Add login and signup

Let people sign up and log in securely. The boring auth stuff, handled.

Categories: authentication, signup

Editorial review: August 2026

A practical authentication stack for an MVP

This is a complementary stack, not a list of competing tools. Supabase Auth owns identities and sessions, Resend delivers transactional authentication email, and Zod validates untrusted form input before it reaches the authentication boundary. The architecture is fast to launch, but production readiness depends on redirect controls, row-level authorization, recovery flows, and email deliverability.

Best for

  • Web products already using Supabase or Postgres with row-level security
  • MVPs that need email/password, magic links, or social login without operating an identity service
  • Small teams that want explicit control over their signup UI and transactional email

Consider another approach when

  • Enterprise identity projects that require a formal SSO, directory, or compliance evaluation before vendor selection
  • Products that need a no-code hosted login experience with minimal application work
  • Teams that do not have an owner for authorization policies, abuse controls, and account recovery

What each tool owns

ToolRoleChoose it forWatch for
Supabase AuthIdentity, credentials, OAuth, and sessionsCreating users, issuing sessions, linking providers, and enforcing database access with row-level security.Authentication does not replace authorization. Every sensitive table and server action still needs an explicit access policy.
ResendTransactional email deliverySending branded confirmation, magic-link, invitation, and recovery messages through a production email domain.Configure domain authentication, monitor delivery failures, and avoid leaking whether an account exists in recovery responses.
ZodInput validation and typed schemasSharing form rules between client and server while rejecting malformed input before calling authentication APIs.Client validation improves usability but is never a security boundary; repeat validation on the trusted server path.

Design the account lifecycle before building the form

Map the full lifecycle: signup, email confirmation, first session, logout, forgotten password, password change, social-login linking, email change, and account deletion. Most authentication bugs appear in the transitions between these states rather than in the initial signup form.

Choose one canonical redirect destination for each flow and allowlist only the origins your application actually uses. Preserve the user’s intended destination after login, but never accept an arbitrary redirect URL from an untrusted query string.

Production implementation checklist

Treat Supabase Auth as the identity layer and row-level security as the authorization layer. A valid session proves who the user is; it does not prove that the user may read or modify a particular record.

  • Validate email, password, and profile fields on both the client and the trusted server path.
  • Use generic signup and recovery responses where necessary to reduce account-enumeration risk.
  • Configure a production SMTP provider and test confirmation, invitation, and password-reset templates on mobile and desktop.
  • Add row-level security policies before exposing user-owned tables through the client SDK.
  • Handle expired links, reused recovery links, provider conflicts, and users who close the browser midway through OAuth.
  • Log authentication failures without recording passwords, tokens, magic links, or full recovery URLs.

What to test before launch

Test with a new address, an existing address, a mistyped address, an expired confirmation, and two accounts that share the same email through different providers. Repeat the flows in a private browser window so cached sessions do not hide redirect and storage problems.

  • A signed-out user cannot read or mutate another user’s data.
  • A password reset invalidates the intended credentials and returns the user to a safe route.
  • Confirmation and recovery emails pass through the production domain and arrive with the expected links.
  • Logout clears local application state as well as the authentication session.
  • The UI explains recoverable failures without exposing sensitive account information.

Tools that power the Add login and signup stack

Setup guide

  1. Supabase Auth: Configure the required sign-in providers in Supabase Auth, add the production and local redirect URLs, and build signup, login, logout, and recovery flows with the Supabase client. Protect user-owned tables with Row Level Security and verify the flow with a non-admin test account. (Open Supabase Auth instructions)
  2. Resend: Verify a sending domain in Resend and connect it as the email provider for Supabase Auth. Customize confirmation and recovery messages, trigger both emails with a test account, and confirm that the links return to an allowlisted application URL. (Open Resend instructions)
  3. Zod: Define shared Zod schemas for signup, login, and password-reset inputs, including normalized email and password rules. Validate on the server as well as in the browser, return field-level errors without exposing account existence, and add tests for valid and invalid payloads. (Open Zod instructions)