How to do server-side auth check in Supabase?

 

Step 1: Set Up Your Supabase Project

 

1. Initialize a new Supabase project by visiting the Supabase website and setting up an account if you haven’t already.
2. Once logged in, create a new project and name it according to your preference.
3. Note the API URL and the API key as these will be required to connect to your database.

 

Step 2: Install Supabase Client

 

To interact with your Supabase backend, you need to install the Supabase client library in your project. If you're using Node.js, you can install it using npm:

npm install @supabase/supabase-js

 

Step 3: Initialize Supabase in Your Project

 

After installation, you need to initialize Supabase in your server-side code. Create a new JavaScript file (e.g., server.js) and write the following code:

const { createClient } = require('@supabase/supabase-js');

const supabaseUrl = process.env.SUPABASE\_URL;
const supabaseKey = process.env.SUPABASE\_KEY;

const supabase = createClient(supabaseUrl, supabaseKey);

Ensure you have environment variables SUPABASE_URL and SUPABASE_KEY set with your project's URL and API key, respectively.

 

Step 4: Implement Authentication Check

 

To check if a user is authenticated on the server-side, you must validate the JWT (JSON Web Token) received from the client. Here's how you handle this:

async function checkAuth(req) {
  const token = req.headers.authorization.split(' ')[1];
  const { data, error } = await supabase.auth.api.getUser(token);

  if (error) {
    console.error('Error fetching user:', error);
    return null;
  }

  return data;
}

Call this function in your server logic where you want to perform an auth check.

 

Step 5: Use the Auth Check in a Route

 

Assuming you're using an Express.js server, you can protect routes as follows:

const express = require('express');
const app = express();

app.get('/protected', async (req, res) => {
  const user = await checkAuth(req);

  if (!user) {
    return res.status(401).json({ error: 'Unauthorized' });
  }

  res.json({ message: 'Successfully authenticated', user });
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});

Make sure you've set up your Express.js server correctly with necessary middleware like body-parser if required.

 

Step 6: Test Your Implementation

 

1. Start your server and access the protected route /protected using a tool like Postman or cURL.
2. Include the Authorization header: Bearer YOUR_ACCESS_TOKEN.
3. Verify that you receive either an authenticated response or an error message if the token is invalid or absent.