supabase/auth

A JWT based API for managing users and issuing JWT tokens

Stars: 2.6k
Forks: 764
Open beginner issues: 11
Indexed issues: 199
Avg merge: 5d 2h
Merged PRs (30d): 38

Dominant language: Go
License: MIT
Last GitHub push: Sep 18, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: good first issue hacktoberfest

Beginner friendly Everything

Open All

199 open issues indexed

GoTrue rejects valid ES256 tokens after signing-key rotation due to JWKS cache not refreshing at runtime Open

Difficulty 4/5 3-5 days Newbie friendliness 52/100

supabase/auth#2821 · Opened Sep 21, 2026
OAuth 2.1 Server (beta): GET /oauth/authorizations/{id} returns 400 when `resource`, `offline_access`, or a public client is used — blocks MCP connectors Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

supabase/auth#2820 · Opened Sep 20, 2026
Proposal: per-token failed-attempt limit for OTP verification Open

bug

Difficulty 5/5 Over a week Newbie friendliness 35/100

supabase/auth#2819 · Opened Sep 18, 2026
RefreshTokenGrant leaks raw internal error text to API clients in the msg field Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

supabase/auth#2812 · Opened Sep 15, 2026
IsUniqueConstraintViolatedError does not recognize a real Postgres unique violation, identity link race returns 500 instead of 422 Open

Difficulty 3/5 1-2 days Newbie friendliness 68/100

supabase/auth#2810 · Opened Sep 15, 2026
OAuth 2.1 server: MFA verification deletes OAuth client sessions (InvalidateSessionsWithAALLessThan does not exclude oauth_client_id) Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

supabase/auth#2801 · 1 comment · Opened Sep 12, 2026
Azure provider: "Error getting user profile from external provider" using the documented /consumers tenant URL for personal accounts REPO: supabase/auth (github.com/supabase/auth/issues) Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

supabase/auth#2795 · 1 comment · Opened Sep 9, 2026
Local mails use Supabase's default templates instead of ours (on SELinux hosts) Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 68/100

supabase/auth#2783 · 1 comment · Opened Sep 3, 2026
sessions_timebox rendered with an 'h' suffix: GoTrue fails to boot on 'invalid duration' (and silently x3600 below the overflow threshold) Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

supabase/auth#2770 · 1 comment · Opened Sep 1, 2026
Passkey login fails with `webauthn_verification_failed` ("Backup Eligible flag inconsistency") for Apple iCloud synced passkeys on subsequent logins Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 55/100

supabase/auth#2732 · 1 comment · Opened Aug 25, 2026
Concurrent MFA verify for the same user returns 500 (FK violation / deadlock) instead of a 4xx conflict Open

Difficulty 4/5 3-5 days Newbie friendliness 52/100

supabase/auth#2727 · 1 comment · Opened Aug 25, 2026
`after-user-created` hook fires on every external OAuth sign-in, not just on account creation Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

supabase/auth#2726 · 1 comment · Opened Aug 24, 2026
.ConfirmationURL drops path/query from redirect_to at email-send time, even though /auth/v1/verify honors it correctly when supplied directly Open

Difficulty 3/5 1-2 days Newbie friendliness 68/100

supabase/auth#2722 · 1 comment · Opened Aug 22, 2026
OAuth 2.1 server: authorize rejects RFC 8252 loopback ephemeral-port redirect_uri (exact-match, no port exemption) Open

Difficulty 3/5 1-2 days Newbie friendliness 72/100

supabase/auth#2703 · Opened Aug 17, 2026
POST /auth/v1/recover returns email_address_invalid for an existing user and success for a missing user (account enumeration) Open

Difficulty 4/5 3-5 days Newbie friendliness 52/100

supabase/auth#2702 · 2 comments · Opened Aug 16, 2026
Custom OIDC provider discards non-standard claims — CustomClaims passthrough exists only for Keycloak Open

Difficulty 3/5 1-2 days Newbie friendliness 68/100

supabase/auth#2694 · 4 comments · Opened Aug 11, 2026
Audit log entries for identity_unlinked are written with an empty log_type Open

Difficulty 1/5 Under an hour Newbie friendliness 86/100

supabase/auth#2679 · Opened Aug 6, 2026
Concurrent /otp signup race for the same new email: losing request returns raw 500 (users_email_partial_key, aborted transaction) instead of a graceful response Open

Difficulty 4/5 3-5 days Newbie friendliness 52/100

supabase/auth#2675 · Opened Aug 4, 2026
Password grant leaks account existence via timing: no hash verify on the unknown-user path Open

