You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* Experimental: We've also heard from the community that Supabase's newly released [support for external auth providers works](https://supabase.com/blog/third-party-auth-mfa-phone-send-hooks), but we don't have any examples for this yet.
19
27
20
-
To implement either **Supabase Auth** or **Anonymous Sign-Ins**, enable the "Use Supabase Auth" setting on the PowerSync instance, and provide your Supabase JWT Secret. Internally, this setting allows PowerSync to verify and use Supabase JWTs directly using HS256 and the provided secret.
28
+
## Enabling Supabase Auth
29
+
30
+
To implement either **Supabase Auth** or **Anonymous Sign-Ins**, enable the relevant setting on the PowerSync instance, and provide your Supabase JWT Secret. Internally, this setting allows PowerSync to verify and use Supabase JWTs directly using HS256 and the provided secret.
31
+
32
+
### PowerSync Cloud instances:
33
+
34
+
1. In the PowerSync Dashboard, right-click on your instance to edit it.
35
+
36
+
2. Under the **"Client Auth"** tab, enable **"Use Supabase Auth"** and enter your Supabase **JWT Secret**:<Framecaption="PowerSync uses the secret to verify Supabase's JWTs.">
37
+
38
+
</Frame>
39
+
40
+
3. Click **"Save and deploy"** to deploy the updates to your instance.
41
+
42
+
### Self-hosted instances:
43
+
44
+
This can be enabled via your [`config.yaml`](/self-hosting/installation/powersync-service-setup):
45
+
46
+
```yaml
47
+
48
+
client\_auth:
49
+
  *# Enable this if using Supabase Auth*
50
+
  supabase: true
51
+
  supabase\_jwt\_secret: your-jwt-secret
52
+
53
+
```
54
+
55
+
## Rotating the JWT Secret
21
56
22
-
Enabling Supabase Auth is also [covered in the Supabase & PowerSync integration guide](/integration-guides/supabase-+-powersync#configuring-powersync).
57
+
If you encounter authroziation errors, you may need to regenrate the JWT Secret. A common cause of this are Supabase projects that are restarted after being paused.
23
58
24
59
To rotate the secret, generate a new secret in the your Supabase project's API Settings:
The Supabase user UUID will be available as `request.user_id()` in Sync Rules. To use a different identifier as the user ID in sync rules (for example user email), use [Custom authentication](/installation/authentication-setup/custom).
65
+
The Supabase user UUID will be available as `request.user_id()` in [Sync Rules](/usage/sync-rules). To use a different identifier as the user ID in sync rules (for example user email), use [Custom authentication](/installation/authentication-setup/custom).
Copy file name to clipboardExpand all lines: self-hosting/installation/client-side-setup.mdx
+24-14Lines changed: 24 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,16 +5,21 @@ title: "Client-Side Setup"
5
5
We recommend splitting up your client-side implementation into four phases:
6
6
7
7
<CardGroup>
8
-
<Cardtitle="Generate development token"icon="key"href="/self-hosting/installation/client-side-setup#1-generate-development-token"horizontal/> <Cardtitle="Run Diagnostics app"icon="bug"href="/self-hosting/installation/client-side-setup#2-run-the-diagnostics-app-using-a-development-token"horizontal/>
9
-
<Cardtitle="Use client SDK with token"icon="code"href="/self-hosting/installation/client-side-setup#3-use-the-client-sdk-with-development-token"horizontal/>
The recommended approach is to initially use a short-lived development token and then wire up production auth at a later stage.
16
20
17
21
1. Generate a temporary private/public key-pair (RS256) or shared key (HS256) for JWT signing and verification.
22
+
18
23
2. Add the key to your PowerSync Service configuration file, e.g.:
19
24
20
25
```yaml
@@ -31,10 +36,14 @@ client_auth:
31
36
```
32
37
33
38
1. Generate a signed JWT. We have two options to get you started:
39
+
34
40
1. If you have a `.yaml` configuration file and HS256 key, we recommending using the `generate-token` script from the Test Client in the [powersync-service repo](https://github.com/powersync-ja/powersync-service/tree/main/test-client), as described here [Self-hosted Setup / Local Development](/installation/authentication-setup/development-tokens#self-hosted-setup-local-development). You need to clone this repo to use this option.
41
+
35
42
2. Alternatively:
36
-
1. Save the private key into a `.env` file.
37
-
2. Generate a JWT, loading the `.env` file and inputting a user UUID. See example script:
43
+
44
+
1. Save the private key into a `.env` file.
45
+
46
+
2. Generate a JWT, loading the `.env` file and inputting a user UUID. See example script:
38
47
39
48
```js
40
49
import * as jose from 'jose';
@@ -63,7 +72,7 @@ const token = await new jose.SignJWT({})
63
72
console.log(token);
64
73
```
65
74
66
-
## 2\. Run the Diagnostics app using a development token
75
+
## 2. Run the Diagnostics app using a development token
67
76
68
77
With the [Diagnostics web app](https://github.com/powersync-ja/powersync-js/tree/main/tools/diagnostics-app) you can quickly inspect a user's local database. By using this you can confirm that the PowerSync Service configuration and sync rules behave as expected without needing to set up authentication or app UI.
