Supabase Auth in production practice

Create the Supabase project and configure `Site URL` plus callback URLs first.

Run the migration so profile, subscription, and learning tables plus policies exist.

Separate browser and server clients instead of mixing them.

Let middleware handle session refresh only.

Use the callback route to exchange verification or OAuth responses into a real session.

Fix redirect URLs before testing login, or you will waste time on the wrong failure.

After sign-in, verify not just the page text but whether user-scoped database access works.

If login works but data queries fail, inspect RLS and server sessions before blaming the frontend.

Using anon keys for server-side management work.

A working callback route paired with wrong Site URL or Redirect URLs.

Putting too much business logic in middleware.

Testing sign-in only and forgetting sign-out, refresh, email verification, and guest access.