Supabase Authentication
Add user accounts to your app with Supabase Auth. Users can sign up, log in, reset passwords, and maintain sessions across app launches.Prerequisites
- Supabase connected
- Your Nativeline project
Setting Up Auth
Tell Nativeline what you need:- Auth service/manager
- Login screen
- Signup screen
- Session handling
Authentication Flow
Signup Flow
Login Flow
Session Persistence
Supabase handles session tokens automatically:- Tokens stored securely
- Auto-refresh before expiry
- User stays logged in across app launches
Creating Auth Screens
Signup Screen
Login Screen
Password Reset
Handling Auth State
Check if User is Logged In
Get Current User
Sign Out
Email Verification (Optional)
By default, Supabase can require email verification:Enable in Supabase Dashboard
- Authentication → Settings
- Toggle “Enable email confirmations”
- Customize email template if desired
Handle in App
Disable for Testing
For development, you can disable email confirmation:- Supabase Dashboard → Authentication → Settings
- Disable “Enable email confirmations”
Protecting Data with User IDs
Associate Data with Users
When saving data, include the user’s ID:Row Level Security
In Supabase, create policies so users only see their data:Handling Auth Errors
Common Errors
| Error | Cause | Solution |
|---|---|---|
| Invalid email | Bad format | Validate email format |
| Weak password | Too short | Require 6+ characters |
| User exists | Duplicate signup | Show “Account exists, try logging in” |
| Invalid credentials | Wrong password | Show “Incorrect email or password” |
| Too many requests | Rate limited | Show “Please wait and try again” |
Error Handling in App
Auth Best Practices
Validate on client AND server
Validate on client AND server
Validate inputs before sending to Supabase. But also rely on Supabase’s server-side validation — don’t trust client validation alone.
Use secure password requirements
Use secure password requirements
Require at least 6 characters (Supabase default). Consider:
- Minimum 8 characters
- Mix of letters and numbers
- Password strength indicator
Handle sessions properly
Handle sessions properly
Let Supabase handle token refresh automatically. Don’t store passwords locally. Clear sessions on logout.
Don't expose user existence
Don't expose user existence
When login fails, say “Invalid email or password” — not “User not found.” This prevents account enumeration attacks.
Testing Auth
In Simulator
- Create a test account
- Verify login works
- Close and reopen app (should stay logged in)
- Test logout
- Test password reset flow
Reset Test Users
In Supabase Dashboard:- Authentication → Users
- Find test user
- Delete or modify as needed
Advanced: Social Auth (Future)
Supabase supports social logins (Google, Apple, GitHub). These require additional setup:- Apple: Requires Apple Developer account
- Google: Requires Google Cloud setup
- OAuth: Various providers