Forcefully create a managed user session.

[ralusek]

I have a scenario wherein a user is being redirected from an other site, sent with a token as a query param. This token is sufficient within my own application that I can confidently verify the user is who they say they are. I'd like to create a session on behalf of this user such that supabase takes over with a refresh/access token and treats them as a fully authenticated user.

Basically, on my backend, I'll be sent this token from a client. I then want to do something like

supabase.auth.createSessionForUser({ userId: 'their_supabase_auth_user_id' });

And from there I get this session to the client, after which supabase client manages the access/refresh token as usual.

[GaryAustin1]

The closest thing I know of is to use auth.admin.generateLink https://supabase.com/docs/reference/javascript/auth-admin-generatelink to get an OTP. Then use that with verifyOtp to sign in the user.

[ralusek]

An interesting approach. Will have to check out that interface, but it looks promising, thanks.