Skip to main content
OpenDot has one auth page with two backend modes:
  • Local Compose/self-hosted mode uses OpenDot email/password auth.
  • Supabase mode uses Supabase Auth in the browser and sends the Supabase access token to the OpenDot API.
For the console-facing login and signup flow, start with Login and signup. This page focuses on deployment settings and the auth/data ownership boundary.

​
Local auth

For local runs, copy the root env template:
Leave these defaults:
Signup creates an app_users row, a hashed password row in local_auth_credentials, and the default user preferences through the platform API. Passwords are never stored as plaintext. Change OPENDOT_SESSION_SECRET before using local auth on any shared or public deployment.

​
Supabase auth

For Supabase-backed deployments, use Supabase Auth for email/password:
The browser signs in with Supabase and sends the Supabase JWT to the OpenDot API. The API validates the token, maps auth.users.id to app_users.id, and keeps durable product data in OpenDot-owned tables. The OSS core is single-workspace and does not put authorization-critical product state in Supabase user_metadata. For the current preview flow without email verification, disable email confirmations in Supabase Auth settings. The forgot-password, Google, and GitHub controls are visible in the UI but are not wired yet.