Update a supabase project's auth (gotrue) service configuration. supports over 200 optional settings covering signup restrictions, jwt/session lifetime, smtp and email templates, sms/phone otp providers, external oauth providers (apple, azure, google, github, etc.), mfa (totp/webauthn/phone), passkeys, rate limits, captcha, auth hooks, and the project's built-in oauth server. only the fields you provide are changed; omitted fields keep their current value. requires the project ref. returns the updated auth config object.
Parameters
The 20-character project reference ID (lowercase letters only). Found in the project's Supabase dashboard URL or Settings > General.
Maximum duration, in seconds, Auth allows for a single API request before timing out.
Whether custom (non-catalog) OAuth provider configurations are enabled for this project.
Maximum size of the database connection pool used by the Auth service.
Unit for db_max_pool_size: a fixed number of connections, or a percentage of the project's total available connections.
Whether to disable new user signups. When true, only existing users can sign in; new signups are rejected.
external_anonymous_users_enabled
Whether anonymous sign-ins are enabled for the project.
external_apple_additional_client_ids
Comma-separated list of additional OAuth client IDs accepted for Sign in with Apple (e.g. for multiple native apps).
OAuth client ID registered with Apple, used for Sign in with Apple.
external_apple_email_optional
When true, a verified email address is not required to complete Sign in with Apple.
Whether Sign in with Apple is enabled for this project.
OAuth client secret registered with Apple, used for Sign in with Apple. Treated as a secret.
OAuth client ID registered with Azure, used for Sign in with Azure.
external_azure_email_optional
When true, a verified email address is not required to complete Sign in with Azure.
Whether Sign in with Azure is enabled for this project.
OAuth client secret registered with Azure, used for Sign in with Azure. Treated as a secret.
Base URL of the self-hosted/on-prem Azure instance to authenticate against.
external_bitbucket_client_id
OAuth client ID registered with Bitbucket, used for Sign in with Bitbucket.
external_bitbucket_email_optional
When true, a verified email address is not required to complete Sign in with Bitbucket.
external_bitbucket_enabled
Whether Sign in with Bitbucket is enabled for this project.
external_bitbucket_secret
OAuth client secret registered with Bitbucket, used for Sign in with Bitbucket. Treated as a secret.
external_discord_client_id
OAuth client ID registered with Discord, used for Sign in with Discord.
external_discord_email_optional
When true, a verified email address is not required to complete Sign in with Discord.
Whether Sign in with Discord is enabled for this project.
OAuth client secret registered with Discord, used for Sign in with Discord. Treated as a secret.
Whether email-based sign-up and sign-in (password or OTP) is enabled.
external_facebook_client_id
OAuth client ID registered with Facebook, used for Sign in with Facebook.
external_facebook_email_optional
When true, a verified email address is not required to complete Sign in with Facebook.
external_facebook_enabled
Whether Sign in with Facebook is enabled for this project.
OAuth client secret registered with Facebook, used for Sign in with Facebook. Treated as a secret.
OAuth client ID registered with Figma, used for Sign in with Figma.
external_figma_email_optional
When true, a verified email address is not required to complete Sign in with Figma.
Whether Sign in with Figma is enabled for this project.
OAuth client secret registered with Figma, used for Sign in with Figma. Treated as a secret.
external_github_client_id
OAuth client ID registered with Github, used for Sign in with Github.
external_github_email_optional
When true, a verified email address is not required to complete Sign in with Github.
Whether Sign in with Github is enabled for this project.
OAuth client secret registered with Github, used for Sign in with Github. Treated as a secret.
external_gitlab_client_id
OAuth client ID registered with Gitlab, used for Sign in with Gitlab.
external_gitlab_email_optional
When true, a verified email address is not required to complete Sign in with Gitlab.
Whether Sign in with Gitlab is enabled for this project.
OAuth client secret registered with Gitlab, used for Sign in with Gitlab. Treated as a secret.
