用户管理

View, delete, and export user information.

你可以在仪表板的用户页面查看你的用户。你也可以在表格编辑器查看 Auth 模式的内容。

🌐 You can view your users on the Users page of the Dashboard. You can also view the contents of the Auth schema in the Table Editor.

通过 API 访问用户数据 #

🌐 Accessing user data via API

出于安全考虑，Auth 模式在自动生成的 API 中不会被暴露。如果你想通过 API 访问用户数据，可以在 public 模式下创建你自己的用户表。

🌐 For security, the Auth schema is not exposed in the auto-generated API. If you want to access users data via the API, you can create your own user tables in the public schema.

确保通过启用行级别安全来保护表格，并且只授予每个角色必要的权限。参考 auth.users 表以确保数据完整性。在引用中指定 on delete cascade。例如，一个 public.profiles 表可能看起来像这样：

🌐 Make sure to protect the table by enabling Row Level Security and only granting the necessary privileges for each role. Reference the auth.users table to ensure data integrity. Specify on delete cascade in the reference. For example, a public.profiles table might look like this:

1
create table public.profiles (
2
  id uuid not null references auth.users on delete cascade,
3
  first_name text,
4
  last_name text,
5
6
  primary key (id)
7
);
8
9
-- Grant the privileges the roles need
10
GRANT SELECT ON public.profiles TO anon;
11
GRANT SELECT, INSERT, UPDATE, DELETE ON public.profiles TO authenticated;
12
GRANT SELECT, INSERT, UPDATE, DELETE ON public.profiles TO service_role;
13
14
-- Enable row level security for the table
15
alter table public.profiles enable row level security;

只在像 auth.users 这样的由 Supabase 管理的 schema 和表中，把主键作为外键引用使用。Postgres 允许你为由唯一索引支持的列指定外键引用（不一定是主键）。

🌐 Only use primary keys as foreign key references for schemas and tables like auth.users which are managed by Supabase. Postgres lets you specify a foreign key reference for columns backed by a unique index (not necessarily primary keys).

主键是保证不会改变的。由 Supabase 管理的列、索引、约束或其他数据库对象可能随时更改，所以在直接引用它们时要小心。

🌐 Primary keys are guaranteed not to change. Columns, indices, constraints or other database objects managed by Supabase may change at any time and you should be careful when referencing them directly.

要在每次用户注册时更新你的 public.profiles 表，设置一个触发器。如果触发器失败，可能会阻止注册，所以一定要彻底测试你的代码。

🌐 To update your public.profiles table every time a user signs up, set up a trigger. If the trigger fails, it could block signups, so test your code thoroughly.

1
-- inserts a row into public.profiles
2
create function public.handle_new_user()
3
returns trigger
4
language plpgsql
5
security definer set search_path = ''
6
as $$
7
begin
8
  insert into public.profiles (id, first_name, last_name)
9
  values (new.id, new.raw_user_meta_data ->> 'first_name', new.raw_user_meta_data ->> 'last_name');
10
  return new;
11
end;
12
$$;
13
14
-- trigger the function every time a user is created
15
create trigger on_auth_user_created
16
  after insert on auth.users
17
  for each row execute procedure public.handle_new_user();

添加和获取用户元数据 #

🌐 Adding and retrieving user metadata

你可以在用户注册时分配元数据：

🌐 You can assign metadata to users on sign up:

1
import { createClient } from '@supabase/supabase-js'
2
const supabase = createClient(process.env.SUPABASE_URL!, process.env.SUPABASE_KEY!)
3
4
// ---cut---
5
const { data, error } = await supabase.auth.signUp({
6
  email: 'valid.email@supabase.io',
7
  password: 'example-password',
8
  options: {
9
    data: {
10
      first_name: 'John',
11
      age: 27,
12
    },
13
  },
14
})

用户元数据存储在 auth.users 表的 raw_user_meta_data 列中。要查看元数据：

🌐 User metadata is stored on the raw_user_meta_data column of the auth.users table. To view the metadata:

1
import { createClient } from '@supabase/supabase-js'
2
const supabase = createClient(process.env.SUPABASE_URL!, process.env.SUPABASE_KEY!)
3
4
// ---cut---
5
const {
6
  data: { user },
7
} = await supabase.auth.getUser()
8
let metadata = user?.user_metadata

删除用户 #

🌐 Deleting users

你可以直接删除用户，也可以通过管理控制台在认证 > 用户中删除。请注意，从 auth.users 表中删除用户并不会自动让用户登出。由于 Supabase 使用 JSON Web Token（JWT），用户的 JWT 在过期之前仍然是“有效”的。

🌐 You may delete users directly or via the management console at Authentication > Users. Note that deleting a user from the auth.users table does not automatically sign out a user. As Supabase makes use of JSON Web Tokens (JWT), a user's JWT will remain "valid" until it has expired.

如果用户是 Supabase Storage 中任何对象的拥有者，你不能删除他们。

🌐 You cannot delete a user if they are the owner of any objects in Supabase Storage.

当你尝试删除拥有任何存储对象的认证用户时，会遇到错误。如果发生这种情况，试着删除该用户的所有对象，或者将所有权转给其他用户。

🌐 You will encounter an error when you try to delete an Auth user that owns any Storage objects. If this happens, try deleting all the objects for that user, or reassign ownership to another user.

移除账户访问 #

🌐 Removing account access

当目的是移除一个账户，使其无法再访问你的应用时，可以使用 auth.admin.deleteUser() 删除认证用户。使用默认的 shouldSoftDelete: false，这会从 auth.users 中删除该行，并级联到 auth.sessions，使用户的刷新令牌失效——所以这个账户就无法再生成新的访问令牌了。

🌐 When the goal is to remove an account so it can no longer access your app, delete the auth user with auth.admin.deleteUser(). With the default shouldSoftDelete: false, this removes the row from auth.users, which cascades to auth.sessions and invalidates the user's refresh tokens — so the account can no longer mint new access tokens.

有几件事不能代替删除用户：

🌐 A few things are not a substitute for deleting the user:

临时封禁只会在其有效期内阻止登录，并不会撤销已有的会话。
仅在你自己的应用表中将账户标记为已删除，auth.users 行仍然存在，所以它仍然可以进行身份验证和刷新。

删除用户仍然无法追溯使已发放的访问令牌失效。Supabase 的访问令牌是无状态的 JWT，所以用户手里的令牌在它的 exp 声明过期之前一直有效，在此期间账户仍然可以调用 API。你有两种方法来处理这个时间窗口：

🌐 Deleting the user still cannot retroactively invalidate an access token that was already issued. Supabase access tokens are stateless JWTs, so a token already in the user's hands stays valid until its exp claim passes, and during that window the account can still call the API. You have two ways to handle this window:

限制它： 保持访问令牌 (JWT) 的有效期短，这样在你删除用户后，任何未使用的令牌很快就会过期。
对敏感操作关闭它： 在这些操作上，将 session_id 声明与 auth.sessions 表进行验证。因为删除用户会移除会话行，未处理的令牌会在这个检查中失败——但只在你执行检查的请求上；其他 API 调用仍然会接受该令牌，直到 exp。

详细信息请参见用户会话。

🌐 See User sessions for details.

导出用户 #

🌐 Exporting users

由于 Supabase 是建立在 Postgres 之上的，你可以通过 SQL Editor 标签查询 auth.users 和 auth.identities 表来提取所有用户：

🌐 As Supabase is built on top of Postgres, you can query the auth.users and auth.identities table via the SQL Editor tab to extract all users:

1
select * from auth.users;

然后你就可以把结果导出成 CSV 文件了。

🌐 You can then export the results as CSV.