Authentication

Authentication Overview

Authentication in NextBento with Supabase Auth.

Overview

NextBento uses Supabase Auth for authentication. Sessions are managed via HTTP-only cookies with the Supabase SSR package, providing secure, server-side session validation.

Auth Methods

Method	Description	Components
Email/Password	Traditional signup and login	`login-form-`, `signup-form-`
Magic Link	Passwordless — email a link	`login-form-*` (magic link tab)
Google OAuth	Sign in with Google	OAuth flow via `/api/auth/oauth`
GitHub OAuth	Sign in with GitHub	OAuth flow via `/api/auth/oauth`

Login page with split layout — Login page (split layout) — OAuth, magic link, and email

File Structure

app/(auth)/
  login/page.tsx, login-2/page.tsx, login-3/page.tsx
  signup/page.tsx, signup-2/page.tsx, signup-3/page.tsx
  forgot-password/page.tsx, forgot-password-2/page.tsx, forgot-password-3/page.tsx
  reset-password/page.tsx, reset-password-2/page.tsx, reset-password-3/page.tsx

components/auth/
  login-form.tsx, login-form-minimal.tsx, login-form-split.tsx
  signup-form.tsx, signup-form-minimal.tsx, signup-form-split.tsx
  forgot-password-form-*.tsx, reset-password-form-*.tsx
  accept-invitation-form.tsx
  auth-split-layout.tsx

lib/auth/
  use-auth-actions.ts  — Client-side auth actions
  errors.ts            — Auth error handling

lib/supabase/
  client.ts   — Browser client
  server.ts   — Server client (cookies)
  service.ts  — Service role (admin)
  middleware.ts — Session refresh, protected routes

Session Flow

User signs in via form or OAuth
Supabase sets HTTP-only cookies
lib/supabase/middleware.ts runs on each request — refreshes session if needed
Protected routes check for user — redirect to /login if unauthenticated

Protected Routes

Middleware protects these paths when no user is logged in:

/dashboard and all dashboard sub-routes
/admin
/settings
/api-keys
/activity
/team

Unauthenticated users are redirected to /login.

Onboarding

New users are guided through /onboarding until profiles.onboarding_completed is true (profile → workspace → optional invite → billing CTA). Existing users are backfilled as completed so they are not redirected into onboarding. See app/(auth)/onboarding and app/api/onboarding.

API Routes

Endpoint	Method	Description
`/api/auth/login`	POST	Email/password or magic-link login
`/api/auth/signup`	POST	Email/password or magic-link signup
`/api/auth/forgot-password`	POST	Send reset email
`/api/auth/reset-password`	POST	Reset password with token
`/api/auth/change-password`	POST	Change password (authenticated)
`/api/auth/magic-link`	POST	Send magic link
`/api/auth/oauth`	GET/POST	OAuth (Google, GitHub)
`/api/onboarding`	GET/POST	Onboarding status and completion

Auth Layouts

NextBento supports three layout variants: centered, split, and minimal. See Auth Layouts for details.

Next Steps

Auth Layouts — Choose and customize layout
Accept Invitation — Team invite flow
Supabase Setup — Configure auth providers
Google Brand Verification — Show your domain instead of Supabase on the Gmail consent screen

PreviousDeploying to Vercel NextAuth Layouts