Sign up a new user and sign in with email and password via the Supabase Auth REST API, obtaining an access token and refresh token for subsequent authenticated requests.

Documented steps

1. Get your project's API key from Project Settings > API Keys. New projects use a publishable key (prefix sb_publishable_...); older projects use the legacy anon JWT. Publishable/secret keys must be sent in the apikey header, not as an Authorization: Bearer token (unless the Bearer value exactly equals the apikey value); legacy anon/service_role JWTs still work as Bearer tokens too.
2. Sign up: POST https://<project-ref>.supabase.co/auth/v1/signup with headers apikey: <publishable_or_anon_key>, Content-Type: application/json, and body {"email":"user@example.com","password":"a-strong-password"}. Optionally include "data" (custom user_metadata) and "options.emailRedirectTo".
3. If email confirmations are enabled (the default), the signup response returns a user object with no session until the user clicks the confirmation link; if confirmations are disabled, the response includes an immediate session.
4. Sign in: POST https://<project-ref>.supabase.co/auth/v1/token?grant_type=password with the same apikey header, Content-Type: application/json, and body {"email":"user@example.com","password":"a-strong-password"}.
5. A 200 response returns {"access_token":..., "refresh_token":..., "expires_in":3600, "token_type":"bearer", "user": {...}}. The default access token lifetime is 1 hour.
6. Use the access token for authenticated calls by sending both headers: apikey: <publishable_or_anon_key> and Authorization: Bearer <access_token> (e.g. GET /auth/v1/user to fetch the logged-in user, or calls to PostgREST at /rest/v1/...).
7. Docs: https://supabase.com/docs/reference/javascript/auth-signup https://supabase.com/docs/reference/self-hosting-auth/authenticate-a-user https://supabase.com/docs/guides/getting-started/migrating-to-new-api-keys