asymmetric-al/nextjs-supabase-auth
.agents/skills/nextjs-supabase-auth/SKILL.md
Integrate Supabase Auth with Next.js App Router using middleware, callback handling, protected routes, and server/client client boundaries.
$ install --global
skillsauthnpx skillsauth add asymmetric-al/core nextjs-supabase-authInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 10, 2026, 3:05 AM10.5s1 file scanned
SKILL.md
- name:
- nextjs-supabase-auth
- description:
- Integrate Supabase Auth with Next.js App Router using middleware, callback handling, protected routes, and server/client client boundaries.
- owner:
- skills-steward
- last_updated:
- 2026-02-18
- status:
- active
- repo:
- supabase/agent-skills
- - "https:
- //supabase.com/docs/guides/auth
- license:
- MIT
Next.js + Supabase Auth
Use this skill for authentication work in Next.js App Router with Supabase Auth.
When to Apply
Use this skill when:
- Implementing login/signup/logout and session flows
- Protecting routes with middleware
- Handling auth callback exchanges
- Wiring auth checks in Server Components, Server Actions, and route handlers
- Debugging cookie/session desync between server and client
Do not use this skill when:
- The task is primarily query/index/schema optimization (use
supabase-postgres-best-practices) - The task spans broader Supabase surface area beyond Next.js auth wiring (use
docs/ai/skills/supabase/SKILL.md) - The task is UI-only and does not change auth behavior
Core Rules
- Use
@supabase/ssrpatterns for App Router integration. - Use
@/lib/supabase/serverfor server-side code and@/lib/supabase/clientfor client-side code. - Use middleware to refresh and enforce session state on protected routes.
- Do not manually store or forward auth tokens in client code.
- Use Server Actions (or secure route handlers) for privileged auth operations.
- Maintain RLS assumptions; do not bypass policy boundaries.
Workflow
- Identify execution boundary first (server component, client component, middleware, action, or route handler).
- Ensure the correct Supabase client is used for that boundary.
- Verify middleware coverage for protected routes.
- Verify callback handling exchanges auth code/session correctly.
- Validate auth checks before sensitive reads/writes.
- Verify end-to-end login/logout/session refresh behavior.
Checklist
- [ ] Server code imports
@/lib/supabase/server - [ ] Client code imports
@/lib/supabase/client - [ ] Protected paths are covered by auth middleware
- [ ] Callback route/session exchange is correctly handled
- [ ] No service role keys in client-side code
- [ ] No manual token persistence logic added
Common Anti-Patterns
- Using browser clients in server actions
- Using server clients in client components
- Calling
getSessionblindly in server render paths without user validation - Storing JWTs manually in localStorage/cookies
Related Skills
asymmetric-al/payload
development
VerifiedTrustedCommunity
Use when working with Payload CMS projects (payload.config.ts, collections, fields, hooks, access control, Payload API). Use when debugging validation errors, security issues, relationship queries, transactions, or hook behavior.
473SKILL.mdUpdated Apr 10, 2026
asymmetric-al/triage-ci-flake
testing
VerifiedTrustedCommunity
Use when CI tests fail on main branch after PR merge, or when investigating flaky test failures in CI environments
473SKILL.mdUpdated Apr 10, 2026
asymmetric-al/generate-translations
tools
VerifiedTrustedCommunity
Use when new translation keys are added to packages to generate new translations strings
473SKILL.mdUpdated Apr 10, 2026
asymmetric-al/repo-entry
data-ai
VerifiedTrustedCommunity
Pointer to the canonical agent instruction and skill system for this monorepo
473SKILL.mdUpdated Apr 10, 2026