Adds a guide for the recently introduced recursive/nested function
rate-limits.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
When a session token is refreshed server-side, `@supabase/ssr` writes
the updated JWT via Set-Cookie. If a CDN caches that response and serves
it to another user, that user will be signed in as the wrong person.
Adds documentation covering this in two places:
- creating-a-client.mdx: brief mention with a link to the full
explanation
- advanced-guide.mdx: expands the existing CDN FAQ with an explanation
of the risk and Cache-Control: private, no-store examples for Next.js
and Nuxt
Related: https://github.com/supabase/supabase-js/issues/1682
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
docs update
## What is the current behavior?
n/a
## What is the new behavior?
n/a
## Additional context
Add any other context or screenshots.
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Add a couple of technical terms, and a handful of common brand and
products names to simplify docs submissions.
## Description
Adds a troubleshooting article for the `UNUSED_EXTERNAL_IMPORT` build
warnings
that Vite/Rollup/Nuxt users see when bundling apps that use
`@supabase/supabase-js`.
**File:**
`apps/docs/content/troubleshooting/unused-external-import-warning-vite-rollup.mdx`
## What the article covers
- What the warning looks like
- Why it's a false positive (re-exported external imports not recognised
as "used"
by Rollup's code-body check)
- `onwarn` suppression snippet for Vite/Rollup
- `onwarn` suppression snippet for Nuxt
## Related
- https://github.com/supabase/supabase-js/issues/2010
- https://github.com/supabase/supabase-js/pull/2122
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
docs update
## What is the current behavior?
Superuser settings list is out of date
## What is the new behavior?
Update superuser settings with [new
configs](https://github.com/supabase/postgres/blob/21338c84583acc6f0d65fc99f014c83206aaa32d/ansible/files/postgresql_config/supautils.conf.j2#L13)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated PostgreSQL custom configuration guide with new superuser-level
settings options including deadlock timeout, parameter logging, network
connectivity, safe update enforcement, and function tracking
capabilities.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
docs update
## What is the new behavior?
Adds PostgREST mirror codes
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a comprehensive PostgREST Error Codes guide covering database-
and API-level errors, HTTP status mappings, JSON examples, SQL query
samples, and log-analysis/debugging tips.
* Updated REST API Guides navigation to include the new Error Codes
documentation link.
* **Style**
* Expanded spelling allow-list to include "Grantor" (case variant) and
"SQL".
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
* docs: improve Facebook OAuth guide with troubleshooting and clearer instructions
- Add explicit callback URI pattern with link to dashboard
- Add dedicated "Configure email permissions" section with caution admonition
- Add "Testing your integration" section explaining development mode
- Add "Going live with App Review" section with step-by-step guide
- Add "Troubleshooting" section for common issues
- Add error handling to JavaScript code examples
- Fix Swift example with complete ASWebAuthenticationSession implementation
- Add note about checking pub.dev for latest Flutter package version
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Apply suggestions from code review
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* Apply suggestions from code review
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* docs: improve Facebook OAuth guide with troubleshooting and clearer instructions
- Add explicit callback URI pattern with link to dashboard
- Add dedicated "Configure email permissions" section with caution admonition
- Add "Testing your integration" section explaining development mode
- Add "Going live with App Review" section with step-by-step guide
- Add "Troubleshooting" section for common issues
- Add error handling to JavaScript code examples
- Update Swift example to use webAuthenticationSession environment
- Add note about checking pub.dev for latest Flutter package version
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* style: run format
* Apply suggestions from code review
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
* feat(docs): update-ai-prompts
Adds links to prompts from MCP docs, and creates a table of relevant tools where these prompts can be used.
* prompts should be more visible
* Prettier and MDX lint
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
* docs(branching): add the list of all valid secrets fields
* chore(docs): allow Captcha to the rules spelling lints
* docs(branching): make external secret a star field
* docs: improve BYOM guide for MCP server deployment and OAuth integration
* fix tutorial for simple mcp server
* remove authentication section
* fix rebase
* fix pnpm.lock
* add Zod to dictionary
* remove authentication from the beginning
* fix mcp-lite link
* change order of deno.json
* fix mcp-handler
* docs: update Refine svg in HeroFrameworks
* docs: use capital R for Refine mentions
* docs: use main branch for Refine repository references
* docs: update connect interface example code for Refine
* docs: update Refine quick start tutorial with Refine v5
* examples(refine-user-management): upgrade to Refine v5
* docs: update Refine getting started tutorial with Refine v5
* chore(studio): update Refine icon on Connect modal
* docs: update Refine svg
* docs: update welcome screen screenshot in Refine tutorial
* docs: update dimensions of welcome screen screenshot in Refine tutorial
* chore: remove leftover dist assets from Refine example
* chore(linter): add Refine to Rule001 and Rule003
* chore: format getting started with Refine.mdx
* chore: remove .prettierrc file from the example
* Add cant access to supabase
* Add identify lovable backend guide
* Improve guide with images and components
* Improve style
* Fix relative urls
* Apply formatting rules
* Put link in line
* Apply formatting rules
* Add Lovable and Lovable Cloud to words allows_list
* Use Admonition for note
* Apply several improvements to content
* Add Pedro Rodrigues to humans.txt
* docs: add MCP-lite Edge Functions tutorial
- Add comprehensive tutorial on building MCP servers with mcp-lite on Supabase Edge Functions
- Add navigation entries in Examples and Third-Party Tools sections
- Based on Fiberplane blog post about mcp-lite and Supabase integration
* docs: remove redundant 'supabase init' step from MCP-lite tutorial
The template from 'npm create mcp-lite@latest' already initializes Supabase, so this step is not needed.
