Sign-in with Supabase

IntermediateAuth

Email and password (plus only the methods you list) with a protected route and a session that survives reload.

When to use it

Use when the project already has, or will have, Supabase. Do not use it for another auth vendor: swap the prompt instead of letting the model mix the two.

Variables

[APP_NAME][STACK][METHODS][AFTER_LOGIN][PROTECTED_ROUTES]

Copy prompt

Add Supabase auth to [APP_NAME], in [STACK].

Decisions already made
- Methods: [METHODS]
- Where to go after login: [AFTER_LOGIN]
- Routes that require a session: [PROTECTED_ROUTES]

Do not replace the project's UI library. Do not create a parallel user backend.

Build
- Sign up, sign in, and sign out, only with the methods in [METHODS].
- If [METHODS] includes email/password: minimum 8 character password, generic message when login fails (do not reveal whether the email exists).
- A session that remains after reload.
- [PROTECTED_ROUTES] redirect to login when there is no session, then return to the original URL.
- A sign-out control that clears the session and sends the person to a public page.
- Environment variables documented in .env.example. The anon/public key may ship to the client. The service_role key may not. If you need it, keep it on a server and name the file.

Do not
- Do not print the session to the console in production.
- Do not store the password in localStorage.
- Do not turn off email confirmation unless I ask.

Deliver
1. Changed files, as a list.
2. Supabase dashboard steps (redirect URL, provider) that code does not configure by itself.
3. A manual test: sign up, sign out, sign in, open a protected route without a session, reload while signed in.

If the repo has no Supabase client, add the smallest possible wiring and stop so I can paste the URL and the anon key. Do not invent those two strings.

How to run this prompt

List the methods. Email/password is the default. Add OAuth only if METHODS names the provider.
Name the routes. PROTECTED_ROUTES is the list that requires a session.
Review the key. Search the browser code for service_role before you commit.

Where this breaks

The service_role key must not reach the client. The prompt asks the model to point at the file if it does. Confirm the email redirect in the dashboard, because code alone does not prove it.

Result

Slot for a screenshot or demo. No result is published yet.