Skip to content

Supabase Auth Email Templates

This project uses Supabase Management API to keep Auth templates consistent across environments. Templates are configured to use Onset-hosted links (/auth/confirm) so customer emails never expose Supabase URLs. The script also applies branded templates for security notification emails so all Auth emails share the same visual language.

Apply templates

  1. Create a Supabase personal access token:
    https://supabase.com/dashboard/account/tokens
  2. Run:
SUPABASE_ACCESS_TOKEN=sbp_xxx npm run supabase:auth:templates

Optional overrides

  • PROJECT_REF (default: emxrmjysvxeboavhatry)
  • SITE_URL (default: https://clinic.theonset.app)
  • URI_ALLOW_LIST (default includes production + localhost callback)

Example:

PROJECT_REF=emxrmjysvxeboavhatry \
SITE_URL=https://clinic.theonset.app \
URI_ALLOW_LIST="https://clinic.theonset.app/auth/callback,http://localhost:3000/auth/callback" \
SUPABASE_ACCESS_TOKEN=sbp_xxx \
npm run supabase:auth:templates

About "first signup welcome" emails

Supabase's built-in auth templates cover confirmation, magic link, recovery, invite, reauthentication, and email-change flows.

There is no separate built-in "post-confirmation welcome email" event template.

To keep setup simple, this project uses:

  • Custom SMTP in Supabase Auth
  • Built-in Supabase Auth email templates

No Send Email hook is required for standard clinic auth flows.

  • Auth emails should use only Onset domains.
  • The template script generates confirmation/reset/invite links using:
  • {{ .SiteURL }}/auth/confirm?...
  • src/app/auth/confirm/route.ts verifies token hashes server-side and redirects users in-app.