What is the difference between using Supabase Auth and rolling your own JWT-based authentication?

Supabase Auth is a managed identity service: it stores users in auth.users, issues and refreshes JWTs, handles password hashing and reset flows, and wires several OAuth providers, all pre-integrated with Row Level Security so auth.uid() is available inside your policies for free.

Rolling your own JWT auth means owning every part of that: password storage and hashing, token issuance and rotation, OAuth provider integration, session revocation, and connecting the resulting identity into your database's authorization checks manually. It offers more control — useful if you need a non-standard identity model or must integrate with an existing enterprise identity provider Supabase doesn't support out of the box — but it also means owning the security surface area that Supabase Auth already covers, including edge cases like token refresh races and email verification flows.

Most teams start with Supabase Auth and only move to a custom or external solution when a specific requirement (like a particular SSO protocol) isn't supported.