Edel Auth for Supabase
| 开发者 | edelhearts |
|---|---|
| 更新时间 | 2026年9月25日 20:35 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
wp-admin remains secure while offering a seamless login experience for your customers.
Full Setup Guide
We have prepared a comprehensive guide to help you through the process, including Google Cloud Platform configuration and Supabase settings:
https://edel-hearts.com/edel-auth-for-supabase-guide/?display_lang=en
Key Features
- Supabase Authentication: Support for Email/Password, Magic Links (Passwordless), and Social Login (Google).
- Auto Synchronization: Users created in Supabase are automatically synced to WordPress as subscribers upon login.
- Logout Synchronization: Logging out of WordPress automatically triggers a sign-out from Supabase to ensure session consistency.
- User Deletion Sync: Deleting a user in WordPress automatically removes the corresponding user from Supabase (Requires Service Role Key).
- Secure Admin Separation: Administrators are blocked from logging in via the frontend forms to prevent privilege escalation attacks.
- Smart Password Reset: Automatically detects if a user registered via Google and guides them to use the "Log in with Google" button instead of sending a reset email.
- Welcome Emails: Sends customizable "Welcome" emails directly from WordPress upon successful registration. Custom Sender Name and Email are supported.
- Keep Alive (Maintenance): Automatically accesses Supabase once a day to prevent free projects from pausing due to inactivity.
- Developer Friendly: Includes hooks for customizing user roles and syncing additional metadata.
安装:
- Upload the plugin files to the
/wp-content/plugins/edel-auth-for-supabasedirectory, or install the plugin through the WordPress plugins screen directly. - Activate the plugin through the 'Plugins' screen in WordPress.
- Go to Settings > Edel Auth (Supabase).
- For a step-by-step walkthrough of the API and Google Login setup, refer to our official guide: https://edel-hearts.com/edel-auth-for-supabase-guide/?display_lang=en
- Log in to your Supabase Dashboard.
- Go to Project Settings > API.
- Copy the Project URL, anon public key, and service_role secret.
- Paste these credentials into the plugin settings page in WordPress.
-
Note: The
service_rolekey is stored securely and used for administrative tasks like checking Google users, syncing user deletions, or the "Keep Alive" feature.
常见问题:
How do I remove the "Powered by Supabase" text from Supabase emails?
This text is automatically added by Supabase if you are using their built-in email service. To remove it, you must configure Custom SMTP in your Supabase Project Settings. Once configured, you can edit the Email Templates to remove the footer.
Does this plugin sync users to the WordPress database?
Yes, but efficiently. A WordPress user record is created (or updated) only when a user successfully logs in via Supabase. This ensures that users exist in WordPress for compatibility with other plugins (like WooCommerce or membership plugins), but authentication is handled by Supabase.
Does logging out of WordPress log me out of Supabase?
Yes. The plugin detects the WordPress logout action and triggers a sign-out request to Supabase on the frontend, ensuring both sessions are terminated.
What happens if I delete a user from WordPress?
If you have configured the Service Role Key in the settings, deleting a user from the WordPress admin screen will also delete the corresponding user from your Supabase project.
What happens if a Google-registered user tries to reset their password?
The plugin's "Smart Check" feature detects that the email is associated with a Google provider. Instead of sending a reset email (which wouldn't work), it displays a helpful message advising the user to log in with Google.
Can Administrators log in via the Supabase form?
No. For security reasons, users with administrator privileges are blocked from logging in via the frontend Supabase forms.
Admins should continue using the default /wp-login.php or /wp-admin.
Where can I find the Redirect URL for Google Login?
If you use Google Login, you need to add your site's URL to the Redirect URLs in Supabase (Authentication > URL Configuration).
Usually, this is just your site's home URL (e.g., https://example.com).
Should I enable "Confirm email" in Supabase?
Yes, we strongly recommend keeping Confirm email enabled (Authentication > Providers > Email).
The plugin links a Supabase account to an existing WordPress user by email address, so email ownership must be verified by Supabase.
Users with the administrator role are always blocked. If you want to block additional roles (e.g. editors), use the eafs_is_login_blocked filter.
更新日志:
- Tested up to WordPress 7.1 and PHP 8.5.
- Updated bundled supabase-js to 2.117.1.
- Fixed: Bundled Japanese translation was not loaded on sites without a language pack.
- Fixed: Login/registration sent the sync request to WordPress twice (manual login + auth state change).
- Fixed: "Register with Google" button threw a JavaScript error on pages without the login form.
- Fixed: Empty Main Color / Redirect settings now fall back to defaults instead of producing broken CSS or URLs.
- Fixed: Welcome email "From" header when Sender Name / Sender Email are empty.
- Fixed: Login success URL cleanup left a stray "&" when the parameter came first.
- Security: Added rate limiting, result caching and a page limit to the provider-detection AJAX endpoint.
- Added:
eafs_is_login_blockedandeafs_check_provider_max_pagesfilters,wp_loginaction on Supabase login. - Added:
{login_url}placeholder documented for the welcome email; cron event and transients are removed on uninstall. - Improved: Timeouts on all Supabase API requests, escaping and i18n cleanups.
- Improved: Errors returned by Supabase in the URL hash (e.g. expired magic link) are now shown to the user.
- Updated documentation link and developer hooks instructions.
- Fixed code block formatting issues in readme.
- Fixed file naming issues and updated branding.
- Initial release.