Difficulty 3/5 1-2 days Newbie friendliness 68/100

supabase/auth#2674 · 1 comment · Opened Aug 4, 2026
PUT /user 500s when a customize_access_token hook blanks session_id Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

supabase/auth#2665 · 1 comment · Opened Aug 1, 2026
Intermittent 403 "unrecognized JWT kid <nil> for algorithm ES256" on Admin API with valid sb_secret key Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

supabase/auth#2647 · 1 comment · Opened Jul 25, 2026
linkIdentity rejects phone-only users when an email-optional OIDC identity has no email Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 80/100

supabase/auth#2640 · 2 comments · Opened Jul 23, 2026
emailRedirectTo is ignored during signUp() confirmation email, but works correctly for resetPasswordForEmail() Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

supabase/auth#2634 · 1 comment · Opened Jul 18, 2026
Custom OIDC: token exchange url-encodes client secret (RFC 6749 §2.3.1), breaking providers that expect a raw secret (Epic); real error masked by auto-detect fallback Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

supabase/auth#2623 · Opened Jul 13, 2026
Proposal: isolated-DB multi-tenant Auth runtime with bounded tenant routing Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

supabase/auth#2622 · 2 comments · Opened Jul 10, 2026
Design proposal: multi-tenant Supabase Auth runtime Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

supabase/auth#2621 · 10 comments · Opened Jul 9, 2026
Authorization-code replay race (TOCTOU) in the `authorization_code` grant at `POST /oauth/token` Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 25/100

supabase/auth#2613 · 1 comment · Opened Jul 2, 2026
OAuth 2.1 server: support RFC 8707 Resource Indicators (resource parameter → aud claim) Open

Difficulty 5/5 Over a week Newbie friendliness 42/100

supabase/auth#2610 · 4 reactions · Opened Jul 2, 2026
internal/forks/godotenv is not copied to container in Dockerfile.dev Open

bug

Difficulty 1/5 Under an hour Newbie friendliness 86/100

supabase/auth#2606 · Opened Jul 2, 2026
[BUG] double_confirm_changes silently bypassed when mailer_autoconfirm is true. Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

supabase/auth#2600 · 3 comments · Opened Jun 29, 2026
Sent Verification email Instead of having configured HTML template file, the email body contains the HTML returned by the application URL configured in GOTRUE_SITE_URL. Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 48/100

supabase/auth#2589 · 1 comment · Opened Jun 23, 2026
Feature request: sign up a user without creating a session Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

supabase/auth#2586 · Opened Jun 22, 2026
Make PKCE optional for confidential clients in the OAuth server Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 50/100

supabase/auth#2585 · 1 comment · 2 reactions · Opened Jun 22, 2026
External provider with no email returns generic 500 (unexpected_failure) instead of email_address_not_provided Open

Difficulty 2/5 1-3 hours Newbie friendliness 20/100

supabase/auth#2583 · Opened Jun 18, 2026
email_verified is set to true during OTP email sign up before verifying the OTP code. Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 52/100

supabase/auth#2580 · 3 comments · Opened Jun 17, 2026
[BUG] Kakao provider hardcodes account_email scope, blocking non-Biz Korean developers Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 52/100

supabase/auth#2574 · 6 reactions · Opened Jun 12, 2026
auth.identities.last_sign_in_at not updated after subsequent sign-ins (contradicts docs) Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 50/100

supabase/auth#2563 · Opened Jun 4, 2026
send_email hook payload site_url uses API_EXTERNAL_URL instead of GOTRUE_SITE_URL Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

supabase/auth#2558 · Opened Jun 1, 2026
Cannot update or delete custom OAuth provider in the UI Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 72/100

supabase/auth#2541 · 6 comments · 1 reaction · Opened May 26, 2026
admin.generateLink(email_change_new): properties.hashed_token diverges from stored email_change_token_new Open

Difficulty 3/5 1-2 days Newbie friendliness 48/100

supabase/auth#2538 · 1 comment · Opened May 25, 2026
Magic link doesn't support PKCE + opens up PKCE bypass for OTP Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 48/100

supabase/auth#2536 · 3 comments · Opened May 18, 2026
Custom OAuth (oauth2) returns "missing provider id" after successful login Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 48/100

supabase/auth#2519 · 2 comments · Opened May 5, 2026
Mailer drops path component of API_EXTERNAL_URL when building confirmation URLs Open

Difficulty 3/5 1-2 days Newbie friendliness 55/100

supabase/auth#2518 · 3 comments · 2 reactions · Opened May 4, 2026
send_email Auth Hook does not attach Authorization header despite signing secret being configured Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 55/100

supabase/auth#2499 · Opened Apr 22, 2026
Roles in ID token from Zitadel is removed Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 55/100

supabase/auth#2494 · Opened Apr 21, 2026
Custom Hostname active but /.well-known/oauth-authorization-server still returns issuer: <project-ref>.supabase.co (RFC 8414 violation) Open

Difficulty 5/5 Over a week Newbie friendliness 32/100

supabase/auth#2486 · 2 comments · 4 reactions · Opened Apr 19, 2026
`signInWithOAuth` custom provider incorrect `redirect_uri` Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 20/100

supabase/auth#2477 · 2 comments · Opened Apr 11, 2026
Mix-Up Attacks Defense via Distinct Redirect URIs Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

supabase/auth#2474 · Opened Apr 10, 2026
Issue with automatic identity linking Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

supabase/auth#2472 · 2 comments · Opened Apr 9, 2026
Third-Party Auth with WorkOS fails with JWSInvalidSignature Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 55/100

supabase/auth#2476 · 2 comments · Opened Apr 8, 2026

A short digest of beginner-friendly GitHub issues.