Supabase Auth on Next.js 16 at the Edge

Supabase's SSR helpers keep the session in cookies, which is exactly what an Edge runtime needs: no Node APIs, just Request and Response.

Install

pnpm add @supabase/ssr @supabase/supabase-js

Guard the route in middleware

export async function middleware(req: NextRequest) {
  const supabase = createServerClient(URL, KEY, { cookies: { /* getAll / setAll */ } });
  const { data: { user } } = await supabase.auth.getUser();
  if (!user) return NextResponse.redirect(new URL("/login", req.url));
}

On Cloudflare Pages keep the file named middleware.ts: Next 16's proxy.ts only runs on Node.js.

Before you ship

1. Turn off public sign-ups in Supabase Auth
2. Use getUser(), not getSession(), on the server
3. Lock rows down with Row Level Security, not just the UI

Read the official guide for the full cookie setup.