# Supabase Auth Verification Checklist

## Environment

- `NEXT_PUBLIC_SUPABASE_URL` is set
- `NEXT_PUBLIC_SUPABASE_ANON_KEY` is set
- `SUPABASE_SERVICE_ROLE_KEY` is set
- `NEXT_PUBLIC_SITE_URL` matches the local or deployed site

## Dashboard

- Site URL is correct
- Redirect URL includes `/auth/callback`
- Email/password auth is enabled

## Database

- `202603080001_init.sql` was executed
- `profiles` exists
- `lesson_progress` exists
- `saved_cards` exists
- `subscriptions` exists
- RLS is enabled on user-scoped tables

## Flow

- Sign up succeeds
- Verification email arrives
- Clicking the email returns to `/auth/callback`
- The callback exchanges code for session
- The user lands in `/dashboard`

## Data Isolation

- Signed-in users can see their own progress
- Guests do not see signed-in user data
- Signed-in users do not read another user's rows