Configuring and Managing User Authentication (Auth)

1. Log in to the RDS console.
2. Click in the upper left corner and select a region.
3. In the navigation pane, choose AI App Dev Platform.
4. On the AI App Dev Platform page, click the target AI application name to open its details page.
5. In the navigation pane, choose Auth Configuration to open the Auth configuration page.
   Figure 1 Auth configuration for an RDS Supabase application
   

1. Follow the steps in Viewing the Full Auth Configuration to open the Auth configuration page.
   Figure 2 Auth configuration (user registration) for an RDS Supabase application
   

   Enable or disable the relevant settings as needed based on your business requirements.

   Table 1 Supabase user registration settings

   Parameter	Description	Precautions
   Allow New User Registration	Controls whether new users can register with your application project. If disabled, the system will not allow new user registration, and all new user registration requests (including email, OAuth, anonymous, etc.) will be rejected.	Exercise caution when disabling this setting, as all new user registration requests, including email, OAuth, and anonymous sign-ups, will be rejected.
   Allow Anonymous Login	Controls whether anonymous users are allowed to access. With only the API Key obtained from the RDS management console, a temporary identity can be created without providing any personal information (email, phone, or password), directly creating a temporary "guest" account.	If enabled, anonymous users (guests) can also access Supabase application services. Exercise caution when enabling this setting.

2. After you change the settings, a configuration delivery task is triggered. Wait for the task to complete to ensure that the changes take effect in the Supabase service.

1. Follow the steps in Viewing the Full Auth Configuration to open the Auth configuration page.
   Figure 3 Auth configuration (access control) for an RDS Supabase application
   

   Modify the relevant parameters as needed based on your business requirements.

   Table 2 Supabase access control settings

   Parameter	Description	Example Value	Precautions
   Site URL	Specifies the URL of your frontend project (website). It is used to construct links in emails and is the page users are redirected to when they click those links. After OAuth sign-in, email magic-link verification, or password reset, the user's browser is redirected to this URL.	http://10.10.10.20:8080	Both IP addresses and domain names are supported. Domain names must be resolvable and accessible.
   API External URL	Specifies the full, externally accessible URL of the Supabase application service. It is used for scenarios involving external callbacks, such as OAuth sign-in, SSO, and email link redirects. Format: SSL disabled: http://{supbase_eip_address}:8443 SSL enabled: https://{supbase_eip_address}:8443	SSL disabled: http://10.10.10.10:8443 SSL enabled: https://10.10.10.10:8443	{supbase_eip_address} is the EIP bound to the Supabase application. Do not append a trailing slash (/).
   Redirect Allowlist	Specifies an allowlist of URLs to prevent malicious attacks and open redirect vulnerabilities. Enter a comma-separated list of URLs that are permitted redirect targets for the redirect_to parameter in browser URLs used for OAuth redirects, including third-party OAuth sign-ins, email verification links, and password reset links.	http://10.10.10.11:8080,http://10.10.10.12:8080	IP addresses and domain names are supported. You can configure up to 10 URLs. Wildcards are supported, for example, https://10.10.10.*:8443.

2. After you finish configuring the parameters, a configuration delivery task is triggered. Wait for the task to complete to ensure that the changes take effect in the Supabase service.

1. Follow the steps in Viewing the Full Auth Configuration to open the Auth configuration page.
   Figure 4 Auth configuration (IdP) for an RDS Supabase application
   

2. Turn on the switch on the Email card to open the email authentication configuration page.
   Figure 5 Auth configuration (email authentication) for an RDS Supabase application
   

   Configure the parameters as needed based on your business requirements. Carefully verify the SMTP settings and network connectivity.

   Table 3 Supabase email authentication settings

   Parameter	Description	Example Value	Precautions
   Enable External Email Login	Controls whether an external email provider is enabled as a third-party authentication IdP. When this parameter is enabled, users can sign in through the email provider and be redirected through SSO authentication without entering their Supabase password.	Enabled	An EIP must be bound.
   SMTP Host	The host address of the SMTP email server. Do not include the protocol or port number.	10.10.10.10 smtp.163.com	IP addresses must be IPv4. Domain names must be publicly resolvable.
   SMTP Port	The port used by the SMTP email server. Both non-SSL and SSL-encrypted ports are supported.	25	To prevent passwords and email content from being intercepted, an SSL-encrypted port is strongly recommended. Common ports include 465 and 587.
   SMTP Username	The authentication username for the SMTP email server. The operations administrator's email address is recommended.	zhangsan@huawei.com	-
   SMTP Password	The authentication password for the SMTP email server.	-	This is not the email account password. Use the authorization code generated in the SMTP settings.
   Admin Email	The administrator's email address.	zhangsan@huawei.com	Typically, this email address is identical to the SMTP username.
   Sender Name	The display name shown to email recipients.	zhangsan	-
   Email Auto Confirm	Specifies whether email confirmation is skipped during user registration. When this parameter is enabled, the system does not send a confirmation email, and users can complete registration without clicking a verification link.	Disabled	Exercise caution when enabling this setting in production environments. Disabling it is strongly recommended to ensure that registration email addresses are valid.
   Email Sending Rate Limit (seconds)	Limits how frequently the same user or IP address can trigger an SMTP email. The value specifies the minimum interval, in seconds, between email sending requests.	60	The default is 60 seconds. Set this value appropriately for your business requirements.

