<img width="1510" height="860" alt="image"
src="https://github.com/user-attachments/assets/36a748b7-bdeb-4685-8bb1-da911711874b"
/>
Introduces a new OAuth consent block in preparation for offering more
MCP focused blocks that require authentication and consent. The general
approach for this is to decouple consent block from authentication block
but provide guidance on how to use both. The alternative is to add auth
as a dependency to consent but apps may already have their own
authentication UI / flows.
The block is also positioned as a general OAuth Consent vs MCP Consent
as it can be put to use for other use cases outside of MCP on projects
who want to make use of the OAuth 2.1 Server offering.
A couple of changes outside of the block itself were required:
- Updated the Auth blocks to allow for a `next` param to redirect users
to after signing in
- Updated middleware so next param is correctly passed through to sign
in
## How to test
Requires Docker and a Supabase CLI recent enough to support
`[auth.oauth_server]` (verified on 2.109.0 / GoTrue v2.192.0).
### 1. Local Supabase with the OAuth server enabled
In your `supabase/config.toml`, edit the existing `[auth.oauth_server]`
section — `supabase init` already writes one, and adding a second fails
with `table oauth_server already exists`:
```toml
[auth.oauth_server]
enabled = true
authorization_url_path = "/oauth/consent"
allow_dynamic_registration = true
```
Set `site_url` to wherever your test app runs (e.g.
`http://localhost:3100`), then `supabase start`. Grab the API URL and
publishable key from `supabase status`.
### 2. A consumer app with the blocks installed
The consent block ships no login route by design, so pair it with an
auth block:
```bash
npx create-next-app@latest consent-test --ts --tailwind --app --yes
```
```bash
cd consent-test && npx shadcn@latest init -d -y && npx shadcn@latest add https://supabase.com/library/r/password-based-auth-nextjs.jsonhttps://supabase.com/library/r/oauth-consent-nextjs.json
```
To test this branch before it deploys, run `pnpm --filter ui-library
dev` and use `http://localhost:3004/library/r/...` instead. If you
changed anything under `registry/default/blocks/oauth-consent/**`, run
`pnpm --filter ui-library build:registry` first — shadcn fetches the
generated `public/r/*.json`, not the source.
Put `NEXT_PUBLIC_SUPABASE_URL` and
`NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY` in `.env.local` and start the app
on the port you set as `site_url`.
### 3. Register an OAuth client and start a real authorization request
```bash
curl -s -X POST http://127.0.0.1:54321/auth/v1/oauth/clients/register -H "Content-Type: application/json" -d '{"client_name":"Test Client","redirect_uris":["http://localhost:3100/callback"],"grant_types":["authorization_code"],"response_types":["code"],"scope":"openid profile email"}'
```
Then open the authorize URL in a browser (not curl — you need the
redirect chain and cookies):
```
http://127.0.0.1:54321/auth/v1/oauth/authorize?client_id=<id>&response_type=code&redirect_uri=http://localhost:3100/callback&scope=openid+profile+email&state=xyz&code_challenge=<challenge>&code_challenge_method=S256
```
Auth mints the `authorization_id` and redirects to
`<site_url>/oauth/consent?authorization_id=…`. An MCP client pointed at
your app is an even better driver, since that's the real consumer shape.
### 4. Cases to walk
| Case | Expected |
| --- | --- |
| Signed out, hit the authorize URL | Lands on
`/auth/login?next=%2Foauth%2Fconsent%3Fauthorization_id%3D…`; after
login, returns to the consent screen |
| Consent screen | Shows client name, redirect URI, signed-in email, and
requested scopes from `getAuthorizationDetails` |
| Allow access | Redirects to `redirect_uri` with `code` and your
original `state`; the code exchanges at `/oauth/token` for a real access
token |
| Deny | Redirects with `error=access_denied` and your `state` |
| Re-run the same authorize URL after approving | Skips the screen,
straight to callback with a new code |
| Visit `/oauth/consent` with no `authorization_id` | "This page needs
an authorization_id" |
| Stale or bogus `authorization_id` | Error shown, buttons still usable
|
| Double-click Allow | Exactly one `POST
/oauth/authorizations/<id>/consent` |
Test the react, react-router, or tanstack variant the same way if you're
touching them — the hook is duplicated per framework, so a fix in one
doesn't carry.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added an OAuth 2.1 consent experience with client details, requested
scopes, redirect URI, and approve/deny actions.
