AI app auth specialist — Supabase Auth fix, Clerk setup for AI apps, OAuth callback fix and session management when authentication works in preview and nowhere else.
An AI app auth specialist is the person you hire when login works in preview and nowhere else. The widely-reported February 2026 Lovable/Supabase RLS disclosure (see our 2026 research) wasn't a Supabase bug — it was auth logic inverted and missing session management. We ship Supabase Auth fixes, Clerk setup for AI apps, OAuth callback fixes and session refresh wiring — at fixed prices, covering Supabase Auth, Clerk, NextAuth, Firebase, and Auth0. As of April 2026, Supabase Auth v2 (released Q1 2026) changed the session token format and many AI-generated apps are still emitting v1 patterns — Clerk also launched organization-level auth in March 2026 that AI tools haven't caught up with.
Why AI builders ship broken authentication
Authentication is five flows pretending to be one. Sign-up, sign-in, session refresh, password reset, and OAuth redirect each have their own edge cases — expiring tokens, one-time links, state parameters, cookie domains. AI builders reliably get sign-up and sign-in working in preview. They reliably forget the other three.
The most dangerous auth failure is logic inversion. The widely-reported February 2026 Lovable/Supabase RLS disclosure — summarized in our 2026 research — captured the exact failure: policies had the role check inverted, so authenticated users were denied and unauthenticated requests were allowed through. That's not a missing policy — that's generated code that runs and silently does the opposite of what the developer intended. Industry benchmarks put AI-code vulnerability rates close to half; auth logic inversion is one of the categories.
The second failure mode is environment coupling. OAuth redirect URIs hard-coded to localhost. Session cookies set on the preview subdomain but not the production domain. JWT secrets inconsistent between build and runtime. Clerk webhooks pointed at the preview URL forever. Every AI builder produces at least one of these. An authentication specialist enumerates every flow, tests every edge, and patches the cookies, redirects, and role checks before a single real user logs in.
Source: The Register, Feb 2026 — Lovable/Supabase auth-inversion disclosure
Which AI builder shipped your broken authentication?
The authentication failure mode usually depends on the tool that shipped the code. Find your builder below, then read the matching problem page.
| AI builder | What breaks in authentication | Go to |
|---|---|---|
| Lovable | Supabase Auth wired in; password reset emails never arrive. OAuth redirect URL stuck on preview. Role checks inverted on RLS policies. | Lovable auth fix → |
| Bolt.new | Auth scaffolding present, session refresh missing. JWT secret regenerated per deploy, invalidating all sessions. | Bolt.new auth fix → |
| v0 | Frontend-only. Beautiful sign-in form; no backend validates it. You pick Clerk or Supabase and wire it yourself. | v0 auth fix → |
| Cursor | Regression loop — fixes password reset, breaks OAuth callback two prompts later. Forgets session hydration on SSR. | Cursor regression fix → |
| Replit Agent | Picks Replit DB auth for prototypes, swaps to Supabase or Clerk late. Cookies set on wrong domain. | Replit rescue → |
| Claude Code | Writes correct auth when told to. Silently assumes sessions are server-only and misses the browser-side refresh path. | Claude Code architecture fix → |
| Windsurf | Enterprise auth patterns but no specific flow testing. Role propagation across features is inconsistent. | Windsurf rescue → |
| Base44 | Opaque auth wrapper. Export lands with raw Supabase Auth and no policies. | Base44 backend fix → |
Anatomy of the auth-inversion failure behind the 2026 Lovable disclosure
February 2026: the widely-reported Lovable/Supabase RLS disclosure captured the largest AI-built-app breach on record. Our 2026 research summarizes the incident. The root cause wasn't missing security — it was inverted security. Quote from the disclosure: 'authenticated users were blocked; unauthenticated visitors had full access to all data.' That single sentence captures a failure mode that doesn't exist in human-written auth code, because humans ask 'why would I write this?' AI agents don't.
The mechanism is boring in isolation. An AI builder is prompted: 'users should only see their own orders.' It writes a Supabase RLS policy: `USING (auth.uid() = user_id)`. Later, the same or a different prompt asks for a public-facing orders summary. The AI adjusts the policy — and adjusts it wrong. The condition becomes `auth.uid() != user_id OR auth.uid() IS NULL`, which reads as 'allow if the viewer isn't the owner, or if there's no viewer at all.' The anon key, embedded in every client bundle, is exactly the 'no viewer' case. Every anonymous visitor now has full read access to every user's orders. Authenticated users, who are the owners, are blocked by the != check.
