How do I get custom auth hook to execute in the local development environment

[VimVoyager]

I am working on an app with Supabase and Svelte and currently working on Role Based Access Control. I used the guide in the Supabase docs to implement it. (https://supabase.com/docs/guides/auth/custom-claims-and-role-based-access-control-rbac).

I managed to get it working on the remote supabase project, but not on the local development environment. I have configured the hook to the config.toml here:

# https://supabase.com/docs/guides/auth/auth-hooks#local-development
# This hook runs before a token is issued and allows you to add additional claims based on the authentication method used.
[auth.hook.custom_access_token]
enabled = true
uri = "pg-functions://postgres/public/custom_access_token_hook"

But the hook is not executing, Is there anything I have missed when working in the local development environment that I need to set up for this to work, because RBAC is really important in this project and if I cannot get it to work in the local development environment I will need to switch to a different tech stack away from supabase. I am using supabase CLI version 1.153.4.

[alanqthomas]

@LMarshallAfzal Not sure if you got this working yet, but my suggestion would be to ensure that you have that postgres function for your custom access token hook locally. e.g. supabase db pull and then supabase db reset to mirror your local postgres to your prod one.

[Keliqq]

Have you managed to solve this problem? I faced the same problem. Supabase was launched in a self-host variant. I have a feeling that with self-host, the config.toml file is not readable at all. After all, everything is downloaded from the docker hub, and there are no volumes that would give access to this file.

[theunsa]

In case anyone else comes across this forum's question first while searching the web for an answer ...

The supabase documentation covers this https://supabase.com/docs/guides/auth/auth-hooks#local-development, with some extra information in this issue #22031.

Basically edit your config.toml to have this:

...
[auth.hook.custom_access_token]
enabled = true
uri = "pg-functions://postgres/public/custom_access_token_hook"
...

where custom_access_token_hook is your custom auth hook function.

1. Run supabase stop.
2. Remove the hidden directory supabase/.temp
3. Run supabase start.

Tested with supabase-cli v1.165.0 on Apple M2 Pro running Docker Desktop.

[jdgamble555]

Note: Running supabase db reset will not activate the hook. You must start and stop as well.

[aotakeda]

in case anyone else is running into issues even after following this solution, you should check your supabase CLI if it's up to date: https://supabase.com/docs/guides/local-development/cli/getting-started?queryGroups=platform&platform=macos#updating-the-supabase-cli

after updating and following the steps above it worked

[Korat-Dishant]

Are you able to get the claims in local supabase instance?

select (auth.jwt()  ->> 'user_role')

Does this SQL give you user role? In my case it works in production but not locally.

[jovand3v]

Probably not the case for most people but hopefully helps someone, please double check your auth hook and edge function name.

If you blindly follow the docs you could end up using send_email and send-email interchangeably.

[nassmim]

I'm still having issue to get it running, having the user receive a confirmation email after signup
I'm trying to run:

• supabase auth hook
• resend as email provider

This is my config.toml:
[auth.hook.send_email]
enabled = true
uri="http://127.0.0.1:54321/functions/v1/auth-hook-emails"
secrets="env(SEND_EMAIL_HOOK_SECRET)"

[functions.auth-hook-emails]
entrypoint = './functions/auth-hook-emails/index.js'

The endpoint is created as expected when I run supabase functions serve.-:
Setting up Edge Functions runtime...
2025-07-29T16:11:28.413342175Z Serving functions on http://127.0.0.1:54321/functions/v1/
2025-07-29T16:11:28.413399758Z - http://127.0.0.1:54321/functions/v1/auth-hook-emails
2025-07-29T16:11:28.413405841Z Using supabase-edge-runtime-1.68.0 (compatible with Deno v1.45.2)

However, when checking at the docker logs I get the following:
2025-07-29 17:10:17 {"level":"info","msg":"GoTrue API started on: 0.0.0.0:9999","time":"2025-07-29T16:10:17Z","version":"v2.177.0"}
2025-07-29 17:13:18 {"level":"info","msg":"Request received external host in X-Forwarded-Host or Host headers, but the values have not been added to GOTRUE_MAILER_EXTERNAL_HOSTS and will not be used. To suppress this message add the host, or sanitize the headers before the request reaches Auth.","time":"2025-07-29T16:13:18Z","x_forwarded_host":"127.0.0.1","x_forwarded_proto":"http"}
2025-07-29 17:13:20 {"auth_event":{"action":"user_confirmation_requested","actor_id":"1b7d1ed8-96ef-4703-94d9-5a9a13e0bf8d","actor_username":"nassmim972@gmail.com","actor_via_sso":false,"log_type":"user","traits":{"provider":"email"}},"component":"auth_hook","level":"error","method":"POST","msg":"Request timed out for attempt 0 with err Post "http://localhost:3002/functions/v1/auth-hook-emails\": dial tcp 127.0.0.1:3002: connect: connection refused","path":"/signup","referer":"http://localhost:3002/api/email-confirmation","remote_addr":"192.168.65.1","request_id":"8156958b-6459-4199-989b-c3f50101783e","time":"2025-07-29T16:13:20Z","url":"http://localhost:3002/functions/v1/auth-hook-emails"}
2025-07-29 17:13:22 {"auth_event":{"action":"user_confirmation_requested","actor_id":"1b7d1ed8-96ef-4703-94d9-5a9a13e0bf8d","actor_username":"nassmim972@gmail.com","actor_via_sso":false,"log_type":"user","traits":{"provider":"email"}},"component":"auth_hook","level":"info","method":"POST","msg":"invocation attempt: 1","path":"/signup","referer":"http://localhost:3002/api/email-confirmation","remote_addr":"192.168.65.1","request_id":"8156958b-6459-4199-989b-c3f50101783e","time":"2025-07-29T16:13:22Z","url":"http://localhost:3002/functions/v1/auth-hook-emails"}

Which configuration am I supposed to implement?

[nassmim]

It took me a while but I found a solution.
I had to set uri="http://host.docker.internal:54321/functions/v1/auth-hook-emails"
replacing my localhost with host.docker.internal as localhost refers to docker container itself.

Then, I also had another issue if that could help people facing this: the config.toml requires the full secret including v1,whsec whereas standardwebhooks (used in my function) requires it without. It's better explained here:
#28784

[Korat-Dishant]

I have similar problem. I am able to get the user_role when calling const claims = await supabase.auth.getClaims(); This means that the auth hook is running. Problem is that I am unable to get this data inside supabase dashboard sql. select (auth.jwt() ->> 'user_role') The thing which makes it even more confusing is that the code select (auth.jwt() ->> 'user_role') works in the production but when running it locally it doesn't. because of this issue authorize() function fails

declare
  bind_permissions int;
  user_role public.app_role;
begin
  -- Fetch user role once and store it to reduce number of calls
  select (auth.jwt() ->> 'user_role')::public.app_role into user_role;

  select count(*)
  into bind_permissions
  from public.role_permissions
  where role_permissions.permission = requested_permission
    and role_permissions.role = user_role;

  return bind_permissions > 0;
end;

That's why RBAC works in production but not in local development setup.

I guess the only option left is to modify authorize() function to not rely on claims fetched from auth.jwt() but directly fetch claims from user_role table 🤷‍♂️ Please let me know if you have any better idea on how to fix this problem.