How Supabase Structures Its Auth Schema: Users, Identities, and Sessions

Supabase stores all authentication data in a dedicated auth schema, separate from the public schema where application tables reside. Each user has a single row in auth.users, one or more rows in auth.identities reflecting each login provider used, and potentially multiple active rows in auth.sessions representing different devices or tabs. Refresh tokens are stored separately in auth.refresh_tokens, backing each session with long-lived credentials alongside revocation and reuse-detection logic. The auth schema is managed internally by GoTrue, Supabase's auth service, meaning developers should read from it via the client or Admin API rather than writing to it directly. Understanding these four core tables and their foreign-key relationships is key to querying user activity and safely linking auth data to application profile tables.