# Supabase auth hardening checklist that keeps production sign-in safe

Production sign-in breaks in predictable places: an open redirect, an email link that lands on the wrong URL, a table that exposes rows to the wrong user, or a privileged key that shipped inside a client bundle. Hardening auth means closing those paths before launch, then proving each one with a test.

[Auth documentation](https://supabase.com/docs/guides/auth) describes authentication as verifying identity and authorization as verifying resource access, with JSON Web Tokens for the first and [row-level rules](https://supabase.com/docs/guides/database/postgres/row-level-security) for the second. Use that split as the hardening plan. Identity checks belong in the auth configuration. Data access belongs in the database, enforced on every request.

---

*This is an excerpt. Read the full post at [otf-kit.dev/blog/supabase-auth-production-hardening](https://otf-kit.dev/blog/supabase-auth-production-hardening) — full-stack kits your AI coding agent can actually ship to production. [Browse the kits →](https://otf-kit.dev)*