69
78
@@ -78,18 +87,18 @@ Enter the generated token into the app's sign in screen.
78
87
Enter your PowerSync Service endpoint (see the port number specified in your config file e.g. `http://localhost:8080`).
79
88
80
89
<Info>
81
-
**Checkpoint:**
90
+
**Checkpoint:**
82
91
83
-
Inspect your global bucket and synced table (from the [PowerSync Service Setup](/self-hosting/installation/powersync-service-setup) section) in the diagnostics app — these should match the sync rules you [defined previously](/self-hosting/installation/powersync-service-setup#1.sync-rules).
92
+
Inspect your global bucket and synced table (from the [PowerSync Service Setup](/self-hosting/installation/powersync-service-setup) section) in the diagnostics app — these should match the sync rules you [defined previously](/self-hosting/installation/powersync-service-setup#1.sync-rules).
84
93
</Info>
85
94
86
-
## 3\. Use the Client SDK with a development token
95
+
## 3. Use the Client SDK with a development token
87
96
88
97
Install the PowerSync client SDK in your app. Refer to the client-side installation instructions here: [Client-Side Setup](/installation/client-side-setup)
89
98
90
99
Hardcode the development token you generated above in the `fetchCredentials` method, which you'll implement as part of [Integrate with your Backend](/installation/client-side-setup/integrating-with-your-backend)
91
100
92
-
## 4\. Implement authentication
101
+
## 4. Implement authentication
93
102
94
103
Read about how authentication works in PowerSync here: [Authentication Setup](/installation/authentication-setup)
95
104
@@ -105,7 +114,7 @@ Under `client_auth` in your config file, enable Supabase authentication:
105
114
client_auth:
106
115
# Enable this if using Supabase Auth
107
116
supabase: true
108
-
supabase_jwt_secret: [secret]
117
+
supabase_jwt_secret: your-secret
109
118
```
110
119
111
120
For more details, see [Supabase Auth](/installation/authentication-setup/supabase-auth).
@@ -115,6 +124,7 @@ For more details, see [Supabase Auth](/installation/authentication-setup/supabas
115
124
Under `client_auth` in your config file, add your Firebase JWKS URI and audience.
Copy file name to clipboardExpand all lines: self-hosting/installation/powersync-service-setup.mdx
+26-31Lines changed: 26 additions & 31 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,9 +8,13 @@ After configuring your Postgres database for PowerSync, you'll setup your [Power
8
8
This entails:
9
9
10
10
1. Configuring MongoDB (if required)
11
+
11
12
2. Defining your PowerSync config
13
+
12
14
1. Defining connections to Postgres and MongoDB
15
+
13
16
2. Defining your [Sync Rules](/usage/sync-rules)
17
+
14
18
3. Defining your auth method
15
19
16
20
Examples of the above can be found in our demo application [here](https://github.com/powersync-ja/self-host-demo/tree/main/config). Below we go through these in more detail.
If you are rolling your own Docker environment, you can include this init script in your docker-compose file to configure a replica set as once-off operation:
35
+
31
36
```yaml
32
37
# Initializes the MongoDB replica set. This service will not usually be actively running
33
38
mongo-rs-init:
@@ -46,26 +51,20 @@ If you are rolling your own Docker environment, you can include this init script
46
51
The PowerSync Service is configured using key/value pairs in a config file, and supports the following configuration methods:
47
52
48
53
1. Inject config as an environment variable (which contains the base64 encoding of a config file)
54
+
49
55
2. Use a config file mounted on a volume
56
+
50
57
3. Specify the config as a command line parameter (again base64 encoded)
51
58
52
59
Both YAML and JSON config files are supported, and you can see examples of the above configuration methods in our demo app's [docker-compose](https://github.com/powersync-ja/self-host-demo/blob/d61cea4f1e0cc860599e897909f11fb54420c3e6/docker-compose.yaml#L46) file.
53
60
54
61
A detailed `config.yaml` example with additional comments can be found here:
55
-
<Card
56
-
title="self-host-demo/config/powersync.yaml at main · powersync-ja/self-host-demoGitHub"
<Card title="self-host-demo/config/powersync.yaml at main · powersync-ja/self-host-demoGitHub" icon="github" href="https://github.com/powersync-ja/self-host-demo/blob/main/config/powersync.yaml" horizontal />
61
64
62
65
The config file schema is also available here:
63
-
<Card
64
-
title="self-host-demo/schema/schema.json at main · powersync-ja/self-host-demoGitHub"
<Card title="self-host-demo/schema/schema.json at main · powersync-ja/self-host-demoGitHub" icon="github" href="https://github.com/powersync-ja/self-host-demo/blob/main/schema/schema.json" horizontal />
69
68
70
69
Below is a skeleton config file that you can copy/paste and edit locally:
71
70
@@ -113,7 +112,7 @@ sync_rules:
113
112
client_auth:
114
113
# Enable this if using Supabase Auth
115
114
# supabase: true
116
-
# supabase_jwt_secret: [secret]
115
+
# supabase_jwt_secret: your-secret
117
116
118
117
# JWKS URIs can be specified here.
119
118
jwks_uri: http://demo-backend:6060/api/auth/keys
@@ -132,11 +131,11 @@ client_auth:
132
131
Specify the connection to Postgres in the `replication` section. Retrieving your database connection string / individual parameters differs by database hosting provider. See [Database Connection](/self-hosting/appendix/database-connection) for further details.