* docs: clarify local development steps for MCP-lite tutorial
- Separate 'supabase start' and 'supabase functions serve' into distinct steps
- Clarify that npm run dev only serves the function, not starts Supabase
- Make it clear these should be run in separate terminals
* style: format MCP-lite tutorial with prettier
* Update apps/docs/content/guides/functions/examples/mcp-server-mcp-lite.mdx
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* Fix rules
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
* docs: general improve apple sign in guide
* docs: add note regarding supporting full name when sign in with apple
* add ComposeAuth to spelling list
* Formatter
* apply code review fixes
# Conflicts:
# apps/docs/content/guides/auth/social-login/auth-apple.mdx
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
* feat: add `crypto-js`, `encryptString` with sample key
* feat: include POSTGRES_PASSWORD in generated .env.test
* feat: include POSTGRES_PASSWORD in turbo.json for studio
* feat: read only query support
* feat: configurable `POSTGRES_HOST`, `POSTGRES_DB`, `POSTGRES_PORT`
* chore: rename POSTGRES_USER to clarify write permission
* feat: configurable `PG_META_CRYPTO_KEY`
* chore: add `PG_META_CRYPTO_KEY` to generateLocalEnv
* feat: add 'postgres-meta' to linter dictionary
* feat: restore read-only toggle in local MCP URL builder
* docs(react-native): create the basic expo project
* docs(react-native): cross-platform Apple social sign-in
* docs(react-native): cross-platform Google social sign-in
* docs(react-native): fix typos
* docs(react-native): remove wrong entry in the `Connection` component
* Correct typos
* Prettier
* Draft
* Draft
* docs(react-native): use kebab-case file naming convention in Expo guide
- use kebab-case file naming convention in Expo guide
- add trailing semicolon to align with the standard Expo template conventions
* docs(react-native): use kebab-case file naming convention in Expo social auth example
* docs(react-native): update the packages of the Expo social auth example
* Fix
* Draft
* Changes
* Correct log message
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
* docs(auth): add Flutter signInWithIdToken example for Facebook auth
Add documentation section showing how to integrate Facebook authentication
in Flutter using the signInWithIdToken method with the Facebook SDK.
Includes dependency setup, basic implementation, and error handling.
* fix style
* docs(dart): add Facebook signInWithIdToken example
Add native Facebook sign-in example to the Dart client reference
documentation. Includes integration with flutter_facebook_auth package
and proper error handling for the signInWithIdToken method.
* docs(dart): simplify provider parameter description
Remove specific provider enumeration from parameter description
to keep it more generic and maintainable.
* Add signInWithIdToken to spelling allow list
* Update auth-facebook.mdx
Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
* Update apps/docs/content/guides/auth/social-login/auth-facebook.mdx
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* Update apps/docs/content/guides/auth/social-login/auth-facebook.mdx
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---------
Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* feat: add documentation and UI integration for Before User Created hook
- Added new guide: `before-user-created-hook.mdx`, documenting usage, inputs,
outputs, and multiple complete examples for HTTP and SQL.
- Updated navigation menu and hook index table to include the new hook.
- Hook is now listed as available on Free and Pro plans.
Studio changes:
- Registered `Before User Created` hook in `hooks.constants.ts` with proper
title, slug, and configuration keys.
- Enabled Docs button linking to hook guide in both `CreateHookSheet` and `HookCard` components.
- Extended hook listing page to support docs access via `secondaryActions`.
This hook allows developers to intercept and reject user creation across all
flows (email/password, OAuth, SSO, SAML, anonymous) - enabling custom signup
logic like domain allowlists, geofencing, or account gating.
* fix: add subnet to mdx lint allowed list
* fix: incorporate feedback and spelling changes
* feat: add allow/deny domain and CIDR examples to before-user-created hook
This commit enhances the documentation for the before-user-created auth hook:
- Adds production-ready SQL examples for blocking or allowing signups by email domain (signup_email_domains) and IP address or CIDR (signup_networks)
- Introduces enum-based classification (allow vs deny) for both domain and network restrictions
- Adds full migration-style snippets for easy copy/paste into Supabase SQL Editor
- Includes updated HTTP examples that delegate to Postgres functions via Supabase client rpc()
- Adds environment setup guidance and edge function scaffolding
* fix: pnpm format
---------
Co-authored-by: Chris Stockton <chris.stockton@supabase.io>
