Recommended Free Tools
In Supabase Auth, a user is the account, an identity is a sign-in method linked to that account, and a session is the authentication state a browser uses after sign-in. One user can have multiple identities; the session is represented by an access-token and refresh-token pair. Keeping these concepts separate helps you design app tables and write safer access policies.
How the three concepts differ
| Concept | What it represents | Relationship to a user | Security role |
|---|---|---|---|
auth.users record |
The Auth-managed account and canonical user ID. | One account can be associated with multiple identities and sessions over time. | Its ID is the usual reference from application tables and an identifier in JWT claims. |
auth.identities record |
A sign-in method, such as email, phone, OAuth, or SAML. | A user may have multiple identities. An anonymous user has none until one is linked. | Describes how a user authenticates; it is not itself a browser session. |
| Session | Authentication state binding a verified identity to a browser. | A user can authenticate in different browser contexts; a session is represented by its token pair. | The access token carries signed identity and authorization context; the refresh token is used to obtain renewed access. |
Supabase Auth stores its records in the project’s Postgres database, in the special auth schema. The official Auth overview explains how Auth data can relate to application tables. The tables and tokens serve different jobs: an account is not a login method, and neither is interchangeable with the credentials held by a browser.
As an Amazon Associate I earn from qualifying purchases.
What lives in auth.users?
auth.users is the Auth-managed user record. Its user ID is the canonical identifier to reference when application data belongs to an authenticated account. For example, an application-owned table can store a profile row whose user ID references the Auth user ID through a foreign key.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Use your own schema for product-specific profile fields rather than treating the Auth schema as a general-purpose profile database. Supabase’s Auth0 migration guide recommends an application table for larger amounts of user-specific metadata. This also keeps account-management data separate from fields your application owns and evolves.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What does an identity record mean?
Supabase defines an identity as “an authentication method associated with a user.” The documented identity types include email, phone, OAuth, and SAML. A person may link more than one method to a single account, so an email identity and an OAuth identity can point to the same user rather than representing two unrelated accounts.
An identity record includes an identity ID, provider name, provider identifier, linked user ID, provider-specific identity data, and timestamps. For email and phone identities, the provider ID is the user’s ID from auth.users; OAuth and SAML identity data contains information from the external provider. An anonymous user has no identity until a sign-in method is linked. See Supabase’s identity guide for the identity object and linking behavior.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How a session uses access and refresh tokens
A session is the browser’s authenticated state, not another name for the user or identity record. Supabase describes the access-token and refresh-token pair as representing a session. The access token is a JWT; the refresh token is a randomly generated string. Supabase’s glossary characterizes sessions as usually long-lived and access tokens as short-lived, usually no more than one hour. Actual token lifetime depends on project configuration, so do not treat that typical description as a guarantee for every project.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The access token carries claims used to identify the request context. Supabase’s JWT claim reference lists required claims including sub (the user UUID), session_id (the session identifier), role, aal, iss, aud, exp, and iat, as well as email, phone, and is_anonymous. Optional claims can include metadata and authentication-method context. Applications and APIs should validate the token signature and relevant claims, including expiration, issuer, and audience, before trusting them. Never put a service-role token in client-side code.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Server-rendered applications
In server-side rendering (SSR), server code cannot read browser local storage. Supabase’s SSR advanced guide describes storing tokens in secure cookies and recommends the PKCE flow for SSR; it says @supabase/ssr initializes clients to use PKCE by default. Follow the current guide and package behavior when configuring a client, since implementation details can change.
Metadata is not the same as application profile data
Supabase’s Auth0 migration guide distinguishes two JSONB fields: raw_user_meta_data, which users can update, and raw_app_meta_data, which users should not be able to update. Both are included in access tokens. Do not use user-editable metadata as a trusted source for permissions or other authorization decisions, and avoid putting large or excessive profile data in either field. Put application-owned profile and business data in your own tables instead.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How Auth context connects to database access
Row-level security (RLS) policies let Postgres decide which rows a client can access using Auth context. Supabase integrates RLS with helper functions such as auth.uid() and auth.jwt(); its RLS guide explains the approach. A policy can use the authenticated user ID to restrict reads or writes to rows belonging to that user.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteBe careful about exposing data from auth.users through views. Supabase’s security guidance warns that a view can expose personal information if it does not respect the underlying protections; a security-invoker view is one way to respect underlying policies. For application-facing data, a purpose-built table in your own schema is usually a clearer boundary.
Quick Recap
A practical way to model an app
- Use the Auth user ID as the account key. When application data belongs to a user, store that ID in an app-owned table and add a foreign key where appropriate.
- Keep sign-in methods conceptually separate. Let Auth manage identities and linking; do not create duplicate app accounts merely because a user has more than one provider.
- Keep profile and business fields in your schema. Store fields your app owns in application tables, not as an improvised extension of the Auth record.
- Use RLS to enforce row access. Write policies around verified Auth context, and do not treat user-editable metadata as authorization proof.
- Handle browser credentials for your app architecture. For SSR, follow Supabase’s current secure-cookie and PKCE guidance; validate tokens where your server or API relies on their claims.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