133
132
134
133
<Info>
135
-
If you are using hosted Supabase, you will need to enable IPv6 for Docker as per [https://docs.docker.com/config/daemon/ipv6/](https://docs.docker.com/config/daemon/ipv6/)
134
+
If you are using hosted Supabase, you will need to enable IPv6 for Docker as per [https://docs.docker.com/config/daemon/ipv6/](https://docs.docker.com/config/daemon/ipv6/)
136
135
137
-
If your host OS does not support Docker IPv6 e.g. macOS, you will need to run Supabase locally.
136
+
If your host OS does not support Docker IPv6 e.g. macOS, you will need to run Supabase locally.
138
137
139
-
This is because Supabase only allows direct database connections over IPv6 — PowerSync cannot connect using the connection pooler.
138
+
This is because Supabase only allows direct database connections over IPv6 — PowerSync cannot connect using the connection pooler.
140
139
</Info>
141
140
142
141
Specify the connection to MongoDB in the `storage` section.
@@ -150,12 +149,8 @@ Using `!env [variable name]` will substitute the value of the environment variab
150
149
Only environment variables with names starting with `PS_` can be substituted.
151
150
152
151
See examples here:
153
-
<Card
154
-
title="self-host-demo/config/powersync.yaml at main · powersync-ja/self-host-demoGitHub"
<Card title="self-host-demo/config/powersync.yaml at main · powersync-ja/self-host-demoGitHub" icon="github" href="https://github.com/powersync-ja/self-host-demo/blob/main/config/powersync.yaml" horizontal />
159
154
160
155
### Sync Rules
161
156
@@ -195,15 +190,15 @@ For more information about sync rules see:
195
190
[Sync Rules](/usage/sync-rules)
196
191
197
192
<Info>
198
-
**Checkpoint**
193
+
**Checkpoint**
199
194
200
-
To verify that your sync rules are functioning correctly, inspect the contents of your sync bucket in MongoDB.
195
+
To verify that your sync rules are functioning correctly, inspect the contents of your sync bucket in MongoDB.
201
196
202
-
If you are running MongoDB in Docker, run the following:
197
+
If you are running MongoDB in Docker, run the following:
1. Copy the database connection details from Supabase:<Framecaption="It is important to uncheck this checkbox">
2
+
<imgsrc="/images/integration-3.png" />
3
+
</Frame>
1
4
2
-
1. Copy the database connection details from Supabase:
3
-
* In your Supabase dashboard, navigate to **"Project Settings"**\-> **"Database" -> "Connection string**" and select the "URI" tab.
4
-
* Uncheck the "**Display connection pooler**" checkbox. PowerSync needs to connect to the database directly and cannot use the pooler.
5
-
<Framecaption="It is important to uncheck this checkbox">
6
-
<imgsrc="/images/integration-3.png"/>
7
-
</Frame>
8
5
* Copy the connection string. The hostname should be `db.<PROJECT-ID>.supabase.co`, and not, for example, `aws-0-us-west-1.pooler.supabase.com`.
6
+
9
7
* Paste this URI in PowerSync instance **URI** field.
8
+
10
9
* Enter the **Password** for the `postgres` user in your Supabase database.
11
-
* Supabase also [refers to this password](https://supabase.com/docs/guides/database/managing-passwords) as the _database password_ or _project password_.
10
+
11
+
* Supabase also [refers to this password](https://supabase.com/docs/guides/database/managing-passwords) as the *database password* or *project password*.
12
+
12
13
* PowerSync has the Supabase CA certificate pre-configured — `verify-full` SSL mode can be used directly, without any custom certificates.
14
+
15
+
- In your Supabase dashboard, navigate to **"Project Settings"** -> **"Database" -> "Connection string**" and select the "URI" tab.
16
+
17
+
- Uncheck the "**Display connection pooler**" checkbox. PowerSync needs to connect to the database directly and cannot use the pooler.
18
+
13
19
2. Click **"Test Connection"** and fix any errors.
14
-
3. Under the **"Client Auth"** tab, enable **"Use Supabase Auth"** and enter your Supabase **JWT Secret**:
15
-
<Framecaption="PowerSync uses the secret to verify Supabase's JWTs.">
3. Under the **"Client Auth"** tab, enable **"Use Supabase Auth"** and enter your Supabase **JWT Secret**:<Framecaption="PowerSync uses the secret to verify Supabase's JWTs.">
22
+
23
+
</Frame>
24
+
25
+
4. Click **"Save and deploy"** to deploy the updates to your instance.
19
26
20
27
PowerSync deploys and configures an isolated cloud environment for you, which will take a few minutes to complete.
0 commit comments