3. After you finish configuring the parameters, a configuration delivery task is triggered. Wait for the task to complete to ensure that the changes take effect in the Supabase service.

Ensure that Allow New User Registration is enabled in the user registration settings. Otherwise, the system rejects new registration requests, preventing new GitHub users from registering and signing in. After GitHub SSO registration and sign-in are successful, you can disable Allow New User Registration as needed to prevent other users from registering.

1. Sign in to the official GitHub website and choose Settings > Developer Settings to register a new OAuth App. The key settings are described below.

   Table 4 GitHub OAuth App registration settings

   Parameter	Description	Example Value	Precautions
   Application name	The name of the OAuth App.	Supabase Baas App	Recommend using the name of your website, software, or company.
   Homepage URL	The full URL of the OAuth App's official homepage.	http://10.10.10.30:8080	Use the full URL of the production homepage of your application or website.
   Authorization callback URL (legacy) Redirect URL (new)	The authorization callback URL. After GitHub successfully authenticates the user, it sends a temporary authorization code to this URL. The Supabase backend captures the request and completes user registration or sign-in in the background, then securely redirects the user to the frontend project URL. Format: http(s)://{supbase_eip_address}:8443/auth/v1/callback	SSL disabled: http://10.10.10.10:8443/auth/v1/callback	{supbase_eip_address} is the EIP bound to the Supabase application.

   After the creation, obtain the Client ID and Client Secret, and keep them secure to avoid security risks caused by disclosure.

2. Follow the steps in Viewing the Full Auth Configuration to open the Auth configuration page.
   Figure 6 Auth configuration (IdP) for an RDS Supabase application
   

3. Turn on the switch on the GitHub card to open the GitHub authentication configuration page.
   Figure 7 Auth configuration (GitHub authentication) for an RDS Supabase application
   

   Configure the parameters as needed based on your business requirements.

   Table 5 Supabase GitHub authentication settings

   Parameter	Description	Example Value	Precautions
   GitHub OAuth App Client ID	The unique identifier GitHub uses to identify the application initiating the sign-in request.	Ov45liywCeERZoCwLx0i	Enter the value obtained in step 1.
   GitHub OAuth App Client Secret	The application's secret credential. After the user grants authorization, the backend server sends the authorization code and Client Secret to GitHub to obtain an access token.	bb1946b54eccbcae0fd6d2745429************	Enter the value obtained in step 1.
   Callback URL	The URL to which the browser is redirected in the Supabase application after the user successfully authorizes GitHub.	http://10.10.10.10:8443/auth/v1/callback	It must exactly match the Authorization callback URL configured in the GitHub OAuth App. Use the Supabase application's external access URL followed by /auth/v1/callback.

4. After you finish configuring the parameters, a configuration delivery task is triggered. Wait for the task to complete to ensure that the changes take effect in the Supabase service.

RDS Supabase applications include built-in email templates in English, including email subjects and message bodies. By default, the email authentication process uses these templates to generate email content. If the built-in templates do not meet your business requirements, you can create custom email template files in HTML format, upload and host them using the Storage feature in the RDS Supabase Dashboard so that the email authentication process can retrieve and use them.

