基于密码的认证

用户通常希望使用密码登录你的网站。Supabase Auth 可以帮助你安全地实现基于密码的认证，使用安全的配置选项以及存储和验证密码的最佳实践。

🌐 Users often expect to sign in to your site with a password. Supabase Auth helps you implement password-based auth safely, using secure configuration options and best practices for storing and verifying passwords.

用户可以使用他们的电子邮箱地址或电话号码将密码与身份关联。

🌐 Users can associate a password with their identity using their email address or a phone number.

通过电子邮件 #

🌐 With email

启用邮箱和密码登录 #

🌐 Enabling email and password-based authentication

电子邮件验证默认是开启的。

🌐 Email authentication is enabled by default.

你可以设置用户是否需要验证他们的邮箱才能登录。在托管的 Supabase 项目中，这默认是开启的。在自托管项目或本地开发中，则默认是关闭的。

🌐 You can configure whether users need to verify their email to sign in. On hosted Supabase projects, this is true by default. On self-hosted projects or in local development, this is false by default.

对于托管项目，请在认证提供商页面更改此设置，或对于自托管项目，请在配置文件中更改。

🌐 Change this setting on the Auth Providers page for hosted projects, or in the configuration file for self-hosted projects.

用邮箱和密码注册 #

🌐 Signing up with an email and password

电子邮件注册有两种可能的流程：隐式流程 和 PKCE 流程。如果你在使用 SSR，那么你用的是 PKCE 流程。如果你只用客户端代码，默认流程取决于客户端库。在 JavaScript 和 Dart 中默认是隐式流程，而在 Swift 中默认是 PKCE 流程。

🌐 There are two possible flows for email signup: implicit flow and PKCE flow. If you're using SSR, you're using the PKCE flow. If you're using client-only code, the default flow depends upon the client library. The implicit flow is the default in JavaScript and Dart, and the PKCE flow is the default in Swift.

本节中的说明假设电子邮件确认已启用。

🌐 The instructions in this section assume that email confirmations are enabled.

1
import { createClient } from '@supabase/supabase-js'
2
3
const supabase = createClient('https://your-project-id.supabase.co', 'sb_publishable_...')
4
5
// ---cut---
6
async function signUpNewUser() {
7
  const { data, error } = await supabase.auth.signUp({
8
    email: 'valid.email@supabase.io',
9
    password: 'example-password',
10
    options: {
11
      emailRedirectTo: 'https://example.com/welcome',
12
    },
13
  })
14
}

使用邮箱和密码登录 #

🌐 Signing in with an email and password

1
import { createClient } from '@supabase/supabase-js'
2
3
const supabase = createClient('https://your-project-id.supabase.co', 'sb_publishable_...')
4
5
// ---cut---
6
async function signInWithEmail() {
7
  const { data, error } = await supabase.auth.signInWithPassword({
8
    email: 'valid.email@supabase.io',
9
    password: 'example-password',
10
  })
11
}

重置密码 #

🌐 Resetting a password

1
import { createClient } from '@supabase/supabase-js'
2
3
const supabase = createClient('https://your-project-id.supabase.co', 'sb_publishable_...')
4
5
// ---cut---
6
await supabase.auth.resetPasswordForEmail('valid.email@supabase.io', {
7
  redirectTo: 'http://example.com/account/update-password',
8
})

1
import { createClient } from '@supabase/supabase-js'
2
3
const supabase = createClient('https://your-project-id.supabase.co', 'sb_publishable_...')
4
5
// ---cut---
6
await supabase.auth.updateUser({ password: 'new_password' })

正在验证当前密码 #

🌐 Verifying the current password

如果你的应用要求用户在设置新密码之前确认当前密码，你可以传递 current_password（在 supabase-js v2.102.0+ 和 supabase-kt 3.5.0+ 可用）:

🌐 If your app requires users to confirm their current password before setting a new one, you can pass current_password (available in supabase-js v2.102.0+ and supabase-kt 3.5.0+):

1
await supabase.auth.updateUser({
2
  password: 'new_password',
3
  current_password: 'old_password',
4
})

发送邮件 #

🌐 Email sending

注册确认和密码重置流程需要一个 SMTP 服务器来发送邮件。

🌐 The signup confirmation and password reset flows require an SMTP server to send emails.