Base URL of the self-hosted/on-prem Gitlab instance to authenticate against.
external_google_additional_client_ids
Comma-separated list of additional OAuth client IDs accepted for Sign in with Google (e.g. for multiple native apps).
external_google_client_id
OAuth client ID registered with Google, used for Sign in with Google.
external_google_email_optional
When true, a verified email address is not required to complete Sign in with Google.
Whether Sign in with Google is enabled for this project.
OAuth client secret registered with Google, used for Sign in with Google. Treated as a secret.
external_google_skip_nonce_check
When true, skips validating the OIDC nonce claim for Sign in with Google. Only disable this if you understand the replay-attack risk.
OAuth client ID registered with Kakao, used for Sign in with Kakao.
external_kakao_email_optional
When true, a verified email address is not required to complete Sign in with Kakao.
Whether Sign in with Kakao is enabled for this project.
OAuth client secret registered with Kakao, used for Sign in with Kakao. Treated as a secret.
external_keycloak_client_id
OAuth client ID registered with Keycloak, used for Sign in with Keycloak.
external_keycloak_email_optional
When true, a verified email address is not required to complete Sign in with Keycloak.
external_keycloak_enabled
Whether Sign in with Keycloak is enabled for this project.
OAuth client secret registered with Keycloak, used for Sign in with Keycloak. Treated as a secret.
Base URL of the self-hosted/on-prem Keycloak instance to authenticate against.
external_linkedin_oidc_client_id
OAuth client ID registered with LinkedIn (OIDC), used for Sign in with LinkedIn (OIDC).
external_linkedin_oidc_email_optional
When true, a verified email address is not required to complete Sign in with LinkedIn (OIDC).
external_linkedin_oidc_enabled
Whether Sign in with LinkedIn (OIDC) is enabled for this project.
external_linkedin_oidc_secret
OAuth client secret registered with LinkedIn (OIDC), used for Sign in with LinkedIn (OIDC). Treated as a secret.
external_notion_client_id
OAuth client ID registered with Notion, used for Sign in with Notion.
external_notion_email_optional
When true, a verified email address is not required to complete Sign in with Notion.
Whether Sign in with Notion is enabled for this project.
OAuth client secret registered with Notion, used for Sign in with Notion. Treated as a secret.
Whether phone-based sign-up and sign-in (SMS OTP) is enabled.
OAuth client ID registered with Slack, used for Sign in with Slack.
external_slack_email_optional
When true, a verified email address is not required to complete Sign in with Slack.
Whether Sign in with Slack is enabled for this project.
external_slack_oidc_client_id
OAuth client ID registered with Slack (OIDC), used for Sign in with Slack (OIDC).
external_slack_oidc_email_optional
When true, a verified email address is not required to complete Sign in with Slack (OIDC).
external_slack_oidc_enabled
Whether Sign in with Slack (OIDC) is enabled for this project.
external_slack_oidc_secret
OAuth client secret registered with Slack (OIDC), used for Sign in with Slack (OIDC). Treated as a secret.
OAuth client secret registered with Slack, used for Sign in with Slack. Treated as a secret.
external_spotify_client_id
OAuth client ID registered with Spotify, used for Sign in with Spotify.
external_spotify_email_optional
When true, a verified email address is not required to complete Sign in with Spotify.
Whether Sign in with Spotify is enabled for this project.
OAuth client secret registered with Spotify, used for Sign in with Spotify. Treated as a secret.
external_twitch_client_id
OAuth client ID registered with Twitch, used for Sign in with Twitch.
external_twitch_email_optional
When true, a verified email address is not required to complete Sign in with Twitch.
Whether Sign in with Twitch is enabled for this project.
OAuth client secret registered with Twitch, used for Sign in with Twitch. Treated as a secret.
external_twitter_client_id
OAuth client ID registered with Twitter, used for Sign in with Twitter.
external_twitter_email_optional
When true, a verified email address is not required to complete Sign in with Twitter.
