App review says they can't log in, but my login is a magic link

A reviewer account with a password is normal and allowed. Apple's own form has "Sign-in required" with username and password fields for exactly this. The sketchy part would be a hardcoded backdoor, so do it properly:

• Create one real user in Supabase with a password (supabase.auth.admin.createUser with email_confirm: true).
• In the app, add a small "Sign in with password" link under the magic link button. It's fine for everyone to see it.
• Give that account demo data so the reviewer sees something.

Don't hardcode the password anywhere in the app.

Alternative that keeps the UI magic-link only: switch to email OTP (a 6 digit code). Supabase supports it with the same email template, just use {{ .Token }}. Then for the reviewer email you can set a fixed OTP... except Supabase doesn't support fixed OTPs, so you'd still need the password route. I'd just do what amir_h says.