Adding JWT Authentication in ASP.NET Core With Supabase Auth

In this video, we'll explore Supabase Auth—a powerful and developer-friendly authentication platform—and seamlessly integrate it into your ASP.NET Core projects. I'll show you how to get Supabase Auth up and running quickly with clear, step-by-step instructions. We will obtain an access token and a refresh token. We will also configure an ASP.NET Core Web API to validate Supabase JWTs correctly. Whether you're a beginner or an experienced developer, this tutorial will give you the tools and knowledge you need to implement secure and user-friendly authentication in your ASP.NET Core projects.

Master Claims Transformation for Flexible ASP.NET Core Authorization

Join my weekly .NET newsletter:

Read my Blog here:

Chapters
0:00 What is Supabase Auth?
2:23 Creating a Supabase project
4:55 Getting a JWT from Supabase
7:14 Supabase Auth in ASP.NET Core
10:09 Getting the Supabase JWT secret

[ramax]

Why do you set "ValidateIssuerSigningKey" to "true"? This option is for asymmetric algorithms if I'm not mistaken. And in this JWT is used HS256 algorithm.

[wicho]

What would you recommend for and small production app?
Supabase
Keycloack
Custom IdentityServer

[patasmajeris]

I think good video should be showing how to add Supabase Auth to Blazor SSR (and if possible SR, WebAssembly)

[isahirzavalamiranda]

i have sign in and up endpoints with oauth providers, should i have a endpoint for the callback o that should be on the front?

[yotelolailo]

Just a note, the response from the refresh token endpoint doesn't seem to return a cached response. The access token is different for each request. You can even see it in the video. What would be the difference between using a login compared to the refresh endpoint?

[vinp]

is this something like keycloak like an authentication aggregator but light weight?

[matthewrossee]

How would you add authorization to an app that uses Supabase authentication? There's a possibility to create custom supabase hook that adds additional claims to the JWT, but I was wondering if it was better to store roles/permissions against the user identifier directly in the database (the one that aspnet core app uses, not the supabase db) and implement authorization handler that checks if there's a valid record in the database. What do you think?

[manzot]

Is it possible to not include some function to require an accessToken? For Example Login and Register (made with Supabase authentication) shouldn't require an AccessToken.
If I'm using Controllers how can I require the authorization in them?

[akashkarve]

Thanks for this informative video. Does it supports "Onbehalf" flow?

[matthewrossee]

Hi Milan, could you make a video about many to many relationships in domain driven design? I don’t know how to design my aggregates. Also, do you think that relationships between aggregates should be resolved via ef core HasMany/HasOne foreign keys, or should the relationships be updated manually in domain event handler, like Amichai Mantinband does?

[OscarGarcia-upph]

Could you make a tutorial on Authentication using Keycloak? I love this videos

[ruekkart]

Can we use this together with Microsoft Identity users? Also, what if we need to manage users directly from our apps?

[StormBreaker-fwww]

If you have diferent microservices, you must define the secret in every service? There is another way to download the keys safely from the Auth provider?

[refazrony]

Please make a video .NET core with oracle database