Whether Sign in with Twitter is enabled for this project.
OAuth client secret registered with Twitter, used for Sign in with Twitter. Treated as a secret.
external_web3_ethereum_enabled
Whether Sign-in with Ethereum (Web3 wallet) is enabled.
external_web3_solana_enabled
Whether Sign-in with Solana (Web3 wallet) is enabled.
external_workos_client_id
OAuth client ID registered with Workos, used for Sign in with Workos.
Whether Sign in with Workos is enabled for this project.
OAuth client secret registered with Workos, used for Sign in with Workos. Treated as a secret.
Base URL of the self-hosted/on-prem Workos instance to authenticate against.
OAuth client ID registered with X (Twitter), used for Sign in with X (Twitter).
external_x_email_optional
When true, a verified email address is not required to complete Sign in with X (Twitter).
Whether Sign in with X (Twitter) is enabled for this project.
OAuth client secret registered with X (Twitter), used for Sign in with X (Twitter). Treated as a secret.
OAuth client ID registered with Zoom, used for Sign in with Zoom.
external_zoom_email_optional
When true, a verified email address is not required to complete Sign in with Zoom.
Whether Sign in with Zoom is enabled for this project.
OAuth client secret registered with Zoom, used for Sign in with Zoom. Treated as a secret.
hook_after_user_created_enabled
Whether the 'after user created' Auth hook is enabled. When enabled, Auth calls the configured URI at the relevant point in the auth flow.
hook_after_user_created_secrets
Comma-separated list of base64/HMAC signing secrets used to verify requests to the 'after user created' hook came from Supabase Auth.
hook_after_user_created_uri
URI Auth calls for the 'after user created' hook. Supports 'https://', 'http://' (local dev), or 'pg-functions://' for a Postgres function.
hook_before_user_created_enabled
Whether the 'before user created' Auth hook is enabled. When enabled, Auth calls the configured URI at the relevant point in the auth flow.
hook_before_user_created_secrets
Comma-separated list of base64/HMAC signing secrets used to verify requests to the 'before user created' hook came from Supabase Auth.
hook_before_user_created_uri
URI Auth calls for the 'before user created' hook. Supports 'https://', 'http://' (local dev), or 'pg-functions://' for a Postgres function.
hook_custom_access_token_enabled
Whether the 'custom access token' Auth hook is enabled. When enabled, Auth calls the configured URI at the relevant point in the auth flow.
hook_custom_access_token_secrets
Comma-separated list of base64/HMAC signing secrets used to verify requests to the 'custom access token' hook came from Supabase Auth.
hook_custom_access_token_uri
URI Auth calls for the 'custom access token' hook. Supports 'https://', 'http://' (local dev), or 'pg-functions://' for a Postgres function.
hook_mfa_verification_attempt_enabled
Whether the 'mfa verification attempt' Auth hook is enabled. When enabled, Auth calls the configured URI at the relevant point in the auth flow.
hook_mfa_verification_attempt_secrets
Comma-separated list of base64/HMAC signing secrets used to verify requests to the 'mfa verification attempt' hook came from Supabase Auth.
hook_mfa_verification_attempt_uri
URI Auth calls for the 'mfa verification attempt' hook. Supports 'https://', 'http://' (local dev), or 'pg-functions://' for a Postgres function.
hook_password_verification_attempt_enabled
Whether the 'password verification attempt' Auth hook is enabled. When enabled, Auth calls the configured URI at the relevant point in the auth flow.
hook_password_verification_attempt_secrets
Comma-separated list of base64/HMAC signing secrets used to verify requests to the 'password verification attempt' hook came from Supabase Auth.
hook_password_verification_attempt_uri
URI Auth calls for the 'password verification attempt' hook. Supports 'https://', 'http://' (local dev), or 'pg-functions://' for a Postgres function.
