How to Add User Login and Signup in a Lovable App

Most real apps need accounts. Lovable integrates with Supabase Auth, which handles email and password login, sessions, and per-user data. This guide adds authentication to an existing Lovable app and makes sure each user only sees their own records.

What you need

• An existing Lovable project with at least one page
• A Supabase account (free tier is fine)
• Your project already connected to Supabase, or willingness to connect it now
• About 20 minutes

Step 1: Connect Supabase to the project

If you have not already, open the Supabase panel in Lovable and link a project. Lovable stores the project URL and the anon key and uses them for both database and auth calls.

Step 2: Ask Lovable to add auth pages

Prompt Lovable to add the sign-up and login flow. It generates the forms, the session handling, and a way to log out. Be explicit that you want email and password auth so it does not guess.

Add Supabase email and password authentication with a Sign Up page, a Log In page, and a Log Out button in the header. Redirect logged-out users to the login page.

Step 3: Protect data with row level security

Auth alone does not stop one user reading another user's rows. You must enable Row Level Security (RLS) on your tables and add a policy that ties each row to its owner. Ask Lovable to do this, or run the SQL yourself in the Supabase SQL editor.

alter table habits enable row level security;

create policy "Users see only their habits"
  on habits for all
  using ( auth.uid() = user_id )
  with check ( auth.uid() = user_id );

Step 4: Test signup and isolation

Create two accounts in the preview, add data with each, and confirm that one account cannot see the other's records. This is the real test that auth and RLS are working together.

Result

Your app now has working accounts. New users can sign up, returning users log in, and the database enforces that each person only ever touches their own data. You can publish with confidence that the basics of security are in place.