Skip to content

Conversation

@SumitKumar-17
Copy link

@SumitKumar-17 SumitKumar-17 commented Oct 24, 2025

  • Added type safety for email, phone, user_metadata, app_metadata, is_anonymous, etc.
  • Provides autocomplete and type safety for all documented JWT claims fields
  • getClaims() method now returns properly typed JwtPayload with documented fields

Fixes #1584

🔍 Description

What changed?

Why was this change needed?

Closes #(issue_number)

📸 Screenshots/Examples

🔄 Breaking changes

  • This PR contains no breaking changes

📋 Checklist

  • I have read the Contributing Guidelines
  • My PR title follows the conventional commit format: <type>(<scope>): <description>
  • I have run npx nx format to ensure consistent code formatting
  • I have added tests for new functionality (if applicable)
  • I have updated documentation (if applicable)

📝 Additional notes

@SumitKumar-17 SumitKumar-17 requested review from a team as code owners October 24, 2025 21:06
@mrbjjackson
Copy link

@SumitKumar-17 I'm not sure if this is the correct place to point this out but I'm just looking at your commit - I see you've added an "id" field. I'm not sure where this would come from. It's not mentioned in the docs as far as I can see - rather the claims object uses the "sub" parameter for the user's uuid.

@coveralls
Copy link

coveralls commented Oct 29, 2025

Coverage Status

coverage: 95.276% (+14.1%) from 81.197%
when pulling 37201b7 on SumitKumar-17:feat/typescript-jwt-claims
into dd0fee1 on supabase:master.

@mandarini
Copy link
Contributor

Hi @SumitKumar-17 ! Thank you for this PR. I discussed it why my team and we think this PR has a few incorrect claims added (e.g.: id, created_at, updated_at, phone_confirmed_at, etc...). We would recommend you use the following doc as the source of truth for the claims: https://supabase.com/docs/guides/auth/jwt-fields

One caveat here is that a user may use a custom access token hook so there's no guarantee the claims will exist (other than the required ones), so they should all be marked as optional.

Do you think you're able to make these changes? If not, let me know and we can help!

@mandarini mandarini self-assigned this Nov 4, 2025
- Added type safety for email, phone, user_metadata, app_metadata,
is_anonymous, etc.
- Provides autocomplete and type safety for all documented JWT claims
fields
- getClaims() method now returns properly typed JwtPayload with
documented fields

Fixes supabase#1584
@mandarini mandarini force-pushed the feat/typescript-jwt-claims branch from 905f6a3 to 41cabeb Compare November 5, 2025 15:41
@mandarini mandarini requested a review from issuedat November 5, 2025 16:48
@mandarini
Copy link
Contributor

Fixed the types, updated the PR @issuedat

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

auth-js Related to the auth-js library.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Provide TypeScript types for documented JWT claims fields (email, phone, user_metadata, etc.)

4 participants