Supabase Auth in Production: JWT, RLS, and Session Refresh

We use Supabase Auth for many client projects. In production, a few patterns keep things secure and smooth.

**JWT and RLS.** Row Level Security policies run with the user's JWT. Design policies per table and test with different roles. Never trust client-side checks alone.

**Session refresh.** Use short-lived access tokens and refresh tokens. Supabase clients handle refresh; for server-side or API routes, validate the JWT and refresh when needed so sessions don't die mid-flow.

**Handoff.** Document your auth flow and token lifecycle so your team (or future maintainers) can debug and extend without guessing.