Supabase

Trigger Brew automations from Supabase auth events including signups, email confirmation, password changes, and bans, with user data synced as they fire.

Connect Supabase so events on the auth.users table fire Brew automations. Send a real welcome email after the email is verified, alert the user the moment their password changes, drip pending-invite reminders, or surface account-suspension notices.

What You Can Do

• Trigger automations from Supabase auth events. Real signups, email + phone confirmations, password changes, bans, invites
• Auto-sync contacts into your audience. Every Supabase event upserts the user into Brew with supabase_* custom fields (supabase_user_id, supabase_account_status, supabase_email_verified_at, supabase_phone_verified_at, supabase_last_sign_in_at, etc.) you can filter and segment on
• Get more than INSERT/UPDATE/DELETE. Brew classifies column-level transitions into 12 marketing-relevant events (e.g. auth.user.email_confirmed fires the moment email_confirmed_at flips from null to set)
• Stay safe at scale. Brew signs every webhook with a shared secret you control; pgcrypto + Vault handle the HMAC inside Postgres

Every marketing recipient must have opted in to hear from you. Importing or syncing contact data into Brew is not permission to email it. See What You Can Send.

How It Works

1. Brew mints a unique webhook URL for your brand and generates the setup SQL you paste into your Supabase project.
2. The SQL installs the pgcrypto extension, stores your shared secret in Supabase Vault, and creates a trigger on auth.users that HMAC-signs every change before pg_net POSTs it to Brew.
3. On receipt Brew verifies the signature against your shared secret. Any UPDATE is classified, if a specific column transition matches one of the 9 synthetic events (e.g. email_confirmed_at going from null to set), Brew fires that more-specific event instead of the generic auth.user.updated.
4. For each verified event Brew (a) starts every Live automation whose trigger matches and (b) upserts the Supabase user into your audience with supabase_* custom fields.

See How event triggers work for the conceptual flow shared by every event-source integration.

Setup

1. Generate your Brew webhook URL

   In Brew, open Integrations, click the Supabase card, and click Generate URL. The SQL block in step 3 will pre-fill the URL for you.

2. Generate a 32-character shared secret

   Run openssl rand -hex 32 in your terminal. You’ll paste this same value into the SQL block (step 3) and the Brew connect form (step 4).

3. Run the setup SQL in Supabase

   In your Supabase project, open SQL Editor → New query. Paste the SQL block that Brew shows in the connect dialog, replace <PASTE_YOUR_SECRET_HERE> with the secret from step 2, then click Run.

   The block installs the pgcrypto extension, stores your shared secret in Supabase Vault, and creates a trigger on auth.users that signs every change with HMAC-SHA-256 before pg_net POSTs it to Brew.

4. Paste the same secret into Brew

   Paste the secret from step 2 into the Brew connect form and click Connect. Brew uses it to verify every webhook the new trigger sends.

5. Verify it's working

   Sign up a test user in your Supabase Auth UI (or run an INSERT into auth.users via the SQL Editor). Within a few seconds it should appear in the Manage → Recent events panel of the Supabase integration page in Brew. If it doesn’t, recheck the Vault entry and that the trigger SQL ran cleanly.

Re-running the SQL block after rotating the secret is safe. The block drops and re-creates the trigger idempotently.

Triggering Automations

Once connected, every Supabase event below is provisioned automatically and available as a trigger in the automation builder. The Manage tab is a read-only catalogue plus a live Recent events stream, no per-event enable step. Whether an event fires is controlled by whether the bound automation is Live.

Supported Events

Brew supports 12 Supabase auth events, 3 raw envelope types and 9 synthetic UPDATE classifications:

Raw envelope events

• auth.user.created: INSERT into auth.users
• auth.user.updated: UPDATE that didn’t match a synthetic classification
• auth.user.deleted: DELETE from auth.users

Synthetic UPDATE events

• auth.user.email_confirmed: email_confirmed_at transitions from null to set
• auth.user.phone_confirmed: phone_confirmed_at transitions from null to set
• auth.user.email_changed: email column changes between rows
• auth.user.password_changed: encrypted_password changes between rows
• auth.user.signed_in: last_sign_in_at changes
• auth.user.banned: banned_until transitions from null to set
• auth.user.unbanned: banned_until transitions from set to null
• auth.user.invited: invited_at transitions from null to set
• auth.user.upgraded_from_anonymous: is_anonymous flips from true to false

A single UPDATE only fires one synthetic event, the highest-priority classification wins. Email confirmation beats phone confirmation, which beats anonymous-to-real upgrade, and so on.

