{
  "slug": "supabase-auth-configuration-supports-passkeys-and-webauthn-4c8d998d9570",
  "title": "Supabase Auth configuration supports passkeys and WebAuthn",
  "tools": [
    "supabase"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-04-27T08:06:23.000Z",
  "announced_at": "2026-04-27T08:06:23.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When enabling passkey authentication, add `[auth.passkey]` and `[auth.webauthn]` to `supabase/config.toml`; set `enabled = true` and provide the relying-party display name, ID, and origins.",
    "examples": [
      "[auth.passkey]\nenabled = true\n\n[auth.webauthn]\nrp_display_name = \"<app name>\"\nrp_id = \"<bare domain, e.g. example.com>\"\nrp_origins = [\"<https://app.example.com>\"]"
    ],
    "gotchas": [
      "Version: v2.95.4",
      "auth.passkey.enabled (required): Enable passkey sign-in and registration; requires `auth.webauthn` configuration.",
      "auth.webauthn.rp_display_name (required): Human-readable relying-party name shown during passkey ceremonies.",
      "auth.webauthn.rp_id (required): Relying-party identifier; must be a registrable suffix of every configured origin.",
      "auth.webauthn.rp_origins (required): List of app origins allowed for WebAuthn ceremonies.",
      "Prerequisite: Include `[auth.webauthn]` with all three relying-party values when `auth.passkey.enabled` is true.",
      "Prerequisite: Origins must use HTTPS except loopback addresses; each origin hostname must match or be a subdomain of the relying-party ID. Up to five origins are allowed."
    ]
  },
  "why_it_matters": "Configure passkeys and WebAuthn for a Supabase Auth project.",
  "sources": [
    "https://github.com/supabase/cli/releases/tag/v2.95.4",
    "https://supabase.com/docs/guides/auth/passkeys",
    "https://supabase.com/docs/guides/local-development/cli/config"
  ],
  "rank": 0.97026,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v1+judge-v2x3-rejudge+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "backfill-20261007",
    "verdict_id": "backfill-20261007:backfill-20261007-736210749366c188-0:rescue",
    "evidence_hash": "8b06ce8c8f9e9c23b8b50ea27daf64f1abb09d698a3214a8efccdeba4987f3e0"
  },
  "review": {
    "draft_hash": "91e7a52eb1089979abbe64b87830af8063be142ed18a5716a595c07b46869def",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "backfill-20261007:rescue",
    "reason": "Rescue path: first rejected only because the extracted card lacked usage; judged again on the enriched card, 3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.97 >= 0.9; 2 needed) and Jev gave 0.73 (>= 0.6 needed)."
  }
}