PHPackages                             kyzegs/supabase-auth-bundle - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. kyzegs/supabase-auth-bundle

ActiveSymfony-bundle[Authentication & Authorization](/categories/authentication)

kyzegs/supabase-auth-bundle
===========================

A reusable Symfony bundle for stateless authentication via Supabase-issued JWTs.

v1.0.1(1mo ago)07↓90%MITPHPPHP ^8.3CI passing

Since Jun 3Pushed 1mo agoCompare

[ Source](https://github.com/Kyzegs/supabase-auth-bundle)[ Packagist](https://packagist.org/packages/kyzegs/supabase-auth-bundle)[ RSS](/packages/kyzegs-supabase-auth-bundle/feed)WikiDiscussions main Synced 1w ago

READMEChangelog (2)Dependencies (15)Versions (3)Used By (0)

SupabaseAuthBundle
==================

[](#supabaseauthbundle)

Stateless Symfony authentication via Supabase-issued JWTs.

The bundle verifies a Supabase JWT (signature against the project JWKS, plus `exp` and `iss` checks) and hands the verified claims to an application-provided resolver that maps the Supabase identity to your own user. Verification logic lives here once; the only application glue is the resolver.

Installation
------------

[](#installation)

```
composer require kyzegs/supabase-auth-bundle
```

If you don't use Symfony Flex, register the bundle manually in `config/bundles.php`:

```
return [
    // ...
    Kyzegs\SupabaseAuthBundle\SupabaseAuthBundle::class => ['all' => true],
];
```

Configuration
-------------

[](#configuration)

`config/packages/supabase_auth.yaml`:

```
supabase_auth:
    url: '%env(SUPABASE_URL)%'   # required, absolute http(s) URL, no trailing slash
    jwks_ttl: 600                # optional, JWKS cache TTL in seconds
    leeway: 0                    # optional, allowed clock skew in seconds
    audience: 'authenticated'    # optional, required `aud` claim value
    algorithms: ['RS256', 'ES256'] # optional, accepted signature algorithms

when@test:
    supabase_auth:
        test_mode: true          # accept "test-user-{id}" tokens instead of real JWTs
```

OptionDefaultDescription`url`*(required)*Supabase project URL, e.g. `https://xxxx.supabase.co`. Must be an absolute http(s) URL.`jwks_ttl``600`Seconds to cache the JWKS (matches the Supabase edge cache).`leeway``0`Allowed clock skew (seconds) for the `exp`, `iat` and `nbf` checks.`audience``null`When set, the token `aud` claim must contain this value (Supabase uses `authenticated`).`algorithms``[RS256, ES256]`Signature algorithms accepted from the JWKS. Must be a subset of `RS256`, `ES256`.`test_mode``false`Swap the handler for one accepting `{prefix}{identifier}` tokens.`test_token_prefix``test-user-`Bearer-token prefix recognised in test mode.Invalid configuration (an unsupported algorithm, a negative `jwks_ttl`/`leeway`) fails fast at container compile time. The `url` is validated at runtime instead, so an `%env(SUPABASE_URL)%` value — which is unresolved during compilation — is accepted; a non-http(s) URL is rejected on first token verification.

Wiring the firewall
-------------------

[](#wiring-the-firewall)

Point your firewall's access-token handler at the public service id `supabase_auth.token_handler`:

```
# config/packages/security.yaml
security:
    firewalls:
        api:
            stateless: true
            access_token:
                token_handler: supabase_auth.token_handler
```

Provide a user resolver
-----------------------

[](#provide-a-user-resolver)

Implement `SupabaseUserResolverInterface` to map verified claims (typically the `sub` claim) to your security user, and alias the interface to it:

```
namespace App\Security;

use App\Repository\UserRepositoryInterface;
use Kyzegs\SupabaseAuthBundle\Contract\SupabaseUserResolverInterface;
use Symfony\Component\Security\Core\User\UserInterface;

final class SupabaseUserResolver implements SupabaseUserResolverInterface
{
    public function __construct(private UserRepositoryInterface $users) {}

    public function resolve(array $claims): ?UserInterface
    {
        return $this->users->find($claims['sub']);
    }
}
```

```
# config/services.yaml
services:
    Kyzegs\SupabaseAuthBundle\Contract\SupabaseUserResolverInterface: '@App\Security\SupabaseUserResolver'
```

Returning `null` from `resolve()` produces an authentication failure.

Testing your application
------------------------

[](#testing-your-application)

With `test_mode: true`, send `Authorization: Bearer test-user-{identifier}` and the bundle calls your resolver with `['sub' => '{identifier}']` — no real JWT required.

License
-------

[](#license)

MIT

###  Health Score

40

—

FairBetter than 86% of packages

Maintenance90

Actively maintained with recent releases

Popularity5

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity50

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~0 days

Total

2

Last Release

51d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/eb13f61de13b186245a047cd1d882784e4dacb5b9f2a8f930b20e5992159e61a?d=identicon)[Kyzegs](/maintainers/Kyzegs)

---

Top Contributors

[![Kyzegs](https://avatars.githubusercontent.com/u/45851377?v=4)](https://github.com/Kyzegs "Kyzegs (3 commits)")

---

Tags

supabasesupabase-authsymfonysymfony-bundlejwtsymfonysecurityAuthenticationaccess tokensupabase

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan

Type Coverage Yes

### Embed Badge

![Health badge](/badges/kyzegs-supabase-auth-bundle/health.svg)

```
[![Health](https://phpackages.com/badges/kyzegs-supabase-auth-bundle/health.svg)](https://phpackages.com/packages/kyzegs-supabase-auth-bundle)
```

###  Alternatives

[symfony/security-bundle

Provides a tight integration of the Security component into the Symfony full-stack framework

2.5k185.6M2.4k](/packages/symfony-security-bundle)[shopware/core

Shopware platform is the core for all Shopware ecommerce products.

585.6M600](/packages/shopware-core)[contao/core-bundle

Contao Open Source CMS

1231.6M2.8k](/packages/contao-core-bundle)[web-auth/webauthn-framework

FIDO2/Webauthn library for PHP and Symfony Bundle.

515100.5k3](/packages/web-auth-webauthn-framework)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)