Whether the 'send email' Auth hook is enabled. When enabled, Auth calls the configured URI at the relevant point in the auth flow.
Comma-separated list of base64/HMAC signing secrets used to verify requests to the 'send email' hook came from Supabase Auth.
URI Auth calls for the 'send email' hook. Supports 'https://', 'http://' (local dev), or 'pg-functions://' for a Postgres function.
Whether the 'send sms' Auth hook is enabled. When enabled, Auth calls the configured URI at the relevant point in the auth flow.
Comma-separated list of base64/HMAC signing secrets used to verify requests to the 'send sms' hook came from Supabase Auth.
URI Auth calls for the 'send sms' hook. Supports 'https://', 'http://' (local dev), or 'pg-functions://' for a Postgres function.
Expiry time (in seconds) for access tokens (JWTs) issued by Auth. Between 0 and 604800 (7 days).
mailer_allow_unverified_email_sign_ins
Whether users with an unverified email address are allowed to sign in.
When true, new users are automatically confirmed without needing to click a confirmation email link.
mailer_notifications_email_changed_enabled
Whether to send a notification email to the user when their email changed occurs.
mailer_notifications_identity_linked_enabled
Whether to send a notification email to the user when their identity linked occurs.
mailer_notifications_identity_unlinked_enabled
Whether to send a notification email to the user when their identity unlinked occurs.
mailer_notifications_mfa_factor_enrolled_enabled
Whether to send a notification email to the user when their mfa factor enrolled occurs.
mailer_notifications_mfa_factor_unenrolled_enabled
Whether to send a notification email to the user when their mfa factor unenrolled occurs.
mailer_notifications_password_changed_enabled
Whether to send a notification email to the user when their password changed occurs.
mailer_notifications_phone_changed_enabled
Whether to send a notification email to the user when their phone changed occurs.
Expiry time (in seconds) for email OTP / magic link tokens.
Number of digits in generated email OTP codes. Between 6 and 10.
mailer_secure_email_change_enabled
When true, changing a user's email address requires confirmation from both the old and the new email address.
mailer_subjects_confirmation
Subject line used for the 'confirmation' auth email template.
mailer_subjects_email_change
Subject line used for the 'email change' auth email template.
mailer_subjects_email_changed_notification
Subject line used for the 'email changed notification' auth email template.
mailer_subjects_identity_linked_notification
Subject line used for the 'identity linked notification' auth email template.
mailer_subjects_identity_unlinked_notification
Subject line used for the 'identity unlinked notification' auth email template.
Subject line used for the 'invite' auth email template.
mailer_subjects_magic_link
Subject line used for the 'magic link' auth email template.
mailer_subjects_mfa_factor_enrolled_notification
Subject line used for the 'mfa factor enrolled notification' auth email template.
mailer_subjects_mfa_factor_unenrolled_notification
Subject line used for the 'mfa factor unenrolled notification' auth email template.
mailer_subjects_password_changed_notification
Subject line used for the 'password changed notification' auth email template.
mailer_subjects_phone_changed_notification
Subject line used for the 'phone changed notification' auth email template.
mailer_subjects_reauthentication
Subject line used for the 'reauthentication' auth email template.
Subject line used for the 'recovery' auth email template.
mailer_templates_confirmation_content
Custom HTML body template for the 'confirmation' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).
mailer_templates_email_change_content
Custom HTML body template for the 'email change' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).
mailer_templates_email_changed_notification_content
Custom HTML body template for the 'email changed notification' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).
mailer_templates_identity_linked_notification_content
Custom HTML body template for the 'identity linked notification' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).
mailer_templates_identity_unlinked_notification_content
Custom HTML body template for the 'identity unlinked notification' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).
mailer_templates_invite_content
Custom HTML body template for the 'invite' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).
mailer_templates_magic_link_content
Custom HTML body template for the 'magic link' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).
