Supabase Auth
Supabase Auth is an MIT-licensed Go authentication server that issues JWTs and stores users in a Postgres schema, offered both as part of hosted Supabase and as a self-hostable component.
Free, Pro, Team and Enterprise plans with authentication billed on monthly active users above an included allotment, and SAML single sign-on limited to paid plans; self-hosting is free.
Open source
Appears in 1 guide
Where it ranks
Guides that include Supabase Auth.
Security headers
What Supabase Auth's website sends to your browser.
Scanned 2026-08-25. Grade headers F, scoring 25 out of 100.
−
No Content-Security-Policy, so no defence in depth against cross-site scripting
+
Strict-Transport-Security is set
−
No X-Content-Type-Options, so MIME sniffing is not disabled
−
No X-Frame-Options and no CSP frame-ancestors, so clickjacking is possible
−
No Referrer-Policy, so full URLs may leak to third parties
−
No Permissions-Policy, so powerful browser features are not restricted
−
No Cross-Origin-Opener-Policy
−
No Cross-Origin-Resource-Policy
+
No server-version or X-Powered-By disclosure
This is one narrow, automated check of the HTTP response headers on the vendor's own website. It says nothing about how the product itself is built, how it stores your data, or whether it has ever been audited. A good grade here is a small signal that somebody was paying attention.