Important: This documentation covers Yarn 1 (Classic).
For Yarn 2+ docs and migration guide, see yarnpkg.com.

Package detail

@supabase/auth-js

supabase26.3mMIT2.87.1TypeScript support: included

Official SDK for Supabase Auth

auth, supabase, auth, authentication

readme


<picture> <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/supabase/supabase/master/packages/common/assets/images/supabase-logo-wordmark--dark.svg"> <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/supabase/supabase/master/packages/common/assets/images/supabase-logo-wordmark--light.svg"> Supabase Logo </picture>

Supabase Auth JS SDK

An isomorphic JavaScript SDK for the Supabase Auth API.

Guides · Reference Docs · TypeDoc

Build Package License: MIT pkg.pr.new

Requirements

  • Node.js 20 or later (Node.js 18 support dropped as of October 31, 2025)
  • For browser support, all modern browsers are supported

⚠️ Node.js 18 Deprecation Notice

Node.js 18 reached end-of-life on April 30, 2025. As announced in our deprecation notice, support for Node.js 18 was dropped on October 31, 2025.

Quick start

Install

npm install --save @supabase/auth-js

Usage

import { AuthClient } from '@supabase/auth-js'

const GOTRUE_URL = 'http://localhost:9999'

const auth = new AuthClient({ url: GOTRUE_URL })

Custom fetch implementation

auth-js uses the cross-fetch library to make HTTP requests, but an alternative fetch implementation can be provided as an option. This is most useful in environments where cross-fetch is not compatible, for instance Cloudflare Workers:

import { AuthClient } from '@supabase/auth-js'

const AUTH_URL = 'http://localhost:9999'

const auth = new AuthClient({ url: AUTH_URL, fetch: fetch })

Development

This package is part of the Supabase JavaScript monorepo. To work on this package:

Building

# Complete build (from monorepo root)
npx nx build auth-js

# Build with watch mode for development
npx nx build auth-js --watch

# Individual build targets
npx nx build:main auth-js    # CommonJS build (dist/main/)
npx nx build:module auth-js  # ES Modules build (dist/module/)

# Other useful commands
npx nx lint auth-js          # Run ESLint
npx nx typecheck auth-js     # TypeScript type checking
npx nx docs auth-js          # Generate documentation

Build Outputs

  • CommonJS (dist/main/) - For Node.js environments
  • ES Modules (dist/module/) - For modern bundlers (Webpack, Vite, Rollup)
  • TypeScript definitions (dist/module/index.d.ts) - Type definitions for TypeScript projects

Testing

Docker Required! The auth-js tests require a local Supabase Auth server (GoTrue) running in Docker.

# Run complete test suite (from monorepo root)
npx nx test:auth auth-js

This command automatically:

  1. Stops any existing test containers
  2. Starts a Supabase Auth server (GoTrue) and PostgreSQL database in Docker
  3. Waits for services to be ready (30 seconds)
  4. Runs the test suite
  5. Cleans up Docker containers after tests complete

Individual Test Commands

# Run just the test suite (requires infrastructure to be running)
npx nx test:suite auth-js

# Manually manage test infrastructure
npx nx test:infra auth-js   # Start Docker containers
npx nx test:clean auth-js   # Stop and remove containers

Development Testing

For actively developing and debugging tests:

# Start infrastructure once
npx nx test:infra auth-js

# Run tests multiple times (faster since containers stay up)
npx nx test:suite auth-js

# Clean up when done
npx nx test:clean auth-js

Test Infrastructure

The Docker setup includes:

  • Supabase Auth (GoTrue) - The authentication server
  • PostgreSQL - Database for auth data
  • Pre-configured with test users and settings

Prerequisites

  • Docker must be installed and running
  • Ports used by test infrastructure (check infra/docker-compose.yml)
  • No full Supabase instance needed - just the Auth server

Contributing

We welcome contributions! Please see our Contributing Guide for details on how to get started.