mailer_templates_mfa_factor_enrolled_notification_content
Custom HTML body template for the 'mfa factor enrolled notification' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).
mailer_templates_mfa_factor_unenrolled_notification_content
Custom HTML body template for the 'mfa factor unenrolled notification' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).
mailer_templates_password_changed_notification_content
Custom HTML body template for the 'password changed notification' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).
mailer_templates_phone_changed_notification_content
Custom HTML body template for the 'phone changed notification' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).
mailer_templates_reauthentication_content
Custom HTML body template for the 'reauthentication' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).
mailer_templates_recovery_content
Custom HTML body template for the 'recovery' auth email. Supports GoTrue template variables (e.g. {{ .ConfirmationURL }}).
Maximum number of MFA factors a single user may enroll.
Whether users are allowed to enroll a phone-number (SMS OTP) MFA factor.
Minimum number of seconds between MFA SMS challenge messages sent to the same phone number (0-32767).
Number of digits in generated MFA phone OTP codes (0-32767).
Custom SMS message template used when sending an MFA phone OTP challenge. Supports the {{ .Code }} variable.
Whether phone-number (SMS OTP) MFA verification is enabled at sign-in.
Whether users are allowed to enroll a new TOTP (authenticator app) MFA factor.
Whether TOTP (authenticator app) MFA verification is enabled at sign-in.
mfa_web_authn_enroll_enabled
Whether users are allowed to enroll a new WebAuthn (hardware key / platform authenticator) MFA factor.
mfa_web_authn_verify_enabled
Whether WebAuthn MFA verification is enabled at sign-in.
Client ID for Supabase's internal Nimbus OAuth integration (advanced/internal use).
nimbus_oauth_client_secret
Client secret for Supabase's internal Nimbus OAuth integration (advanced/internal use). Treated as a secret.
oauth_server_allow_dynamic_registration
Whether third-party OAuth clients may register themselves dynamically (RFC 7591 Dynamic Client Registration) against this project's OAuth server.
oauth_server_authorization_path
Custom path used for the OAuth authorization endpoint when this project acts as an OAuth server.
Whether this project can act as an OAuth 2.1 authorization server, issuing tokens to third-party client apps.
Whether passkey (WebAuthn passwordless) sign-in is enabled for this project.
When true, passwords are checked against the Have I Been Pwned breached-password database and rejected if found.
Minimum required password length. Between 6 and 32767 characters.
password_required_characters
Character sets that must each appear at least once in a password, expressed as a colon-separated list of character classes (e.g. lowercase:uppercase:digits). Empty string means no requirement.
rate_limit_anonymous_users
Rate limit on anonymous sign-ins, expressed as a per-hour or per-interval integer cap enforced by Auth.
Rate limit on emails sent, expressed as a per-hour or per-interval integer cap enforced by Auth.
Rate limit on OTP requests, expressed as a per-hour or per-interval integer cap enforced by Auth.
Rate limit on SMS messages sent, expressed as a per-hour or per-interval integer cap enforced by Auth.
Rate limit on token refresh requests, expressed as a per-hour or per-interval integer cap enforced by Auth.
Rate limit on OTP/token verification attempts, expressed as a per-hour or per-interval integer cap enforced by Auth.
Rate limit on Web3 (wallet) sign-in attempts, expressed as a per-hour or per-interval integer cap enforced by Auth.
refresh_token_rotation_enabled
Auth config field 'refresh_token_rotation_enabled' (refresh token rotation enabled).
Whether this project can act as a SAML 2.0 Service Provider for SSO sign-in.
The external base URL used in this project's SAML Service Provider metadata (issuer / ACS URL).
Whether CAPTCHA verification is required on sign-up, sign-in, and password recovery.
security_captcha_provider
The CAPTCHA provider to use when CAPTCHA is enabled.