1. Prepare custom HTML email template files. Follow the guidelines below to create the required templates.

   Table 6 Guidelines for creating Supabase email templates

   Template Type	Description	Example
   Email confirmation template	Used to verify email addresses during registration. A verification email is sent after registration to activate the email address.	File name: oauth_email_confirm_template.html Content: <h2>Confirm Your Email via Huawei Cloud RDS Supabase</h2> <p>Follow this link to confirm your user with Email:</p> <p><a href="{{ .ConfirmationURL }}">Confirm your email address</a></p> <p>Alternatively, enter the code: {{ .Token }}</p> <p>Attention: The default validity period of the link and code is 1 hour.</p>
   User invitation template	Used by administrators to invite users to register by sending them an invitation link.	File name: oauth_email_invite_template.html Content: <h2>You have been invited via Huawei Cloud RDS Supabase</h2> <p>You have been invited to create a user on <a href="{{ .SiteURL }}">{{ .SiteURL }}</a>. Follow this link to accept the invite:</p> <p><a href="{{ .ConfirmationURL }}">Accept the invite</a></p> <p>Alternatively, enter the code: {{ .Token }}</p> <p>Attention: The default validity period of the link and code is 1 hour.</p>
   Password reset email template	Used to send emails when users need to reset or recover their passwords.	File name: oauth_email_recovery_template.html Content: <h2>Reset Your Password via Huawei Cloud RDS Supabase</h2> <p>Follow this link to reset the password for your user:</p> <p><a href="{{ .ConfirmationURL }}">Reset Password</a></p> <p>Alternatively, enter the code: {{ .Token }}</p> <p>Attention: The default validity period of the link and code is 1 hour.</p>
   Email change confirmation template	Used to send emails when users change their registered email addresses.	File name: oauth_email_change_template.html Content: <h2>Confirm Your Email Change via Huawei Cloud RDS Supabase</h2> <p>Follow this link to confirm the update of your email from {{ .Email }} to {{ .NewEmail }}:</p> <p><a href="{{ .ConfirmationURL }}">Change email address</a></p> <p>Alternatively, enter the code: {{ .Token }}</p> <p>Ate, enter the code: {{ .Token }}</p> <p>Attention: The default validity period of the link and code is 1 hour.</p>
   Magic link email template	Used to send emails for passwordless sign-in using a magic link (MAGIC_LINK).	File name: oauth_email_magic_link_template.html Content: <h2>Your Magic Link via Huawei Cloud RDS Supabase</h2> <p>Follow this link to direct login <a href="{{ .SiteURL }}">{{ .SiteURL }}</a></p> <p><a href="{{ .ConfirmationURL }}">Log In</a></p> <p>Attention: The default validity period of the link and code is 1 hour.</p>
   Reauthentication email template	Used to send emails for reauthentication.	File name: oauth_email_reauthentication_template.html Content: <h2>Confirm Your Reauthentication via Huawei Cloud RDS Supabase</h2> <p>Enter the code: {{ .Token }}</p> <p>Attention: The default validity period of the link and code is 1 hour.</p>

   Notes:

   • Template files must be in HTML format and must not exceed 1 MB. File names can contain only English letters, digits, and underscores. Chinese characters and special characters are not supported. Use valid file names and ensure that the template content is complete. Otherwise, the email functionality may become unavailable.
   • Use {{ .ConfirmationURL }} as the confirmation link placeholder and {{ .Token }} as the verification code placeholder. RDS Supabase automatically replaces these placeholders with actual values when sending emails. For more configuration details (including supported placeholders) and usage instructions, see the official Supabase documentation.
   • The templates listed above are optional. Create custom templates only if the built-in templates do not meet your requirements.

2. Follow the instructions in Enabling or Disabling Storage Configuration to enable Storage for Supabase. Create a bucket to store email templates.

   In the navigation pane of the Supabase Dashboard, choose Storage and then click New bucket on the page to create a bucket.

   Figure 8 Storage page in the RDS Supabase Dashboard
   

   In the displayed dialog box, configure the bucket settings and click Create.

   • Bucket name: Enter a bucket name. Avoid Chinese characters and special characters to prevent issues caused by character encoding during subsequent operations. Example: oauth-email-bucket.
   • Public bucket: Enable this option to allow direct access over the public network without requiring additional permissions.
   Figure 9 Creating a bucket in the RDS Supabase Dashboard
   

3. Upload the email templates to the Storage bucket.

   Under the Storage > Buckets page, locate the bucket created in step 2 and click its name to open the file management view. Click Upload files in the upper-right corner to upload the template files.

   Figure 10 Uploading template files to a bucket in the RDS Supabase Dashboard
   

4. Follow the steps in Viewing the Full Auth Configuration to open the Auth configuration page.
   Figure 11 Auth configuration (email template settings) for an RDS Supabase application
   

5. Modify the relevant email templates as needed. Locate the configuration row for the required email type and click Modify to configure the parameters.

   Table 7 Supabase email template settings

   Parameter	Description	Notes
   Email Subject	Specifies the custom email subject. Chinese characters, English letters, and digits are supported. The subject must not exceed 256 characters.	Optional. If it is left blank, the built-in subject is used.
   Template URL	Specifies the URL of the email body template. If the template is hosted in Supabase Storage, use one of the following formats: SSL enabled: https://{Supabase_application_access_address}/storage/v1/object/public/{Storage_bucket_name}/{email_template_file_name} Example: https://192.168.166.124:8443/storage/v1/object/public/oauth-email-bucket/oauth_email_confirm_template.html SSL disabled: http://{Supabase_application_access_address/storage/v1/object/public/{Storage_bucket_name}/{email_template_file_name} Example: http://192.168.166.124:8443/storage/v1/object/public/oauth-email-bucket/oauth_email_confirm_template.html	Optional. If it is left blank, the built-in template is used. The parameters are described as follows: {Supabase_application_access_address}: Use one of the following addresses: Internal IP address of the Supabase application:Application port number EIP bound to the Supabase application:Application port number {Storage_bucket_name}: the name of the bucket created in 2. {Email_template_file_name}: the name (including the file name extension) of the template file uploaded in 3.

6. After you finish configuring the parameters, a configuration delivery task is triggered. Wait for the task to complete to ensure that the changes take effect in the Supabase service.