Supabase 平台自带一个默认的邮件发送服务供你试用。该服务的发送频率限制为每小时 2 封邮件，且可用性是尽力而为的。对于生产环境使用，你应该考虑配置自定义的 SMTP 服务器。

查看自定义 SMTP 指南获取说明。

🌐 See the Custom SMTP guide for instructions.

使用 Mailpit 进行本地开发 #

🌐 Local development with Mailpit

你可以在本地机器上测试邮件流程。Supabase CLI 会自动通过 Mailpit 捕获本地发送的邮件。

🌐 You can test email flows on your local machine. The Supabase CLI automatically captures emails sent locally by using Mailpit.

在你的终端中，运行 supabase status 来获取 Mailpit 的网址。然后在浏览器中打开这个网址，并按照指示查找你的邮件。

🌐 In your terminal, run supabase status to get the Mailpit URL. Go to this URL in your browser, and follow the instructions to find your emails.

带手机 #

🌐 With phone

你可以在用户使用密码注册时，用他们的手机号作为标识，而不是邮箱地址。

🌐 You can use a user's mobile phone number as an identifier, instead of an email address, when they sign up with a password.

这种做法通常不被鼓励，因为手机网络会回收手机号码。任何获得回收号码的人都可能访问原用户的账户。为降低这种风险，实现多重身份验证。

🌐 This practice is usually discouraged because phone networks recycle mobile phone numbers. Anyone receiving a recycled phone number gets access to the original user's account. To mitigate this risk, implement MFA.

启用手机和密码认证 #

🌐 Enabling phone and password-based authentication

在托管的 Supabase 项目的 认证提供商页面 启用手机认证。

🌐 Enable phone authentication on the Auth Providers page for hosted Supabase projects.

对于自托管项目或本地开发，请使用 配置文件。请查看 auth.sms 下的配置变量。

🌐 For self-hosted projects or local development, use the configuration file. See the configuration variables namespaced under auth.sms.

如果你想让用户在注册时确认他们的电话号码，你需要设置一个短信服务提供商。每个提供商都有自己的配置。支持的提供商包括 MessageBird、Twilio、Vonage 和 TextLocal（社区支持）。

🌐 If you want users to confirm their phone number on signup, you need to set up an SMS provider. Each provider has its own configuration. Supported providers include MessageBird, Twilio, Vonage, and TextLocal (community-supported).

用手机号和密码注册 #

🌐 Signing up with a phone number and password

要注册用户，请使用他们的电话号码和密码调用 signUp()：

🌐 To sign up the user, call signUp() with their phone number and password:

1
import { createClient } from '@supabase/supabase-js'
2
3
const supabase = createClient('https://your-project-id.supabase.co', 'sb_publishable_...')
4
5
// ---cut---
6
const { data, error } = await supabase.auth.signUp({
7
  phone: '+13334445555',
8
  password: 'some-password',
9
})

如果你开启了手机验证，用户会收到一条包含6位数验证码的短信，你必须在60秒内验证这个验证码：

🌐 If you have phone verification turned on, the user receives an SMS with a 6-digit pin that you must verify within 60 seconds:

1
import { createClient } from '@supabase/supabase-js'
2
3
const supabase = createClient('https://your-project-id.supabase.co', 'sb_publishable_...')
4
5
// ---cut---
6
const {
7
  data: { session },
8
  error,
9
} = await supabase.auth.verifyOtp({
10
  phone: '+13334445555',
11
  token: '123456',
12
  type: 'sms',
13
})

使用电话号码和密码登录 #

🌐 Signing in a with a phone number and password

调用函数，用用户的手机号和密码登录：

🌐 Call the function to sign in with the user's phone number and password:

1
import { createClient } from '@supabase/supabase-js'
2
3
const supabase = createClient('https://your-project-id.supabase.co', 'sb_publishable_...')
4
5
// ---cut---
6
const { data, error } = await supabase.auth.signInWithPassword({
7
  phone: '+13334445555',
8
  password: 'some-password',
9
})