How do I install the Debug Auth skill?

Run npx skillmds@latest add hiai-gg/debug-auth in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Debug Auth safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Debug Auth?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Debug Auth free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Debug Auth?

HiAi-gg (@hiai-gg) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Debug Auth by hiai-gg — Agent Skill

Name: Debug Auth
Author: HiAi-gg

Debug Auth

Debug Supabase authentication issues: signup, sign-in, session handling, and RLS access problems from the client perspective. Use when a user cannot sign in, sessions drop, or authenticated requests return 401/403 or empty results.

HiAi-gg 1feecf4 1.9 KB Updated Sep 17, 2026

File contents

Debug Supabase Authentication

Use this skill when an agent must diagnose why Supabase auth is failing for a user or why authenticated data access misbehaves.

Workflow

1. Classify the symptom

Sign-in failure: wrong credentials, disabled user, email verification pending, provider (OAuth) misconfigured, rate-limited.
Session drops: token expiry (JWT lifetime), refresh token failure, storage/URL config on the client.
Authenticated requests fail: 401 (no/invalid JWT), 403 (RLS denies), or 200 with empty rows (RLS filters everything).

2. Reproduce and observe

Replay the failing request via postgrestRequest:
- with no key → anon role (what RLS allows anonymously),
- with the user's session token (client-level) → authenticated role.
Compare the two: identical results suggest RLS misconfiguration; a 401/403 difference points at token handling.

3. Check the common causes

403 / empty rows: RLS policies don't match the user's auth.uid() — see review-rls.
401: the anon key/JWT is missing or malformed on the request; check the client config.
Sign-up flow: confirm the app uses signUp correctly, email confirmation is enabled/expected, and the user was actually created.

4. Report

State: the symptom, the request/role observations (anon vs authenticated), the most likely cause, and the narrowest fix (client config, RLS policy, auth settings). Do not print tokens or session data.

Guardrails

Never print JWTs, anon/service-role keys, or session storage.
Read-only replay of requests; do not modify auth settings without explicit user intent.

Frequently asked questions