“Compounding: auth in a real app isn't one check.”
Compounding: auth in a real app isn't one check. It's five distinct flows — sign-up, sign-in, session refresh, password reset, OAuth — each with its own edge cases. The AI almost always ships sign-up and sign-in working. Password reset emails go to the AI builder's preview subdomain because SMTP was never reconfigured for production. Session refresh quietly drops users after an hour because `onAuthStateChange` is never wired. OAuth callback hard-codes the Lovable preview URL into Supabase's redirect allowlist. Each of these individually is a support ticket. Together they are a broken product.
The 5-day, $799 integration fix enumerates all five flows, tests each on production URLs with a real email address and a real OAuth provider, writes the missing handlers, and leaves a Playwright suite that fails if any flow regresses. We've shipped many of these; the $499 security audit catches the inverted policies specifically, scripted against every role and route. The difference between the breach apps and the non-breach apps is not talent — it's whether someone ran this specific check before going live.
What a authentication rescue engagement ships
From first diagnostic to production handoff — the explicit steps on every authentication engagement.
- 01
Free rescue diagnostic
Send us your repo and the symptom. In 24 hours we return a written list of which auth flows are broken, which are missing, and the fixed price to complete them.
- 02
Five-flow audit
We test sign-up, sign-in, session refresh, password reset, and OAuth redirect on production URLs. For each we check cookies, redirects, email delivery, token expiry, and role propagation. Delivered as a written report.
- 03
Integration fix
We fix one auth provider end to end — Supabase Auth, Clerk, NextAuth/Auth.js, Firebase, or Auth0 — including the half-wired flows. $799, fixed price, 5-day delivery.
- 04
Production deploy pass
Correct OAuth redirect URLs in provider consoles. Cookie domain configured for production. Session secrets wired consistently between build and runtime. Test every flow on the real domain before cutover.
- 05
Handoff
Delivery doc, Loom walkthrough of every auth flow, runbook for common auth incidents (locked-out admin, expired OAuth app, email deliverability). Optional retainer for ongoing auth work.
Every authentication rescue audit checks
The diagnostic pass on every authentication rescue. Each item takes under 10 minutes; together they cover the patterns that cause 90% of AI-built-app failures.
- 01Every RLS policy tested from each role
Scripted queries as anonymous, as non-owner authenticated, and as owner authenticated. Unexpected success or failure is flagged.
- 02Session cookie settings
HttpOnly, Secure, SameSite=Lax (or Strict for admin). Domain scoped to production, not .vercel.app or similar.
- 03OAuth redirect URI match
Provider console and app must agree exactly. Trailing slash, subdomain, protocol all matter. Mismatches cause 400s in production.
- 04Password reset link points at production domain
Supabase default sends to the project URL. Production apps must override the redirect to the real domain.
- 05SMTP configured for custom domain
Default Supabase email deliverability is low, and the default inbox is capped at three emails per hour; in Q1 2026 roughly 60% of apps we audit still rely on it. We wire Resend or SES with SPF/DKIM on the custom domain.
- 06Session refresh on the client
`supabase.auth.onAuthStateChange` wired in the layout to hydrate and refresh. Missing = silent logouts at access token expiry.
- 07Role propagation across RLS, API routes, and UI
A user's role is checked consistently in all three layers. Divergence is a privilege escalation vector.
- 08Rate limits on auth endpoints
Sign-up, sign-in, password reset capped per-IP and per-identifier. Missing = credential stuffing and enumeration.
- 09Email verification enforcement
Unverified users shouldn't be able to sign in to anything sensitive. We check enforcement in the auth middleware.
- 10MFA or 2FA for admin roles
Especially for apps handling money, health data, or other regulated domains. We enable via the provider.
Common authentication patterns we fix
These are the shapes AI-generated code arrives in — and the shape we leave behind.
