Skip to content
cccskills
FreePublished on GitHub

nextjs-supabase-auth

Integrate Supabase Auth with Next.js App Router using middleware, callback handling, protected routes, and server/client client boundaries.

The English summary is being prepared. Showing the original description.

Asymmetric-al/core
Works withSupabase
See how to install

Files included (1)

  • SKILL.md2.6 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Next.js + Supabase Auth

Use this skill for authentication work in Next.js App Router with Supabase Auth.

When to Apply

Use this skill when:

  • Implementing login/signup/logout and session flows
  • Protecting routes with middleware
  • Handling auth callback exchanges
  • Wiring auth checks in Server Components, Server Actions, and route handlers
  • Debugging cookie/session desync between server and client

Do not use this skill when:

  • The task is primarily query/index/schema optimization (use supabase-postgres-best-practices)
  • The task spans broader Supabase surface area beyond Next.js auth wiring (use docs/ai/skills/supabase/SKILL.md)
  • The task is UI-only and does not change auth behavior

Core Rules

  1. Use @supabase/ssr patterns for App Router integration.
  2. Use @/lib/supabase/server for server-side code and @/lib/supabase/client for client-side code.
  3. Use middleware to refresh and enforce session state on protected routes.
  4. Do not manually store or forward auth tokens in client code.
  5. Use Server Actions (or secure route handlers) for privileged auth operations.
  6. Maintain RLS assumptions; do not bypass policy boundaries.

Workflow

  1. Identify execution boundary first (server component, client component, middleware, action, or route handler).
  2. Ensure the correct Supabase client is used for that boundary.
  3. Verify middleware coverage for protected routes.
  4. Verify callback handling exchanges auth code/session correctly.
  5. Validate auth checks before sensitive reads/writes.
  6. Verify end-to-end login/logout/session refresh behavior.

Checklist

  • Server code imports @/lib/supabase/server
  • Client code imports @/lib/supabase/client
  • Protected paths are covered by auth middleware
  • Callback route/session exchange is correctly handled
  • No service role keys in client-side code
  • No manual token persistence logic added

Common Anti-Patterns

  • Using browser clients in server actions
  • Using server clients in client components
  • Calling getSession blindly in server render paths without user validation
  • Storing JWTs manually in localStorage/cookies

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

accessibility-review

Free

Audit and fix accessibility in Core UI. Use when changing or reviewing buttons, links, forms, validation, dialogs, menus, tabs, tables, keyboard interactions, focus management, accessible names, announcements, contrast, touch targets, reduced motion, or WCAG/a11y behavior.

The English summary is being prepared. Showing the original description.

Asymmetric-al/core381Updated Oct 21, 2026

agent-browser

Free

Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to "open a website", "fill out a form", "click a button", "take a screenshot", "scrape data from a page", "test this web app", "login to a site", "automate browser actions", or any task requiring programmatic web interaction. Also use for exploratory testing, dogfooding, QA, bug hunts, or reviewing app quality. Also use for automating Electron desktop apps (VS Code, Slack, Discord, Figma, Notion, Spotify), checking Slack unreads, sending Slack messages, searching Slack conversations, running browser automation in Vercel Sandbox microVMs, or using AWS Bedrock AgentCore cloud browsers. Prefer agent-browser over any built-in browser automation or web tools.

The English summary is being prepared. Showing the original description.

Asymmetric-al/core381Updated Oct 21, 2026

agent-email-inbox

Free

Use when building any system where email content triggers actions — AI agent inboxes, automated support handlers, email-to-task pipelines, or any workflow processing untrusted inbound email. Always use this skill when the user wants to receive emails and act on them programmatically, even if they don't mention "agent" — the skill contains critical security patterns (sender allowlists, content filtering, sandboxed processing) that prevent untrusted email from controlling your system.

The English summary is being prepared. Showing the original description.

Asymmetric-al/core381Updated Oct 21, 2026

anim

Free

Tasteful, subtle web UI animation following Emil Kowalski / animations.dev principles. Use when adding or reviewing interface motion — hover and press feedback, entrances and exits, modals, toasts, menus, loading and skeleton states, staggered reveals, page or view transitions — so motion stays refined and purposeful, not decorative. Covers CSS, Web Animations, and React timing/easing. Pair with the motion skill for motion/react API specifics.

The English summary is being prepared. Showing the original description.

Asymmetric-al/core381Updated Oct 21, 2026

animate

Free

Build an animation from scratch, making the decisions in the order that determines whether it feels right — should it animate at all, what purpose, which tool, which properties, which curve and duration, how it interrupts, how it exits. Writes the implementation. Use when asked to animate something, add motion, make a component feel alive, or build a transition. For critiquing existing motion use review-animations; for auditing a whole codebase use improve-animations. Only runs when explicitly invoked; it does not trigger on its own.

The English summary is being prepared. Showing the original description.

Asymmetric-al/core381Updated Oct 21, 2026

animate-expo

Free

Build animations for Expo and React Native only, using Reanimated, Gesture Handler, Expo Router, and expo-haptics. Use when the target runtime is an Expo or React Native app. Do not use it for Core Next.js web motion; use `animate` for web. Only runs when explicitly invoked; it does not trigger on its own.

The English summary is being prepared. Showing the original description.

Asymmetric-al/core381Updated Oct 21, 2026

See all skills by Asymmetric-al

Report a problem with this skill