* Added OAuth consent examples and registry blocks for Next.js, React,
React Router, and TanStack Start.
* Added OAuth documentation, navigation, and framework support across
the UI library.
* **Bug Fixes**
* Login flows now safely preserve valid same-origin redirect
destinations while rejecting unsafe URLs.
* OAuth routes can handle consent flows before authentication and
redirect safely to sign-in.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Our UI Library registry is expanding to include blocks that go beyond UI
and in some cases focus purely on back-end. This PR is a precursor to
adding more back-end related blocks. This PR includes the `ui-library ->
library` rename plus redirects and small UI copy updates. Since this is
a rename we'll need to update Vercel configuration.
## Vercel rollout
Keep the Library project Root Directory as `apps/ui-library`
1. In the **Library** Vercel project, set:
`NEXT_PUBLIC_BASE_PATH=/library`
Apply it to Preview and Production, then redeploy the Library project.
2. In the **www** Vercel project, add:
`NEXT_PUBLIC_LIBRARY_URL=<current value of NEXT_PUBLIC_UI_LIBRARY_URL>`
Apply it to Preview and Production. Keep `NEXT_PUBLIC_UI_LIBRARY_URL`
during the migration, then redeploy the www project.
3. Deploy in this order:
1. Library project
2. www project
4. Validate:
- `/library`
- `/library/docs/nextjs/password-based-auth`
- `/ui` redirects to `/library`
- `/ui/docs/nextjs/password-based-auth` redirects to
`/library/docs/nextjs/password-based-auth`
- `/ui/docs/ai-editors-rules/*` still uses its existing Docs redirects
No Vercel dashboard redirect rules are needed. Environment-variable
changes require a new deployment.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Supabase UI Library has been renamed to **Supabase Library** across
navigation, pages, documentation, and resource links.
* The Library is now available at `/library`, with updated descriptions
covering components, blocks, and developer tools.
* **Bug Fixes**
* Added permanent redirects from legacy `/ui` URLs to corresponding
`/library` paths.
* Updated links throughout the site and documentation to prevent broken
navigation and references.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Feature, docs update
## What is the new behavior?
This PR introduces a new `RealtimeFlow` component and hook to the UI
library for building collaborative React Flow with Supabase Realtime:
- keeps nodes and edges in sync across multiple connected clients in
real time
- uses Yjs with `@supabase-labs/y-supabase` to propagate flow updates
- supports optional persistence, so a flow can be restored from
previously saved shared state
## Additional context
https://github.com/user-attachments/assets/90d3a381-6f9c-427f-a493-5d91c2141462
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Collaborative "Realtime Flow" diagram editor with syncing overlays and
a dual-view demo component
* Interactive demo page and registry example for live editing
(add/remove/rename nodes)
* Framework-ready registry packages for Next.js, React, React Router,
and TanStack
* **Documentation**
* Comprehensive docs added for Next.js, React, React Router, and
TanStack (usage, persistence, hook API)
* **Chores**
* Added runtime dependency for the flow component package
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/44273)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Docs update. Part of DEPR-198.
## What is the current behaviour?
Auth email template examples and Studio template labels still reflect
older default copy in a few places.
## What is the new behaviour?
Updates Auth docs, local development docs, related snippets, Studio
template labels, and UI Library examples to [match the updated default
Auth email
copy](https://linear.app/supabase/document/email-template-copywriting-updates-04bba460fd2a).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated authentication email template names and descriptions across
guides, replacing "Magic link" with "Sign-in link or code" terminology
* Revised security notification email naming from "Identity
linked/unlinked" to "Sign-in method linked/removed" and "MFA method" to
"Verification method"
* Updated email template example content with improved wording (e.g.,
"Confirm your email address" instead of "Confirm your signup")
* **UI Updates**
* Refined authentication-related UI text labels and descriptions in the
dashboard
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45706)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Adds a new Realtime Monaco component to the UI Library, enabling
collaborative code editing with Supabase Realtime synchronization using
Monaco Editor and Yjs.
