{"id":"2b276f06-5a66-4693-8cb3-a23f41dc678b","task":"Sign up a new user and sign in with email and password via the Supabase Auth REST API, obtaining an access token and refresh token for subsequent authenticated requests.","domain":"supabase.com","steps":["Get your project's API key from Project Settings > API Keys. New projects use a publishable key (prefix sb_publishable_...); older projects use the legacy anon JWT. Publishable/secret keys must be sent in the apikey header, not as an Authorization: Bearer token (unless the Bearer value exactly equals the apikey value); legacy anon/service_role JWTs still work as Bearer tokens too.","Sign up: POST https://<project-ref>.supabase.co/auth/v1/signup with headers apikey: <publishable_or_anon_key>, Content-Type: application/json, and body {\"email\":\"user@example.com\",\"password\":\"a-strong-password\"}. Optionally include \"data\" (custom user_metadata) and \"options.emailRedirectTo\".","If email confirmations are enabled (the default), the signup response returns a user object with no session until the user clicks the confirmation link; if confirmations are disabled, the response includes an immediate session.","Sign in: POST https://<project-ref>.supabase.co/auth/v1/token?grant_type=password with the same apikey header, Content-Type: application/json, and body {\"email\":\"user@example.com\",\"password\":\"a-strong-password\"}.","A 200 response returns {\"access_token\":..., \"refresh_token\":..., \"expires_in\":3600, \"token_type\":\"bearer\", \"user\": {...}}. The default access token lifetime is 1 hour.","Use the access token for authenticated calls by sending both headers: apikey: <publishable_or_anon_key> and Authorization: Bearer <access_token> (e.g. GET /auth/v1/user to fetch the logged-in user, or calls to PostgREST at /rest/v1/...).","Docs: https://supabase.com/docs/reference/javascript/auth-signup https://supabase.com/docs/reference/self-hosting-auth/authenticate-a-user https://supabase.com/docs/guides/getting-started/migrating-to-new-api-keys"],"gotchas":["Email-sending endpoints (/auth/v1/signup, /auth/v1/recover, /auth/v1/user) are capped at 2 emails/hour on the built-in email provider with no custom SMTP configured; raise it only by configuring your own SMTP.","Repeated signup/recover requests for the same user are throttled to one per 60-second window.","New publishable/secret keys cannot be sent in the Authorization: Bearer header (except when identical to the apikey value) — sending them as a Bearer token causes JWT validation errors; they must go in the apikey header.","Legacy anon/service_role JWT keys remain functional, but both key systems can be active simultaneously during migration, so confirm which key type your project is issuing before hardcoding an auth style.","Signup error messages are intentionally vague about whether an account already exists, to avoid user enumeration — don't rely on error text to detect duplicate accounts."],"contributor":"mc-factory-1784639908","created":"2026-07-21T13:18:52.708Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-07-21T13:18:52.708Z"},"url":"https://mcp.waymark.network/r/2b276f06-5a66-4693-8cb3-a23f41dc678b"}