# Creating a Supabase Instance

1. In the console, navigate to "Cloud Database UDB PostgreSQL" > "Supabase Management" and click "Create Supabase."

2. On the creation page, select the region and availability zone.

3. Configure the Supabase password and port. The Dashboard username is fixed as Supabase.

4. Configure PostgreSQL. Click "Modify" next to the database version to change the version and configuration file; click "Modify" below the database port field to update the database port.

5. Configure the network by selecting the required VPC and subnet.

6. Enter the Supabase instance name.

7. Review all configuration details and the associated cost, then confirm and complete payment.

8. After payment, the page redirects to the Supabase Management page. The instance will enter an initializing state and will be ready to use once initialization is complete.

9. On the Supabase Management page, select an instance and click "Details" to view its detailed information.

# Configuring External Network Access

1. On the instance details page, enable external network access. The Supabase service will restart when external access is enabled, and access will take effect after the restart completes.

2. External network access supports different billing methods. Select bandwidth-based billing or traffic-based billing as needed, and adjust the bandwidth limit. Complete payment and wait for Supabase to restart, after which external network access will be available. (Traffic-based billing is postpaid.)

3. SSL encrypted connections are supported. To disable SSL, you must first disable external network access.

4. Configure the allowlist. After external network access is enabled, the allowlist is empty by default and Supabase cannot be accessed. Add the allowed IP addresses or CIDR ranges to the allowlist to enable access.

# Configuring S3 Storage

1. On the Supabase instance details page, click "Storage Configuration" to update the settings. After submitting the changes, the Supabase service will restart and the configuration will take effect after the restart.

Configuration parameters:

- **AWS_ACCESS_KEY_ID**: The S3 storage public key, corresponding to the public key in US3 token management.
- **AWS_SECRET_ACCESS_KEY**: The S3 storage private key, corresponding to the private key in US3 token management.
- **FILE_SIZE_LIMIT**: The file size limit for uploads, in bytes.
- **GLOBAL_S3_BUCKET**: The name of the primary bucket for storing all files. Supabase organizes data within this bucket using a specific path structure.
- **GLOBAL_S3_ENDPOINT**: The S3 storage access domain. An AWS S3-compatible endpoint must be used. For US3 endpoints, refer to the [US3 documentation](/docs/ufile/introduction/region).
- **REGION**: The geographic region of the S3 bucket. For region names, refer to the [region list documentation](/docs/api/summary/get_project_list).
- **S3_PROTOCOL_ACCESS_KEY_ID**: The access key ID used when S3 protocol mode is enabled.
- **S3_PROTOCOL_ACCESS_KEY_SECRET**: The secret key corresponding to S3 protocol mode.
- **S3_PROTOCOL_ENABLED**: A boolean value (true/false). When enabled, Supabase allows communication via S3-compatible mode, rather than being limited to the standard AWS environment.
- **TENANT_ID**: The tenant ID.

# Third-Party Login

Supabase provides a unified user authentication system with built-in support for popular third-party login methods such as WeChat, Alipay, GitHub, and Apple. These methods can be connected with a single click, eliminating the cost of multi-platform integration and debugging, significantly reducing development effort and accelerating product launch.

## Prerequisites

### 1. Enable External Network Access

External network access must be enabled for the Supabase instance before you can use third-party login.

<!-- image-todo -->

### 2. Ensure the Instance Is Running

The Supabase instance must be in the Running state.

### 3. Configure Authentication Information

Configure the business URL, redirect URL, and authentication provider credentials. Enabling, disabling, or editing the configuration items on this page takes effect only after the Supabase instance is restarted. The restart takes about 1 minute. Perform this operation during off-peak hours.

### 4. Bind a NAT Gateway

Bind a NAT gateway and configure an egress rule that allows access to public network services. The NAT gateway must be in the same region, project, VPC, and subnet as the Supabase instance. If no NAT gateway is bound, the Supabase instance cannot access external identity providers, and third-party, email, and SMS login will not work.

#### 4.1 Open the NAT Gateway Page

Confirm that the region and project of the NAT gateway match those of the target Supabase instance, and open [Private Network VPC > NAT Gateway](https://console.zosoc.com/vpc/natgw).

<!-- image-todo -->

#### 4.2 Create a NAT Gateway

Click Create NAT Gateway. For VPC and Subnet, select the VPC and subnet where the Supabase instance resides. For External Elastic IP, purchase a new EIP or select an existing one as needed. Configure the other parameters based on your business requirements and complete the purchase.

<!-- image-todo -->

#### 4.3 Configure an Egress Rule

After the NAT gateway is created, open its details page and configure an egress rule on the Egress Rules tab. You can use the default egress rule or add a custom rule based on your business requirements. For details, see the [NAT Gateway documentation](https://www.ucloud-global.com/en/docs/vpc/guide/natgw).

