Supabase Auth

A database webhook on auth.users sends Supabase sign-ups, updates and deletions to Referalli.

Connect

1. Create the connection: {"provider": "supabase", "programId": "prg_…"} and keep the secret (whsec_…).

2. In Supabase add a webhook (Database → Webhooks) on auth.users for INSERT, UPDATE and DELETE, sent to your webhook URL with Standard Webhooks headers (webhook-id, webhook-timestamp, webhook-signature) signed with the connection secret, for example from an Edge Function.

Where the referral goes

await supabase.auth.signUp({ email, password, options: { data: window.aff.signupMetadata() } });

It lands in raw_user_meta_data. A banned_until in the future suspends their partner record; clearing it lifts the suspension. DELETE erases.

Referral context

On your sign-up page, with the tracking script loaded, window.aff.getReferral() returns the visitor's referral. Put it where this provider carries it (below), under the default keys referalli_anon_id, referalli_click_id and referalli_coupon. The older referally_* spellings are still read. Referalli never links users by email: without these keys a sign-up is not attributed.

For Supabase Auth the referral is read from: record.raw_user_meta_data.*.

Check it

Each webhook delivery is answered with what Referalli did per user (attributed, partnerId, matchedVia, or the reason it wasn't); signed-protocol calls take "test": true on /signups to see the answer without storing anything. Every connector is held to the same conformance suite.