Lovable prompt to add JWT authentication
Auth retrofits fail in the gaps, the flash of a protected page, the edge function that skips verification, the one table with RLS off. This prompt walks Lovable through Supabase Auth end to end, from signup and silent token refresh to 401 handling in functions, so the JWT actually gates every layer.
Last updated
Add JWT-based authentication to this app using Supabase Auth, covering the client, the database, and the edge functions. Flows: email and password signup with a confirmation step, sign in, a magic link option, password reset, and sign out. On signup, insert a row into a profiles table keyed to the new user id. Route protection: redirect signed-out visitors from any authenticated route to /login with a return-to parameter, and send signed-in users away from /login. Keep the session in the Supabase client so a refresh does not log anyone out, and refresh tokens silently instead of bouncing to login when the access token expires. Database: enable row level security on every user-owned table and write policies against auth.uid(), leaving no table with policies disabled. Edge functions: each function reads the Authorization header, verifies the JWT through the Supabase client, and returns 401 with a JSON error body when it is missing or invalid. No function may fall back to the service role for user-scoped reads. UI states: a loading gate while the session restores so protected pages never flash before redirect, inline errors for wrong credentials, and a resend link on the confirmation notice. Acceptance: an expired session on a protected page recovers without a visible logout, calling an edge function with no header returns 401 not 500, password reset works end to end from the email link, and querying another user's rows from the browser console returns nothing.
Same task in other tools
Questions about this prompt
Is this hand-rolled JWT code or Supabase Auth?
Supabase Auth issues and refreshes the tokens, and the prompt makes Lovable consume them correctly on the client, in RLS policies, and in edge functions. Writing your own token signing inside a Lovable app is the wrong direction.
How do I add Google or GitHub login on top?
Enable the provider in your Supabase auth settings first, then ask Lovable to add the OAuth buttons to the login screen. The session handling from this prompt covers those flows without change.
Users get logged out after the tab sits idle. What is wrong?
That points at token refresh not firing, often because a custom fetch wrapper bypasses the Supabase client. Ask Lovable to route all data access through the shared client instance so refresh happens in one place.