In chat, say “Send the real welcome email after the user confirms their email” and Brew will scaffold the automation with auth.user.email_confirmed pre-selected.

Common Patterns

Goal	Supabase event
Initial signup notification	auth.user.created
Real welcome email (after verification)	auth.user.email_confirmed
Security alert on a password change	auth.user.password_changed
Security alert sent to the old email	auth.user.email_changed
Pending-invite reminder drip	auth.user.invited
Welcome anonymous users after they convert	auth.user.upgraded_from_anonymous
Account-suspension notice	auth.user.banned
Welcome-back after a successful appeal	auth.user.unbanned
Re-engagement detection for returning users	auth.user.signed_in

auth.user.signed_in also fires on Supabase token refreshes. Add a per-user filter or a wait node if you want a true “they came back after a long time” signal.

Personalization

These resolve as merge tags in the email body, subject line, and preview text. Use a fallback wherever an empty value would read badly, like {{ firstName | there }}.

Variable	Example
{{ email }}	[e-mail]
{{ firstName }}	Alex
{{ phone }}	[phone]
{{ provider }} (signup method)	email, google, github
{{ previousValue }} (e.g. old email)	[e-mail]
{{ newValue }} (e.g. new email)	[e-mail]

The Supabase user UUID is not available as a merge tag: it never reaches the trigger payload. Brew writes it to the synced contact as the supabase_user_id custom field instead, so filter, segment, and join on it there.

Troubleshooting

An event arrived but no automation fired

Open the canvas and confirm at least one automation bound to this event is set to Live (not Draft). The Brew integration’s Manage → Recent events panel confirms the webhook is arriving, if it isn’t there, the issue is upstream (pgcrypto trigger not installed, secret mismatch). If the event is there but no email sent, the only remaining gate is automation.published.

Webhooks aren't arriving at all

Re-run the setup SQL block from the integration page. The block is idempotent, it’ll re-create the trigger and re-write the Vault entry. Confirm that pgcrypto is installed (SELECT * FROM pg_extension WHERE extname = 'pgcrypto';) and that the secret in Vault matches the one pasted into Brew.

auth.user.signed_in fires constantly

Supabase token refreshes also bump last_sign_in_at, which fires auth.user.signed_in alongside true sign-ins. Add a per-user wait or filter node in your automation to ignore repeats within a short window, or rely on auth.user.email_confirmed / auth.user.upgraded_from_anonymous for higher-signal events.

I want to test before going live

Insert a test row into auth.users (or sign up via your normal flow) and watch the Manage → Recent events panel. Build your automation as a Draft, run a test send from the email editor, then publish it to Live once you’re happy.

Requirements

• A Supabase project where you can run SQL against the auth schema
• Permission to install extensions (pgcrypto) and write to Supabase Vault

Need Help?

Our team is ready to support you at every step of your journey with Brew. Choose the option that works best for you:

Self-Service Tools

Search Documentation

Type in the “Ask any question” search bar at the top left to instantly find relevant documentation pages.

ChatGPT/Claude Integration

Click “Open in ChatGPT” at the top right of any page to explore it further with ChatGPT or Claude.

Talk to Our Team

Schedule a Call

Book time with our founders for personalized guidance on strategy, best practices, or complex implementation questions.

Call Us Directly

Need immediate assistance? Reach us at [phone] for urgent issues or time-sensitive questions.

Slack Channel

Our preferred support channel. You’ll receive an invite after signup for direct founder support and fast responses.

Email Support

Contact us at [e-mail] for detailed inquiries or if you prefer not to use Slack.