Do Supabase projects have an authority and audience?

[pdevito3]

So setting up supabase on my frontend seems pretty straight forward, but I have a separate backend I want to use for my API layer. If I'm using supabase on my front end though, I need to be able to validate the JWT on the backend to make sure it's valid. This would generally be done with an authority and audience, where the authority would be a tenant domain and the audience is a particular api (i.e. the supabase project). For example:

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.Authority = Environment.GetEnvironmentVariable("AUTH_AUTHORITY");
        options.Audience = Environment.GetEnvironmentVariable("AUTH_AUDIENCE");
    });

But i don't see anything like this anywhere in my supabase config. Does that mean that I'm out of luck if I want to use the supabase auth and db, but have a separate backend to act as my api?

[tigger0jk]

I plugged my JWT I got from supabase into https://jwt.io/ and found:

• The audience ("aud") is "authenticated" - I believe it's always this for auth
• The authority ("iss") is "https://<project_id>.supabase.co/auth/v1" where you can find <project_id> in your supabase console Project Settings -> General -> Reference ID.
  • Alternatively (but identically) authority it may be thought of as "<project_url>/auth/v1" where you can find <project_url> in your supabase console Project Settings -> API -> Project URL -> URL
  • It's probably theoretically possible that someday there will be an "/auth/v2" that breaks this - but I'd imagine that's a breaking-change upgrade you'd have to opt into if it ever happens

I only verified audience on my JWT, so I'm not 100% sure I'm right abut authority.
Here is an example in python using pyjwt that does respect authority

pip install pyjwt

import jwt

decoded_token = jwt.decode(token, '<jwt_secret>', algorithms=['HS256'], audience='authenticated')
supabase_user_id = decoded_token['sub']

[nehatkkhan786]

this helps. thanks a lot.