FS26
Ctrl K
Phase 17 · Lesson 01

Supabase Auth Architecture and Keys

≈ 2 min core reading · 302 source/companion words
Learning contract

What you should be able to do after this

  • Explain Supabase Auth Architecture and Keys without relying on framework buzzwords.
  • Connect the lesson to the phase outcome: Integrate Supabase Auth into Next.js with correct browser/server clients, cookie/session behavior, sign-up/sign-in/sign-out, and protected routing.
  • Reproduce the relevant behavior and verify it with evidence.
  • Diagnose at least one representative failure instead of guessing.
Figure 17.1 — TaskFlow boundary map
auth form
Supabase Auth
session/cookies
Next.js server/client auth helpers
protected UI
access token handoff
This lesson belongs to Phase 17. Keep the full request/data path visible even when today's code changes only one box.
Instructor workflow: predict first → implement the smallest slice → run it → inspect evidence → break one assumption → diagnose → explain it back. Do not copy the whole code block before understanding the first failing boundary.

Supabase Auth Architecture & Keys Place identity, sessions, keys, Next.js, and NestJS in the correct security boundaries

Phase 17 - Supabase Authentication Volume 05 - Authentication & Security

Architecture milestone

Supabase Auth

v

Next.js session

v

NestJS later verifies bearer token

v

Business authorization remains separate

Phase 17 implements cookie-based Supabase Auth in Next.js. NestJS token verification remains Phase 18.

Supabase Auth is the identity provider, not the application backend TaskFlow already has a NestJS backend that owns application rules and Prisma persistence. Supabase Auth is introduced to establish identity and manage the authentication session. It does not replace TasksService, authorization rules, or the NestJS API.

Figure 1 - Responsibility split

Supabase Auth: credentials + session + access token

v

Next.js: web session and authenticated pages

v

NestJS (Phase 18): verify bearer token

v

Service layer: ownership, membership, permissions

v

Prisma/PostgreSQL: durable business data

Authentication and business authorization remain separate layers.

Concern Owner in TaskFlow

Password verification / email confirmation Supabase Auth

Cookie-backed SSR session Next.js + @supabase/ssr

JWT verification for protected API NestJS guard in Phase 18

Task ownership / Workspace permission NestJS service/authorization layer

Business records Prisma + PostgreSQL

Why two Supabase packages? @supabase/supabase-js is the base SDK. @supabase/ssr wraps it for frameworks where the same authenticated session must be readable on the browser and server through cookies. Current Supabase guidance recommends @supabase/ssr for Next.js cookie-backed sessions.

Publishable key vs secret key The Project URL and Publishable key are intentionally used by the browser-facing client. A service-role or secret key has elevated privileges and must never be placed in NEXT_PUBLIC_* variables, browser bundles, or source examples.

Do not confuse the key with the user

A public/publishable project key identifies the Supabase project/client capability. The signed-in user identity still comes from the authenticated session and verified access token.

Executable lesson studio · supabase

Now turn the explanation into engineering skill.

Supabase Auth Architecture and Keys matters because it changes a real boundary in TaskFlow. The goal is to understand the inputs, owner, observable output, and failure modes before adding more abstraction.

By the end, you should be able to

  • Explain Supabase Auth Architecture and Keys in terms of concrete inputs, ownership, outputs, and evidence.
  • Implement or reproduce the smallest TaskFlow slice that demonstrates this supabase concept.
  • Diagnose one representative supabase failure using observable evidence instead of trial-and-error.
Figure 17.1B — Mental model
application
connection configuration
Supabase Postgres
database evidence
Read left-to-right while implementing. When debugging, walk right-to-left until the first observed fact differs from your prediction.
Code-along sequence

One coherent change at a time

  1. 01

    Restate the goal of “Supabase Auth Architecture and Keys” as one observable behavior. Write the success signal before touching code.

  2. 02

    Trace the boundary map: application → connection configuration → Supabase Postgres → database evidence. Mark the one boundary this lesson changes.

  3. 03

    Inspect the current repository state and record the exact files, route, table, or runtime involved. Avoid creating an abstraction before you can name the existing owner.

  4. 04

    Implement the smallest vertical slice. Add one coherent change, run the narrowest verification command, and read the output before continuing.

  5. 05

    Connect the slice to TaskFlow’s phase artifact: Working TaskFlow authentication UI/session integration whose server-side checks are explicit and ready to hand tokens to NestJS.. Verify behavior from the outside as a user or API client would.

  6. 06

    Create one controlled failure that is safe to reproduce. Predict the symptom first, capture evidence, locate the earliest broken boundary, then fix only that cause.

  7. 07

    Close the reference and rebuild or explain the core change from memory. Record what you would monitor or test before trusting the same change in production.

txtBoundary trace
Input -> owner -> transformation -> observable output -> failure evidence

Do not copy this as a finished answer. Predict what each boundary does, type the smallest useful slice, run it, then compare the result with your prediction.

Verification

Prove the happy path

  1. Run the narrowest relevant command or request and require a clean exit/status.
  2. Inspect the boundary-specific evidence: terminal output, Network panel, database row/query plan, test report, container health, or deployment logs.
  3. Repeat the behavior once after the change so a one-off cached or stale result cannot masquerade as success.
Break it on purpose

Build debugging memory

  1. Using service-role key in browser code
  2. Change one assumption in the supabase example—identity, input, configuration, ordering, connectivity, or state—and predict the exact symptom before running it.
SymptomInvestigation path
Expected result does not appear

Return to the nearest observable boundary: input, network, process log, database, or rendered UI. Compare actual evidence with the predicted path.

A shortcut appears to fix it

Change one variable at a time and reproduce the original failure after the fix; otherwise you have correlation, not diagnosis.

Closed-reference challenge

Can you transfer the idea?

Without copying the final source, create a second small scenario that applies “Supabase Auth Architecture and Keys” to a different TaskFlow resource or input. Write the acceptance criteria first, implement it, and provide the evidence that each criterion is satisfied.

Explain-back

Answer these without reopening the solution

  1. What problem does Supabase Auth Architecture and Keys solve in TaskFlow, and what would be observably wrong without it?
  2. Which part of the supabase boundary owns the decision, and which neighboring layer must not own it?
  3. What evidence proves the happy path instead of merely suggesting it worked?
  4. Name one realistic failure or abuse case and the first place you would inspect.
  5. If requirements doubled tomorrow, which part of this design should stay stable and which part is allowed to change?
Lesson studio

Turn the reading into skill

01

Do it

Configure project URLs/redirects and explain why local/preview/production values differ.

Use the smallest change that demonstrates this lesson. Stop after it works and capture evidence.
02

Break it safely

Using service-role key in browser code

Predict the symptom before causing the failure. Then locate the earliest boundary where reality diverges from expectation.
03

Explain it back

Why does this responsibility live here, what input does it trust, what output proves success, and what would go wrong if another layer owned it?

If your explanation is vague, repeat the boundary trace before moving on.
Exit ticket

Before marking complete

Close the reference. Reproduce the core idea from memory or explain the exact request/data flow aloud. Then check your diff or notes for accidental shortcuts that bypass validation, authorization, error handling, or verification earned in earlier phases.

Dashboard URLs Email Confirmation and PKCE →