.	2026-05-28 13:28:39 +02:00
4 people	a45776ecb9	feat(studio): restrict auth email template editing for free projects (#45396) ... ## What kind of change does this PR introduce? Feature / abuse-prevention update. Resolves DEPR-198. ## What is the current behaviour? Free projects using Supabase's built-in email service can edit raw Auth email template subjects and HTML in Studio. That is the risky cohort this project is trying to constrain. ## What is the new behaviour? ### Template editing restrictions For free projects using Supabase's built-in email service, Studio keeps Auth email templates viewable and previewable but disables subject/body editing and saving. Editing is unlocked by setting up Custom SMTP, configuring a send-email hook, or upgrading to a paid plan. **Grandfathering:** projects created before `2026-06-01T00:00:00Z` (the platform enforcement cutoff) are exempt; their editing UI stays unlocked. This mirrors `FREE_TIER_TEMPLATE_BLOCK_CUTOFF_DATE` in the platform PR exactly. | After | | --- | | <img width="1024" height="759" alt="Emails Authentication Fizz Test Supabase-173BB09B-0FB9-4133-8202-9E310DDB347A" src="https://github.com/user-attachments/assets/c966212d-ed0c-443b-8197-440cc2937ef6" /> | | <img width="1024" height="759" alt="Emails Authentication Fizz Test Supabase-CD5845EB-0E45-4779-8989-44E775B2411A" src="https://github.com/user-attachments/assets/055a64d6-b5e8-4d37-a261-6e280f04536a" /> | ### Warning dialogs on transitions that reset templates Two flows now surface a warning before the user commits to a state change that resets their custom email templates to defaults: 1. **Disabling custom SMTP** (SMTP settings page): a confirmation dialog warns that templates will be reset to defaults and the email rate limit reduced to 2 per hour. On confirm, Studio resets all 13 templates via the existing per-template reset endpoint (`Promise.allSettled`). The "won't be able to edit" sentence is shown only for post-cutoff projects; grandfathered projects skip it. The corresponding server-side enforcement is in the Platform PR: https://github.com/supabase/platform/pull/33129 2. **Downgrading to the Free plan** (billing settings): an admonition in the existing downgrade confirmation modal warns that custom templates will be reset to defaults and won't be editable without custom SMTP. The admonition is shown only when the org has at least one post-cutoff project; orgs whose projects are all grandfathered skip it. | Custom SMTP | Downgrading | | --- | --- | | <img width="862" height="586" alt="66764" src="https://github.com/user-attachments/assets/6470c8a6-2f79-40a5-ad3b-bfe5b0ba9c54" /> | <img width="1268" height="1552" alt="CleanShot 2026-05-22 at 17 28 37@2x-FEB1901E-38E6-42DF-8C27-0A036D8A1B94" src="https://github.com/user-attachments/assets/e8caa9e6-c3ed-4787-b771-af77a43eb854" /> | ### Informational admonition when enabling SMTP When a user enables custom SMTP for the first time, a sandwiched admonition above the save footer informs them that the email rate limit will be increased to 30 per hour and can be adjusted. _This is just a minor cosmetic change, unrelated to the email template disabling. Sorry._ | Before | After | | --- | --- | | <img width="1024" height="759" alt="Emails Authentication Chisel Toolshed Supabase-54317D18-803C-4A58-8211-2359355D083B" src="https://github.com/user-attachments/assets/29eff649-02dc-40f3-a379-0b4d484a76c7" /> | <img width="1024" height="759" alt="Emails Authentication Chisel Toolshed Supabase-9E12399E-E9FB-4F9A-B029-A08008EA4B50" src="https://github.com/user-attachments/assets/e542ed86-4da6-407e-8293-0f4c0f071e18" /> | ## How to test All existing projects pre-date the enforcement cutoff (`2026-06-01T00:00:00Z`) and are grandfathered, so the restriction UI won't appear by default. To force the restricted state locally, back-date the cutoff in one file: In `apps/studio/components/interfaces/Auth/EmailTemplates/EmailTemplates.utils.ts`, temporarily change: ```ts export const FREE_TIER_TEMPLATE_BLOCK_CUTOFF_DATE = '2026-06-01T00:00:00Z' ``` to: ```ts export const FREE_TIER_TEMPLATE_BLOCK_CUTOFF_DATE = '2025-01-01T00:00:00Z' ``` Revert before committing. With the cutoff back-dated, use a free-plan project and: - **Template restriction + admonition:** navigate to Authentication > Emails with no custom SMTP configured. Subject/body fields should be read-only and the "Set up SMTP" admonition should appear, with its dropdown offering upgrade and send-email hook options. - **SMTP disable warning:** enable custom SMTP on a project, then disable it via Authentication > SMTP Settings. The confirmation dialog should warn that templates will reset to defaults and that editing will be restricted after disabling. - **Downgrade warning:** in billing settings, initiate a downgrade to the Free plan. The downgrade modal should include an admonition warning about template reset and restricted editing (only if the org has at least one post-cutoff project). ## Additional context The default Auth email template copy was also improved across docs, examples, and UI library snippets (separate prior commits). The per-template reset button (`ResetTemplateDialog`) was migrated to the async `AlertDialogAction` pattern introduced in #45960; the dialog stays open and shows a loading state while the reset is in-flight, closes on success, and stays open on error. Closes PRODSEC-183 --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com> Co-authored-by: Stephen Morgan <stephen@doublethink.co.nz>	2026-05-28 17:23:45 +12:00
Timothy Lim	0840d45417	chore(docs): Clarify identity linking for SSO (#46273) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? - SSO accounts are not legible for any identity linking - Remove bit about choosing correct account when accepting invite as inviter specifies if invite is linked to SSO or not https://github.com/supabase/supabase/pull/43615 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Clarified that accounts created via SAML SSO are ineligible for identity linking to existing user accounts (manual or automatic) * Updated organizational account and identity management guidance for SSO-enabled environments * Enhanced documentation on properly handling non-SSO account memberships in SSO-required organizations and preventing duplicate account creation <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46273?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-05-25 08:30:46 +08:00
