Configuration

The way you want your users to authenticate can be driven via configuration.

If you open the web auth configuration at apps/web/config/auth.config.ts, you'll find the providers object:

import type { Provider } from '@supabase/gotrue-js/src/lib/types';

providers: {
  password: process.env.NEXT_PUBLIC_AUTH_PASSWORD === 'true',
  magicLink: process.env.NEXT_PUBLIC_AUTH_MAGIC_LINK === 'true',
  otp: process.env.NEXT_PUBLIC_AUTH_OTP === 'true',
  oAuth: ['google'] as Provider[],
}

As you can see, the providers object can be configured to display only the auth methods LifeJet wants to use.

Google OAuth is intentionally filtered out of the sign-in and sign-up UI until the production flow is complete. The provider can remain configured while the button is hidden from users.

1. For example, by setting both magicLink and otp to true, the authentication pages can display passwordless authentication forms.
2. Instead, by setting password to false, we will remove the email/password form from the authentication and user profile pages.

Requiring Email Verification

This setting needs to match what you have set up in Supabase. If you require email confirmation before your users can sign in, you will have to flip the following flag in your configuration:

auth: {
  requireEmailConfirmation: false,
}

When the flag is set to true, the user will not be redirected to the onboarding flow, but will instead see a successful alert asking them to confirm their email. After confirmation, they will be able to sign in.

When the flag is set to false, the application will redirect them directly to the onboarding flow.

Emails sent by Supabase

Supabase spins up an InBucket instance where all the emails are sent: this is where you can find emails related to password reset, sign-in links, and email verifications.

To access the InBucket instance, you can go to the following URL: http://localhost:54324/. Save this URL, you will use it very often.