Secret key for the configured CAPTCHA provider, used to verify CAPTCHA tokens server-side.
security_manual_linking_enabled
Whether users may manually link additional identities/providers to their existing account.
security_refresh_token_reuse_interval
Grace period, in seconds, during which a previously used (rotated) refresh token is still accepted, to tolerate network retries.
security_sb_forwarded_for_enabled
Whether to trust the 'X-Forwarded-For' header to determine client IP addresses (for rate limiting and logs) when behind a trusted proxy.
security_update_password_require_reauthentication
Whether users must reauthenticate (re-enter credentials) before changing their password.
sessions_inactivity_timeout
Number of seconds of inactivity after which a session is revoked. 0 disables the timeout.
When true, signing in on a new device/browser revokes the user's other active sessions.
Comma-separated list of tags used to group and manage sessions (e.g. by client type).
Maximum lifetime of a session in seconds, after which the user must sign in again, regardless of activity. 0 disables the limit.
The base URL of the site, used as an allowed redirect URL for authentication flows (e.g. password recovery, email confirmation links).
When true, new users signing up with a phone number are automatically confirmed without an SMS OTP challenge.
Minimum number of seconds between SMS messages sent to the same phone number, for rate limiting (0-32767).
sms_messagebird_access_key
MessageBird API access key, required when sms_provider is 'messagebird'.
sms_messagebird_originator
MessageBird originator (sender ID or phone number) shown to recipients, required when sms_provider is 'messagebird'.
Expiry time (in seconds) for SMS OTP codes.
Number of digits in generated SMS OTP codes (0-32767).
The SMS delivery provider used to send phone OTP messages.
Custom SMS message template used for sign-up/sign-in phone OTP challenges. Supports the {{ .Code }} variable.
Comma-separated list of phone-number=otp pairs used for test/demo sign-ins without sending real SMS (e.g. '+15555550100=123456').
ISO 8601 timestamp after which the configured sms_test_otp values stop working.
Textlocal API key, required when sms_provider is 'textlocal'.
Textlocal sender ID shown to recipients, required when sms_provider is 'textlocal'.
Twilio Account SID, required when sms_provider is 'twilio'.
Twilio Auth Token, required when sms_provider is 'twilio'.
Twilio Content SID for the WhatsApp/Messaging template used to send OTP codes via Twilio, when applicable.
sms_twilio_message_service_sid
Twilio Messaging Service SID used to send OTP messages, required when sms_provider is 'twilio' and a Messaging Service is used instead of a single from-number.
sms_twilio_verify_account_sid
Twilio Account SID used with Twilio Verify, required when sms_provider is 'twilio_verify'.
sms_twilio_verify_auth_token
Twilio Auth Token used with Twilio Verify, required when sms_provider is 'twilio_verify'.
sms_twilio_verify_message_service_sid
Twilio Verify Messaging Service SID, required when sms_provider is 'twilio_verify' and a Messaging Service is used.
Vonage API key, required when sms_provider is 'vonage'.
Vonage API secret, required when sms_provider is 'vonage'.
Vonage sender ID or phone number shown to recipients, required when sms_provider is 'vonage'.
The 'from' email address used when Auth sends emails via the configured SMTP server.
Hostname of the custom SMTP server used to send auth emails instead of Supabase's default mailer.
Minimum number of seconds between emails sent to the same address, used for rate limiting (0-32767).
Password or API key used to authenticate with the custom SMTP server. Treated as a secret.
Port number of the custom SMTP server (as a string), e.g. '587' or '465'.
Display name shown as the sender on outgoing auth emails.
Username used to authenticate with the custom SMTP server.
Comma-separated list of additional redirect URLs allowed after auth actions (sign-in, sign-up, password reset). Supports wildcards.
Human-readable Relying Party name shown to users during passkey/WebAuthn registration prompts.
WebAuthn Relying Party ID: typically your application's domain (without scheme or path).
Comma-separated list of allowed WebAuthn origins (full URLs, including scheme) that may perform passkey registration/authentication.