# Build Next.js Authentication with Supabase

Authentication across browser, server, middleware, and callback contexts is easy to configure incorrectly. This skill provides focused Supabase Auth patterns for Next.js App Router.

## Install

```bash
npx skillstore add sickn33/nextjs-supabase-auth
```

## Metadata

- Status: approved
- Slug: sickn33-nextjs-supabase-auth
- Skillstore revision: r2
- Version status: missing
- Tree hash: 438ab93f4625be61c869ace76696e5907b795893f3b8bb48ebfd9f8618a7c8b8
- Author: sickn33
- GitHub username: sickn33
- License: MIT
- Repository: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/nextjs-supabase-auth
- Ref: 81e05e636292629114b76cbb3922fbe57672fc02
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, env\_access
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/sickn33-nextjs-supabase-auth
- Manifest: https://skillstore.pages.dev/api/skills/sickn33-nextjs-supabase-auth/manifest

## Capabilities

- Configures separate Supabase clients for browser and server contexts.
- Creates middleware that refreshes sessions and protects selected routes.
- Implements OAuth callback handling and exchanges authorization codes for sessions.
- Builds sign-in and sign-out server actions with error handling and cache revalidation.
- Reviews authentication code for insecure session checks and incorrect client usage.

## Use Cases

- Add Authentication to a New Application: Create browser and server clients, login actions, callback handling, and protected routes for a new App Router project.
- Review an Existing Auth Integration: Identify insecure session checks, missing middleware, incorrect clients, weak redirect handling, and absent error handling.
- Standardize Team Auth Patterns: Define consistent Supabase Auth conventions for server components, server actions, middleware, and OAuth callbacks.

## Prompt Templates

### Create the Supabase Clients

```
Set up Supabase browser and server clients for my Next.js App Router project. Explain the required public environment variables and cookie handling.
```

### Protect Application Routes

```
Add Supabase authentication middleware to protect these routes: [ROUTES]. Refresh sessions and redirect unauthenticated users to [LOGIN_PATH].
```

### Implement an OAuth Flow

```
Implement Supabase OAuth for [PROVIDER] in Next.js. Include a callback route, validated local redirects, error handling, and production URL considerations.
```

### Audit a Production Integration

```
Audit my Next.js Supabase Auth implementation. Check client boundaries, verified user retrieval, middleware coverage, redirect validation, cookie updates, errors, and cache revalidation.
```

## Limitations

- It does not configure Supabase projects, OAuth provider consoles, or production secrets.
- It does not design database schemas or row-level security policies.
- Generated patterns require testing against the installed Next.js and Supabase package versions.
- The provided callback redirect pattern requires local-path validation before production use.

## Best Practices

- Use getUser for security decisions because it verifies the authentication token.
- Keep browser and server Supabase clients separate and update cookies through supported server interfaces.
- Validate callback destinations as local paths before redirecting authenticated users.

## Anti Patterns

- Do not trust getSession alone for server-side authorization checks.
- Do not expose Supabase service-role keys through public environment variables.
- Do not concatenate untrusted query values into authentication redirects.

## Security Audit

- Audited at: 2026-08-04T15:59:47.786\+00:00
- Summary: The command-execution alerts are false positives caused by JavaScript template literals, Markdown fences, and inline Markdown. Public Supabase environment variables are expected, but the OAuth callback contains a high-severity open redirect through its unvalidated next parameter.

## Stats

- Views: 120
- Downloads: 13
- Favorites: 0
- Popularity score: 0