Findings (root cause)
- Supabase invite emails default to ConfirmationURL (…/auth/v1/verify?token=…&type=invite&redirect_to=…). After verification, Supabase redirects to your site with tokens in the URL hash (#access_token=…). That requires client-side handling; otherwise no session/cookie is set and users land unauthenticated on your homepage.
- Your app has a server route at app/auth/confirm/route.ts that expects token_hash and type query params and calls supabase.auth.verifyOtp({ type, token_hash }) to set cookies server-side—but the current invite link doesn’t hit that route and uses token (not token_hash).
- Net: there’s a mismatch between the link Supabase sends and how your app expects to finalize auth; you’re not processing the hash fragment, so the invite appears to “do nothing”.
What “should” happen
- Either: handle the hash fragment client-side (getSessionFromUrl) and then sync to server cookies; or: bypass the hash entirely by customizing the email invite link to point directly at your server ro