authentication-system

Dual-token authentication in Supabase uses a visitor token for anonymous access and a user token for authenticated operations. The client automatically switches tokens based on sign-in state, caching them in-memory to manage access securely.

Row Level Security in Supabase enforces fine-grained data access by evaluating dynamic JWT app_metadata. Updating this metadata reflects the current user context, allowing proper differentiation for both public and private realtime interactions.

Yes, a single Supabase auth user can support Realtime with RBAC by acting as a unified transport layer. Differentiation between user roles and access levels is handled dynamically via app_metadata updated within the JWT.

The best way to manage OAuth sign-in flows and token lifecycles is using server-side token generation paired with client-side token management. This approach handles token switching automatically and secures data operations across user sessions.

In-memory token storage is used for Supabase client-side caching to reduce exposure risks. By avoiding localStorage, client-side caching minimizes the attack surface while still automatically selecting and caching the appropriate token based on sign-in state.