<!-- image-todo -->

> **Note:** After configuring the NAT gateway, verify in your business environment that third-party, email, or SMS login can send requests normally.

## Procedure

1. Ensure that external network access is enabled for the Supabase instance and that its status is Running.

2. Configure the business URL.

<!-- image-todo -->

3. Configure the authentication provider credentials. Obtain the OAuth credentials as prompted based on the login method required for your business. Using Alipay login as an example, turn on the Alipay login toggle, paste the callback URL into Alipay Open Platform developer settings, and enter the APP ID, Private Key, and Alipay Public Key provided by Alipay. This step only saves the configuration.

<!-- image-todo -->

4. After the URL and OAuth credentials are changed, manually restart the Supabase instance for the changes to take effect.

<!-- image-todo -->

5. After confirming that the configuration is enabled, test it in your business environment. After an end user clicks Alipay login on the page and completes authorization, the user is logged in.

<!-- image-todo -->

## Email and SMS Login

Supabase supports user authentication through email or SMS. You can configure the email service and SMS login on the Third-Party Login tab of the Supabase instance details page.

<!-- image-todo -->

> **Note:** Email and SMS login rely on public network access. Before use, complete the NAT gateway configuration described in "Prerequisites."

### Email Login

After you configure an email service, Supabase can send authentication emails through the specified SMTP server.

#### Prerequisites

- The Supabase instance is in the Running state.
- The NAT gateway is configured, and the instance can access the SMTP server.
- You have obtained the sender email address, SMTP server address, port, authentication account, and authentication password or authorization code from your email service provider.
- After the email configuration is saved, you must restart the Supabase instance for the changes to take effect. Perform this operation during off-peak hours.

#### Configuration Steps

1. On the Third-Party Login page, click Configure in the Email Service section.

<!-- image-todo -->

2. Turn on the service switch and configure the following parameters based on the information provided by your email service provider:

| Parameter | Required | Description |
| --- | --- | --- |
| Sender Email Address | Yes | The email address used to send authentication emails. |
| Sender Display Name | No | The sender name displayed to recipients. |
| SMTP Server Address | Yes | The SMTP server address provided by your email service provider. |
| SMTP Port | Yes | Select SSL implicit encryption (465) or TLS explicit encryption (587). |
| SMTP Authentication Account | Yes | The account used to log in to the SMTP server. |
| SMTP Authentication Password/Authorization Code | Yes | The password or authorization code for the SMTP account. Follow the requirements of your email service provider. |

3. Select "I understand that the instance must be manually restarted for the configuration to take effect" and click Save Configuration.

4. Return to the Third-Party Login page, click Restart and Apply Configuration, and wait for the Supabase instance to restart.

5. Trigger an email sending flow in your business environment to verify that the email service is configured correctly.

> **Note:** After the email configuration is saved, you must manually restart the Supabase instance for the changes to take effect. Before the restart, email login continues to use the previous configuration or remains unavailable.

### SMS Login

SMS login currently supports only ZOSOC USMS as the SMS provider.

#### Prerequisites

- The Supabase instance is in the Running state.
- The NAT gateway is configured, and the instance can access the ZOSOC USMS service.
- You have activated the [ZOSOC USMS cloud communication service](https://console.zosoc.com/usms) and created an available SMS signature and SMS template.
- You have obtained the USMS project ID, Access Key ID, and Key Secret. Use a least-privilege key and keep it secure.
- After the SMS configuration is saved, you must restart the Supabase instance for the changes to take effect. Perform this operation during off-peak hours.

#### Configuration Steps

1. On the Third-Party Login page, click Configure in the SMS Login section.

<!-- image-todo -->

2. Turn on the service switch and select "ZOSOC" as the SMS provider.

3. Configure the basic SMS service information:

| Parameter | Required | Description |
| --- | --- | --- |
| Project ID | Yes | Defaults to the project ID of the current Supabase instance. To change it, refer to the documentation indicated on the page. |
| Access Key ID | Yes | The public key for the ZOSOC account or project. |
| Key Secret | Yes | The private key corresponding to the Access Key ID. |

4. Click Go Now to open the USMS console. Complete the SMS signature and SMS template configuration, then return to this page and enter the SMS Signature ID and SMS Template ID.

5. Select "I understand that the instance must be manually restarted for the configuration to take effect" and click Save Configuration.

6. Return to the Third-Party Login page, click Restart and Apply Configuration, and wait for the Supabase instance to restart.

7. Trigger an SMS sending flow in your business environment to verify that the SMS service is configured correctly.

> **Note:** After the SMS configuration is saved, you must manually restart the Supabase instance for the changes to take effect. The SMS signature, SMS template, and account permissions must meet the USMS service sending requirements.