Auth bugs in Next.js with Supabase are rarely random. These are five causes that come up again and again.
1. The session is never refreshed
With @supabase/ssr the session cookie has to be refreshed on the server. Add middleware that calls supabase.auth.getUser() on each request and writes the updated cookies back to the response. Without it, users get logged out when the access token expires.
2. Trusting getSession() on the server
getSession() reads the cookie without verifying it. For anything that decides access, call getUser(), which asks the Auth server to validate the token.
3. Email links that expire immediately
Some email security scanners open the link before the user does and use up the one-time token. A common fix is to send the user to a page of your own that asks for a click, and only then call verifyOtp with the token hash.
4. OAuth only works on localhost
Check the Site URL and the Redirect URLs allow-list in the Supabase dashboard. If your production URL is not listed, sign-in falls back or fails after deploy.
5. Cached routes that read cookies
A route handler or page that reads auth cookies must be dynamic. If it gets cached, one user's state can show up for another or go stale.
More fixes
The guide Fix Supabase Auth Problems in Next.js covers 26 common sign-in, session, email-link and OAuth bugs, each with the symptom, the real cause and a fix. It comes with a 14-day money-back guarantee.