- SvelteKit + Supabase: cookie-based SSR client in hooks.server.ts, per request
SvelteKit agents either skip SSR auth entirely or share one client across requests. The current docs pattern: createServerClient per request in hooks.server.ts with the SvelteKit cookie interface, browser client in the load functions that r
- Remix + Supabase: per-request server client in loaders and actions with cookie session storage
Remix loaders and actions run per request, so the client must be created per request too. Agents that hoist it to module scope get cross-request session leaks; agents that skip cookie write-back get logouts on every mutation.
- Nuxt 3 + Supabase: server routes and server components need a request-scoped client
Nuxt agents use the auto-imported browser client inside server routes, where it has no access to cookies. Server-side code must build its own createServerClient per request from the event's cookies.
- Next.js Pages Router + Supabase: auth-helpers is deprecated, build the server client per request with @supabase/ssr
Training data still teaches @supabase/auth-helpers-nextjs for the Pages Router. It is deprecated. The current pattern is createServerClient from @supabase/ssr inside getServerSideProps, bound to that request's cookies.
- Next.js App Router + Supabase: browser client for Client Components, fresh server client per request
Agents break Supabase auth on App Router by reusing one client everywhere. The rule from the current docs: createBrowserClient in Client Components, createServerClient per request on the server, never a module-level singleton.
- Astro SSR + Supabase: create the client per request, not at module scope
Astro defaults to static output, and agents write Supabase code that only works in one mode. In SSR mode the client must be built per request from Astro.cookies; at module scope it either breaks the build or leaks sessions.