Supabase Next.js Starter
The minimum correct setup for Supabase auth in the App Router
Supabase's official Next.js starter is small on purpose. It gets cookie based server side auth right across middleware, server components and route handlers, which is the part everyone implements incorrectly the first time, and stops there.
Why the small scope is the point
Server side auth in the App Router has a narrow correct answer. The session has to be refreshed in middleware, the cookie handling has to be consistent between the browser and server clients, and getting either wrong produces bugs that only appear on a slow connection.
This starter is the working version of that. Reading it once is worth more than several attempts at assembling it from documentation.
What you add yourself
Everything else. No billing, no teams, no admin. It is a correct foundation rather than a product, which is the right shape when you want Supabase specifically and intend to make your own decisions above it.
Row level security is the piece to take seriously next. A Supabase project without considered policies is a public database, and no starter can decide those rules for you.
Reach for it when
- you have already chosen Supabase and want the auth wiring correct
- you want a foundation rather than a finished product
- you intend to make your own decisions above the database
Watch out for
- no billing, teams or admin, this is auth and nothing more
- row level security is your responsibility and is where the real risk lives
- the hosted service has a free tier that pauses inactive projects
Compare with these
- Starter kitsFree
create-t3-app
A typesafe Next.js starter that adds nothing you did not ask for
- nextjs
- typescript
- trpc
MITRead - Starter kitsFree
Next.js SaaS Starter
Auth, teams and Stripe subscriptions, maintained by Vercel
- nextjs
- stripe
- postgres
MITRead - Starter kitsFree
Open SaaS
A complete, genuinely free SaaS template with an admin dashboard
- wasp
- react
- stripe
MITRead