For major changes or if you're unsure about something, please open an issue first to discuss your proposed changes.

changelog

2.87.0 (2025-12-08)

🚀 Features

  • storage: align analytics from method with { data, error } pattern (#1927)

🩹 Fixes

  • repo: update lock file after dependabot to use npm 11 (#1926)

❤️ Thank You

  • Katerina Skroumpelou @mandarini

2.86.2 (2025-12-04)

🩹 Fixes

  • storage: correct QueryVectorsResponse to use vectors instead of matches (#1922)

❤️ Thank You

  • Katerina Skroumpelou @mandarini

2.86.1 (2025-12-04)

🩹 Fixes

  • auth: suppress getsession warning when getuser is called first (#1898)
  • auth: code verifier remains in storage during edge cases (#1759)
  • postgrest: cross-schema rpc setof type inference (#1900)
  • repo: update lock file (#1910)
  • repo: lock file issues (#1919)
  • repo: update npm and install again (#1920)
  • supabase: add esm wrapper to resolve module not found error in nuxt (#1914)

❤️ Thank You

  • Katerina Skroumpelou @mandarini
  • Vaibhav @7ttp

2.86.0 (2025-11-26)

🚀 Features

  • storage: install iceberg-js and add from method (#1881)

❤️ Thank You

  • Katerina Skroumpelou @mandarini

2.85.0 (2025-11-26)

🚀 Features

  • realtime: add metadata to realtime user broadcast push (#1894)

🩹 Fixes

  • auth: oauth minor fixes on types (#1891)

❤️ Thank You

  • Cemal Kılıç @cemalkilic
  • Eduardo Gurgel

2.84.0 (2025-11-20)

🚀 Features

  • postgrest: add isdistinct and regex pattern matching operators (#1875)

🩹 Fixes

  • postgrest: validate empty or invalid relation names in Postgrest… (#1863)
  • realtime: simplify serializer by removing unnecessary types of messages (#1871)

❤️ Thank You

  • Eduardo Gurgel
  • Katerina Skroumpelou @mandarini
  • Soufiane Radouane @sofmega

2.83.0 (2025-11-18)

🚀 Features

  • storage: rename StorageAnalyticsApi to StorageAnalyticsClient (#1869)

❤️ Thank You

  • Katerina Skroumpelou @mandarini

2.82.0 (2025-11-18)

🚀 Features

  • auth: add OAuth grant listing and revocation endpoints (#1833)

🩹 Fixes

  • postgrest: bubble up fetch error causes and codes (#1856)
  • realtime: account for null refs when encoding messages (#1862)
  • storage: analytics bucket prop (#1852)

❤️ Thank You

  • Cemal Kılıç @cemalkilic
  • Eduardo Gurgel
  • Fabrizio @fenos
  • Katerina Skroumpelou @mandarini

2.81.1 (2025-11-11)

🩹 Fixes

  • auth: use Symbols for callback IDs to resolve Next.js 16 compatibility (#1847)
  • auth: add automatic browser redirect to signInWithSSO (#1849)
  • realtime: setAuth not required on custom jwt token (#1826)

❤️ Thank You

  • Filipe Cabaço @filipecabaco
  • Katerina Skroumpelou @mandarini

2.81.0 (2025-11-10)

🚀 Features

  • realtime: implement V2 serializer (#1829)

🩹 Fixes

  • auth: make webauthn param optional and move register params to webauthn (#1765)
  • auth: add providers type to UserAppMetadata interface (#1760)
  • auth: use direct attestation for registration/authentication (#1764)
  • functions: add configurable timeout and normalize abort/timeout errors as FunctionsFetchError (#1837)
  • realtime: ensure WebSocket connections are properly closed in teardown (#1841)

❤️ Thank You

  • Eduardo Gurgel
  • Katerina Skroumpelou @mandarini
  • Tanmay Sharma @tanmaysharma2001

2.80.0 (2025-11-06)

🚀 Features

  • auth: add TypeScript types for documented JWT claims fields (#1802)

🩹 Fixes

  • auth: only warn if multiple clients share a storage-key (#1767)

❤️ Thank You

  • Steve Hall @sh41
  • Sumit Kumar @Software-Engineering-Project-Team-Bob

2.79.0 (2025-11-04)