## Additional context
This is WIP and used for discuss further changes to the y-supabase
provider.
## Demo
https://github.com/user-attachments/assets/84a761e5-73bb-478e-979a-682121ffee89
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added a new Realtime Monaco collaborative code editor component with
real-time synchronization support across multiple frameworks (Next.js,
React, React Router, Tanstack).
* **Documentation**
* Added comprehensive documentation and usage guides for the Realtime
Monaco component across all supported frameworks.
* **Dependencies**
* Added Monaco editor, Yjs, y-monaco, and Supabase collaboration
packages.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
This PR renames all `SUPABASE_PUBLISHABLE_OR_ANON_KEY` env vars into
`SUPABASE_PUBLISHABLE_KEY` to make the new API keys default. This is in
coordination with the rest of the docs.
I've also cleaned up the `blocks/vue` package from unused files.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Breaking Changes**
* Public environment variable names renamed from PUBLISHABLE_OR_ANON_KEY
→ PUBLISHABLE_KEY across all framework integrations; update your
environment configs.
* **Documentation**
* All framework guides, .env examples and registry docs updated to use
the new variable names.
* **Chores**
* Cleaned up UI registry/templates: some example Vue registry items and
autogenerated registry artifacts were removed or simplified.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Sorted all imports in all packages, `cms`, `design-system` and
`ui-library` apps by running `pnpm format` on them.
All changes in this PR are done by the script.
Adds a section explaining that Realtime Chat uses Realtime Broadcast, does not
store messages by default, and relies on onMessage for persistence. Improves
developer understanding of expected behavior.
* Remove unneeded code.
* Remove more unused code.
* Update knip.jsonc for ui-library.
* Remove unneeded imports. Change the registry generation to only generate what's needed.
* Cleanup the rehype middleware (it wasn't used). Clean up the example blocks generation.
* Don't show the "show code" button in all dropzone examples.
* Search and replace all mentions of SUPABASE_ANON_KEY.
* Copy over some comments from the nextjs template.
* Bump shadcn version.
* Change the building of the blocks to append envVars and docs.
* Use the new envVars property in the clients.
* Rebuild all blocks.
* Fix the wording.
* Update the docs.
* Add social login block.
* Regen the registry.
* Fix the nextjs social auth.
* Add social auth blocks for RR, Tanstack and React.
* Minor fixes.
* Add docs.
* Update the docs.
* Minor fixes to the blocks.
* Update the docs.
* Fix various doc issues.
* Fix the redirect in the password-based auth.
* Fix note about supabase clients in docs.
* Use with instead of assert in the registry imports.
* Update all auth blocks to use /protected.
* Update all docs for the password-based auth.
* Add new label to social auth.
* Fix docs issues.
* Light mode fix
* Smol fixes
* Fix the origin in the login route.
* Add social auth to the landing page.
* Regenerate the registry.
---------
Co-authored-by: Terry Sutton <saltcod@gmail.com>
* add throttled callback to cursor hook
* Simplify some parts, add a different kind of throttle.
* Fix the transition duration.
* Update the realtime cursor blocks.
* add docs for smoother cursors
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
* Add realtime chat to the landing page.
* Fix the realtime cursor demo on the landing page.
* Fix a bad spelling of shadcn.
* Fix the wrong link in RR auth.
* Change the demo for reatlime cursor to use predefined names.
* Fix the React Router auth block docs.
* Regenerate the realtime chat code.
* Add a docs field to the clients blocks. Add a missing package to the nextjs client block.
* Add links to additional docs on the auth blocks pages.
* Add additional links to the current user avatar docs.
* Add additional links to the client docs.
* Add additional links to the dropzone docs.
* Add additional links to the avatar stack.
* Add additional links to the realtime cursor.
* Add additional links to the realtime chat.
* Fix the dropzone links.
* Regenerate the registry.
