Documentation Authentication

Authentication

CloudCode has no built-in user auth for your apps. Supabase Auth in your own project is the usual choice, and the agent can generate the sign-in pages, session context and route guards.

Sign-in methods (configured in your Supabase dashboard)

Email & password, with optional email confirmation
Magic link (passwordless email sign-in)
OAuth providers you enable in Supabase, such as Google or GitHub. You register the OAuth app with each provider yourself

typescript

import { supabase } from "@/lib/supabase";

// Sign up
const { data, error } = await supabase.auth.signUp({
  email: "user@example.com",
  password: "securepassword",
});

// Sign in
await supabase.auth.signInWithPassword({ email: "user@example.com", password: "securepassword" });

// Get current user
const { data: { user } } = await supabase.auth.getUser();

// Sign out
await supabase.auth.signOut();

Protecting routes

Your project doesn't include an auth hook out of the box, so ask the agent to create one. A minimal version looks like this:

typescript

// src/hooks/useSession.ts
import { useEffect, useState } from "react";
import type { Session } from "@supabase/supabase-js";
import { supabase } from "@/lib/supabase";

export function useSession() {
  const [session, setSession] = useState<Session | null>(null);
  const [loading, setLoading] = useState(true);
  useEffect(() => {
    supabase.auth.getSession().then(({ data }) => { setSession(data.session); setLoading(false); });
    const { data: sub } = supabase.auth.onAuthStateChange((_e, s) => setSession(s));
    return () => sub.subscription.unsubscribe();
  }, []);
  return { session, loading };
}

Note

In Supabase → Authentication → URL Configuration, add your deployed URL and any other origin you test from to the allowed redirect URLs. Otherwise confirmation emails and OAuth redirects won't come back to your app.