🚀 Features

  • auth: support throwing errors instead of returning them (#1766)
  • repo: remove node-fetch dependency, require Node.js 20+ (#1830)

❤️ Thank You

  • Katerina Skroumpelou @mandarini

2.78.0 (2025-10-30)

🚀 Features

  • auth: add OAuth 2.1 authorization consent management API calls (#1793)
  • auth: add OAuth client update support (#1812)
  • auth: refactor getAuthenticatorAssuranceLevel method (#1822)

🩹 Fixes

  • auth: remove redirection in getAuthorizationDetails (#1811)
  • auth: move session warning proxy from session to user object (#1817)

❤️ Thank You

  • Cemal Kılıç @cemalkilic
  • Katerina Skroumpelou @mandarini
  • Stojan Dimitrovski @hf

2.77.0 (2025-10-29)

🚀 Features

  • auth: add OAuth 2.1 authorization consent management API calls (#1793)
  • auth: add OAuth client update support (#1812)
  • storage: add support for bucket pagination and sorting (#1790)

🩹 Fixes

  • auth: handle 204 No Content response in OAuth client delete (#1786)
  • auth: remove redirection in getAuthorizationDetails (#1811)
  • postgrest: add incoming major 14 support (#1807)
  • repo: add missing tslib dependency to core packages (#1789)
  • repo: cleanup package-lock.json and bun.lock (#1799)
  • storage: remove unnecessary filter (#1809)

🔥 Performance

  • precompile RegExp (#1806)

❤️ Thank You

  • Andrew Valleteau @avallete
  • Cemal Kılıç @cemalkilic
  • Fabrizio @fenos
  • Katerina Skroumpelou @mandarini
  • Kevin Grüneberg @kevcodez
  • Lenny @itslenny

2.76.1 (2025-10-21)

🩹 Fixes

  • repo: add missing tslib dependency to core packages (#1789)

❤️ Thank You

  • Katerina Skroumpelou @mandarini

2.76.0 (2025-10-20)

🚀 Features

  • realtime: realtime explicit REST call (#1751)
  • realtime: enhance RealtimeChannel type (#1747)
  • storage: storage vectors and analytics in storage-js (#1752)

🩹 Fixes

  • functions: missing body when Content-Type header supplied by dev (#1758)
  • functions: add application/pdf response parsing to FunctionsClient (#1757)
  • realtime: manipulate URLs using URL object (#1769)
  • repo: convert postbuild to explicit codegen (#1778)
  • storage: correct list v2 types to correctly match data returned from api (#1761)
  • storage: use backward compatible return type in download function (#1750)
  • storage: api types (#1784)

❤️ Thank You

  • Fabrizio @fenos
  • Filipe Cabaço @filipecabaco
  • Guilherme Souza
  • Katerina Skroumpelou @mandarini
  • Lenny @itslenny

2.75.1 (2025-10-17)

🩹 Fixes

  • storage: use backward compatible return type in download function (#1750)

❤️ Thank You

  • Lenny @itslenny

2.75.0 (2025-10-09)

🚀 Features

  • postgrest: add embeded functions type inference (#1632)

❤️ Thank You

  • Andrew Valleteau @avallete

2.74.0 (2025-10-07)

🚀 Features

  • auth: add deprecation notice to onAuthStateChange with async function (#1580)
  • auth: add OAuth 2.1 client admin endpoints (#1582)
  • docs: explicitly mark options as optional (#1622)
  • realtime: add support to configure Broadcast Replay (#1623)
  • release: enable trusted publishing (#1592)
  • storage: add support for sorting to list v2 (#1606)

🩹 Fixes

  • storage: remove trailing slash from baseUrl normalization (#1589)

❤️ Thank You

  • Cemal Kılıç @cemalkilic
  • Doğukan Akkaya
  • Eduardo Gurgel
  • Etienne Stalmans @staaldraad
  • Lenny @itslenny
  • Stojan Dimitrovski @hf
  • Taketo Yoshida