01`USING (auth.uid() != user_id OR auth.uid() IS NULL)` — allows anonymous and non-owner, blocks owner. 170-Lovable-apps pattern.01`USING (auth.uid() = user_id)` with tests against anonymous, non-owner, and owner confirming the expected access.01Password reset email links to `https://preview.lovable.app/auth/callback?...`. Production users can't reset.01Reset redirect set to production URL in Supabase allowlist. Tested end-to-end with a real inbox.01No `onAuthStateChange` listener. Access token expires at 1 hour; user drops out mid-session with no indication.01Listener wired in the root layout. Refresh token automatically exchanges new access tokens. Session persists per Supabase's configured TTL.01Google OAuth console has `localhost:3000/callback`. Production request arrives from `app.example.com/callback`. Google returns 400.01Production callback URL added to Google OAuth console and to Supabase allowlist. Tested from every environment.01User's role stored only in React state after login. A client-side edit flips 'user' to 'admin' and bypasses UI gating.01Role stored server-side, checked in RLS and API middleware on every request. Client state is display-only; server enforces.01User signs up, immediately logs in, uses the app. Email verification never required. Spam accounts and takeovers follow.01Unverified users can't log in to protected routes. Verification email sent via configured SMTP; TTL and resend flow wired.01Secret is read from a random generator in build; every deploy invalidates every session. Users report 'I'm logged out again.'01Secret fixed in Vercel env, consistent across deploys. Rotation is a planned event with a key-rollover window.authentication red flags in AI-built code
If any of these are true in your repo, the rescue is probably worth more than the rewrite.
Fixed-price authentication engagements
No hourly meter. Scope agreed up front, written fix plan, delivered on date.
- turnaround
- Security audit
- scope
- RLS, auth logic, session, and OAuth review. 48-hour turnaround.
- turnaround
- Integration fix
- scope
- One auth provider — Supabase, Clerk, NextAuth, Firebase, Auth0 — done right.
- turnaround
- Deploy to production
- scope
- Env vars, redirect URLs, cookie domains, monitoring. Safe for real users.
What authentication rescues actually cost
Anonymized, representative scopes from recent authentication rescues. Every price is the one we actually quoted.
A founder on Lovable whose Google OAuth breaks in production. Preview works. Users see redirect_uri_mismatch.
- Scope
- OAuth allowlist update across Google console and Supabase, production callback tested, one-flow integration fix.
- Duration
- 2 days
A seed-stage SaaS whose five auth flows are half-wired. Sign-up works; password reset silent; session drops after an hour; roles inconsistent.
- Scope
- Full auth pass — all 5 flows wired, tested on production domain, SMTP configured, session refresh, role propagation, Playwright tests.
- Duration
- 5 days
A growth-stage B2B SaaS migrating from Supabase Auth to Clerk with preserved user IDs, SSO for enterprise customers, SCIM provisioning.
- Scope
- User migration via Clerk import API, SSO config for 3 enterprise customers, SCIM endpoint, audit log, 40-PR rollout.
- Duration
- 4-5 weeks
authentication runbook and reference material
The documentation, CLIs, and specs we rely on for every authenticationengagement. We cite, we don't improvise.
- Supabase — Auth redirect URLs
The allowlist we update on every production cutover.
- Supabase — Row Level Security
RLS is where the 170-apps breach happened. We verify every policy.
- Clerk — Session management
The provider we prefer when migrating off half-wired Supabase Auth.
- Auth.js — Session strategies
Our default for Next.js apps wanting full control of the session layer.
- Google Identity — OAuth redirect URI validation
The exact matching rules we verify for Google OAuth.
- OWASP — Authentication Cheat Sheet
The baseline we audit against for every auth engagement.
- Clerk — Importing users API
Used in migrations off Supabase Auth with preserved IDs.
authenticationrescues we've shipped
Related authentication specialists
Supabase Auth fix is half of the Supabase stack. We fix both halves including RLS.
Subscription access control depends on session management. We make sure auth and billing agree.
The AI app auth specialist covers login; this expert covers the rest — rate limiting, secrets, OWASP.
Related authentication problems we rescue
The symptom page — Supabase + Google OAuth redirect URIs mismatch and how we fix it.
Multi-tenant auth for SaaS — orgs, invites, role propagation, RLS policy hygiene.
Sessions expire wrong, reset email never arrives, verification skipped.
The classic Lovable deploy failure. Fix Supabase redirect URLs.
JWT rotation, session refresh, and cookie domain fixes.
v0 is frontend-only. We wire Clerk, Auth.js, or Supabase Auth end to end.
authentication questions founders ask
Sources cited in this dossier
Your AI builder shipped broken authentication. We ship the fix.
Send the repo. We'll tell you exactly what's wrong in your authentication layer — and the fixed price to ship it — in 48 hours.
Book free diagnostic →