* Fix the paths of the ai editor rules.
* Fix headings on clients and auth blocks.
* Fix realtime chat and avatar demos.
* Setup mdx-lint for the ui-library. Fix some obvious wordings.
* Fix the tooltips for the examples. Reorder the example pages.
* add realtime chat
* yolo
* clean up avatar references, leaving those out
* allow to pass messages and receive message change state
* add more names to reduce prob of same name popping up int he example
* update registry, add nextjs docs
* add more usage examples
* Minor changes on the realtime chat component.
* Regenerate the registry.
* docs
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
* Update usage sections
* Small style tweaks
* Update docs, tan capital S stack everywhere
* Fix the colors of the linkedcard.
* MInor fixes for all doc pages.
* Updates
* Spacing
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
* Change the destinations for next auth routes.
* Change the folder definition to /auth.
* Fix wrong docs.
* More fixes.
* Fix the redirect url to include the base path.
* Minor fixes to the other auth blocks.
* Fix example URLs. Remove some extra code.
* Minor fixes for the avatar stack demo.
* More fixes.
* Fix the v0 button. Add some more docs. (+13 squashed commits)
Squashed commits:
[cc5954779e] Add success state to the forgot-password form.
[258bfb1015] Simplify the tanstack auth block.
[1ba5c223d9] Add missing pages to the nextjs auth.
[b842e4acec] Fix the env vars in the React client.
[2a2bcc5356] Fix the command URL.
[a26a2d36c2] Add a tanstack block for password-based auth.
[d68881f0d5] Fix the tanstack client.
[1fd2e16d96] Add missing deps to satisfy TS build.
[9797d745df] Various fixes.
[3e9b676e99] Fix the registryBlock component.
[540a5d600b] Set the supabase project for testing.
[3eba892c92] Regenerate the llms.txt file.
[bf526a0ecb] Regenerate the registry files.
* Add current user avatar.
* Add RealtimeAvatarStack.
* Use the fields which are populated by Auth.
* Regenerate the registry files.
* Fix the imports.
* Rebuild the registry files. Add a github login to the supabase config.
* Minor fixes for the components.
* Minor fix to the avatar stack.
* Remove peekCode, show showCode prop to component preview.
* Add examples for avatar stack and current user avatar.
* Use the new generatenames function in the cursors.
* Add documentation for avatar stack and avatar.
* Switch the profile images.
* Fix a type error.
* More fixes.
* init
* Update component-preview.tsx
* please note: changed redirects in block, so need to update the logic to find and replace the redirects
* Fix the redirect urls to work when installing and in examples.
* Revert some of the changes.
* Add a step when building the registry to clean the registry of example code.
* Fix the clean registry script.
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
* Add faq sections
* Update the faq.
* Minor updates to the client and auth guides.
* Add missing pages to the sidebar.
* Rename the React category to React SPA.
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
* Regenerate the registry files.
* Regenerate the llms.txt file.
* Set the supabase project for testing.
* Fix the registryBlock component.
* Various fixes.
* Add missing deps to satisfy TS build.
* Fix the tanstack client.
* Add a tanstack block for password-based auth.
* Fix the command URL.
* Fix the env vars in the React client.
* Add missing pages to the nextjs auth.
* Simplify the tanstack auth block.
* Add success state to the forgot-password form.
* Fix the v0 button. Add some more docs.
* Revert some changes.
* Copy the design-system app into a new one for ui-library.
* Remove unneeded content.
* Add supabase config.
* Cleanup the css.
* Add bunch of packages.
* Cleanup the registry.
* Regenerate the registry.
* Add needed components for documenting components.
* Add the pages for the components.
* Fix the RegistryBlock.
* Various fixes.
* Add a turbo definition for ui-library.
* Rename Remix to React Router.
* Reorder the pages for all frameworks.
* Remove the bottom pager.
* Fix the pages and command menu.
* Various fixes.
* Minor fixes.
* Add ai editor rules.
* Various fixes.
* Add local supabase env vars.
* Try to fix a package error.
* Bunch of various fixes.
* Fix lint errors.