Danny WhiteandJoshen Lim	38e09e1754	chore(studio + docs + ui library): update auth email template copy docs (#45706) ... ## What kind of change does this PR introduce? Docs update. Part of DEPR-198. ## What is the current behaviour? Auth email template examples and Studio template labels still reflect older default copy in a few places. ## What is the new behaviour? Updates Auth docs, local development docs, related snippets, Studio template labels, and UI Library examples to [match the updated default Auth email copy](https://linear.app/supabase/document/email-template-copywriting-updates-04bba460fd2a). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated authentication email template names and descriptions across guides, replacing "Magic link" with "Sign-in link or code" terminology * Revised security notification email naming from "Identity linked/unlinked" to "Sign-in method linked/removed" and "MFA method" to "Verification method" * Updated email template example content with improved wording (e.g., "Confirm your email address" instead of "Confirm your signup") * **UI Updates** * Refined authentication-related UI text labels and descriptions in the dashboard [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45706) <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com>	2026-05-22 11:47:36 +10:00
3 people	c88dba9628	docs: add Nuxt examples to SSR client guide (#43944) ... ## What kind of change does this PR introduce? Documentation update. ## What is the current behavior? The server-side auth client guide currently includes framework examples for Next.js, SvelteKit, Astro, Remix, React Router, Express, and Hono, but not Nuxt. ## What is the new behavior? - Adds a Nuxt env var tab in the setup section. - Adds a Nuxt framework section in the create-client guide with: - A server route example using `createServerClient` with cookie adapters. - A browser plugin example using `createBrowserClient`. ## Additional context Closes #34283 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **Documentation** * Added comprehensive Nuxt server-side rendering guide for creating Supabase clients with cookie support, including environment variable configuration setup and implementation examples for both server and browser environments. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/43944?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>	2026-05-19 07:57:45 +00:00
Timothy Lim	0884060914	fix(docs): Fix Oauth docs and code to use redirect_url (#45966) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Fix incorrect reference to `redirect_to` when it should be `redirect_url` - https://github.com/supabase/supabase-js/blob/1c48755657c5f7aac5e4a7abf3f68f27efc0c746/packages/core/auth-js/src/lib/types.ts#L2561-L2569 - https://github.com/supabase/supabase-js/blob/1c48755657c5f7aac5e4a7abf3f68f27efc0c746/packages/core/auth-js/src/lib/types.ts#L2534-L2537 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Enhanced OAuth Server "Getting Started" guide with updated code examples and clearer explanatory steps for implementing authorization flows with accurate field references. * Refined OAuth authorization code flow documentation, including updated diagrams and instructions to ensure consistent field references across all redirect and consent handling steps. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45966) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-05-18 20:48:07 +08:00
Danny WhiteandChris Chinchilla	9c03ad6b02	chore(docs): migrate Admonition labels to titles (#46053) ... ## What kind of change does this PR introduce? Docs update. Related to DEPR-551. ## What is the current behavior? Docs MDX still uses the legacy `label` prop for Admonitions, even though #45618 added `title` and kept `label` only as a backwards-compatible alias after #45302 was reverted in #45535. ## What is the new behavior? Migrates Docs-owned Admonitions from `label=` to `title=` without changing rendered copy, component APIs, Studio callsites, design-system examples, or the legacy `label` alias. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Standardized admonition headings across the docs by switching how admonition headings are provided (preserving all visible guidance and examples). Content and instructions remain unchanged; this ensures consistent rendering of callouts and improves uniformity across guides and reference pages. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46053?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>	2026-05-18 19:00:09 +10:00
Danny WhiteandJoshen Lim	f45a6085f4	feat(studio): add auth email template reset flow (#45572) ... ## What kind of change does this PR introduce? Feature. Resolves AUTH-879. ## What is the current behavior? Studio does not provide a way to reset an Auth email template back to the default subject and body once it has been customised. ## What is the new behavior? Studio shows a `Reset template` action when Platform reports that the selected Auth email template subject or body has been customised. The action opens a confirmation dialog, calls the dedicated Platform reset endpoint, and refreshes the editor with the default subject and body returned by the API. The Auth config save/reset mutations now run their user-facing success handling before refreshing Auth lint data, so the success toast and local editor cleanup are not delayed by lint refetches. ## Additional context Depends on supabase/platform#32417. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Reset email templates to defaults via a confirmation dialog; button appears when custom content is detected and respects update permissions. * Typed email-template definitions and improved template variable display and descriptions. * **Tests** * Added tests covering template reset visibility, confirmation flow, state updates, permission handling, and toast notifications. * **Documentation** * Example email template placeholders updated for internationalization and provider snippets. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45572) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com>	2026-05-18 14:33:26 +10:00
Chris ChinchillaandCemal Kılıç	8b01d388b9	docs: Remove leftover auth-ui components (#45931) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated authentication guide for Kotlin Compose Multiplatform with revised dependency configuration. * Enhanced user-management example README with improved project structure, deployment steps, and resources. * **Chores** * Refactored example applications to use custom authentication forms instead of pre-built Auth UI components. * Removed unused authentication UI dependencies from multiple example projects. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45931) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Cemal Kılıç <cemalkilic@users.noreply.github.com>	2026-05-14 15:42:09 +00:00