Supabase auth example by tleyden · Pull Request #4066 · PrefectHQ/fastmcp

Description

Complete working example of using Supabase Auth. I found this to be a very non-trivial task, so hopefully this will save someone the iterations I had to go through!

Closes #4063

Contribution type

• Bug fix (simple, well-scoped fix for a clearly broken behavior)
• Documentation improvement
• Enhancement (maintainers typically implement enhancements — see CONTRIBUTING.md)

Checklist

• This PR addresses an existing issue (or fixes a self-evident bug).

But to be fair I filed it!

• I have read CONTRIBUTING.md

• I have added tests that cover my changes

This is an example. Automated tests probably not appropriate.

• I have run uv run prek run --all-files and all checks pass
• I have self-reviewed my changes
• If I used an LLM, it followed the repo's contributing conventions (not generic output)

Guilty as charged, except for the README.md which was entirely hand-crafted.

Happy to clean up the AI slop, but I'd like to get a round of feedback before I go too deep on that. I just want to make sure the PR will be accepted in it's current form, or if there is an example template I should follow for an example like this.

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d2e2773182

cc @aaazzam - since it looks like you worked on the original PR. Any chance you could take a look and let me know what would be needed to get this example merged?

A few things that stand out:

• README Step 5 documents an unresolved error ("You will see error in browser window. I am not sure what's going on here.").
• hello_supabase.py has substantial debug scaffolding: the InstrumentedJWTVerifier (lines 31-96) with emoji logging and manual JWT decoding, and RequestLoggingMiddleware (lines 99-117). The shape to match is examples/auth/github_oauth/server.py.
• consent_server.py has the same: the inline debugEl / console.log output pane is a debug UI, not consent UI.
• pyproject.toml and a 1,188-line uv.lock inside the example folder. No other example in examples/auth/ ships its own env or lockfile.
• The README's ## Needs Review section still has unresolved questions.

We're happy to accept a Supabase example, but it needs to arrive fully formed — walkthrough verified end-to-end against a real Supabase project, no debug scaffolding, structurally consistent with the other auth examples in the repo. Once it's ready for the world, ping us and we'll take a look.

tl;dr: CI failed on a flaky timing-sensitive test (test_timeout_tool_call_overrides_client_timeout_even_if_lower) unrelated to this PR's Supabase example. Safe to re-run.

The only failing job was Tests with lowest-direct dependencies. The single failure was in tests/client/client/test_timeout.py:37, which configures a Client(timeout=0.1) and then asserts a per-call timeout=2 override lets a 0.5s tool sleep complete. On a slow runner (and against the lowest-pinned mcp==1.24.0), the 0.1s client-level timeout is tight enough to occasionally win the race.

This PR only adds files under examples/auth/supabase_auth/ — it cannot affect client timeout behavior. All other test jobs (Python 3.10/3.13 ubuntu, 3.10 windows, integration, conformance) passed.

FAILED tests/client/client/test_timeout.py::TestTimeout::test_timeout_tool_call_overrides_client_timeout_even_if_lower
  - mcp.shared.exceptions.McpError: Timed out while waiting for response to ClientRequest. Waited 0.1 seconds.
======= 1 failed, 5622 passed, 2 skipped, 1 xfailed in 116.56s =======

🤖 Generated with Claude Code

Thanks for taking a look @jlowin, I will try to find the time to make the changes.

structurally consistent with the other auth examples in the repo

Do you recommend any particular auth example that is most similar to Supabase, or are they all about the same?