Understanding the impact of disabling signups

In this section, I’ll explain to you the potential benefits of disabling signups in your instance, even though, for implementing a signup, this might sound paradoxical.

The Supabase client has a publicly callable supabase.auth.signUp(..) function (https://supabase.com/docs/reference/javascript/auth-signup) that creates a Supabase user and sends a user a login link via the built-in mailing system. The function also returns the newly created user. “Publicly” here also means that anyone can call this method with the Anonymous Key – which is exposed via the frontend.

Now, you may be thinking: is creating a Supabase user enough to use our application? It’s not. Our application requires custom claims (see Chapter 6) to be set on the user’s app_metadata – which only admin powers can do. However, it’s not just that; our application also requires a service user and at least one tenant...