Perform admin user management (create, list, and delete users) against the Supabase Auth admin REST endpoints using a server-side secret/service_role key, bypassing normal signup flows and Row Level Security.

Documented steps

1. Get the secret key from Project Settings > API Keys (prefix sb_secret_...) or the legacy service_role JWT. This key bypasses Row Level Security and must only be used server-side; using it from a browser returns HTTP 401.
2. Create a user: POST https://<project-ref>.supabase.co/auth/v1/admin/users with headers apikey: <secret_key>, Authorization: Bearer <secret_key>, Content-Type: application/json, and body such as {"email":"user@example.com","password":"a-strong-password","email_confirm":true,"user_metadata":{"name":"Yoda"}}.
3. List all users: GET https://<project-ref>.supabase.co/auth/v1/admin/users with the same apikey and Authorization: Bearer <secret_key> headers. The response is a JSON object with an "aud" field and a "users" array of user objects (id, email, phone, app_metadata, user_metadata, identities, timestamps).
4. Fetch a single user: GET https://<project-ref>.supabase.co/auth/v1/admin/user/{user_id} with the same admin headers.
5. Delete a user: DELETE https://<project-ref>.supabase.co/auth/v1/admin/user/{user_id} with the same admin headers. A successful deletion returns HTTP 200 with an empty object {}; an invalid/missing user or bad credentials returns 401.
6. Update a user (e.g. ban, change role, reset password) uses PUT https://<project-ref>.supabase.co/auth/v1/admin/user/{user_id} with the same admin headers and a JSON body of the fields to change.
7. Docs: https://supabase.com/docs/reference/self-hosting-auth/introduction https://supabase.com/docs/reference/self-hosting-auth/list-all-users https://supabase.com/docs/reference/self-hosting-auth/removes-a-user https://supabase.com/docs/reference/javascript/auth-admin-createuser