Demo, all content is generated
Question

How do I show other users' emails in my app? auth.users isn't accessible

Open · 371 views · asked by frankie_r · edited

Team page should list members with their email. supabase.from('users') doesn't find anything and auth.users gives relation "public.auth.users" does not exist or permission denied depending on how I try. The emails are right there in the Authentication tab.

What I’ve tried

Tried .schema('auth').from('users'), got an error about the schema not being exposed.

Comment
Do team members need to see emails of people outside their own team, or only teammates? mira_dev · edited
only teammates frankie_r · edited

3 answers

mira_dev · edited

auth.users is deliberately not reachable from the API. The usual pattern is a profiles table in public that you fill with a trigger on signup, and only copy what the app needs:

create table public.profiles (
  id uuid primary key references auth.users on delete cascade,
  email text,
  display_name text
);

Then an RLS policy so people only see profiles of members in their own team (not everyone). For existing users, backfill once with insert into public.profiles (id, email) select id, email from auth.users;.

Keep in mind the copy won't follow email changes unless you also add an update trigger.

Comment
ok this makes sense. Lovable actually made a profiles table already but without email. adding it now frankie_r · edited
amir_h · edited

Also ask yourself if members really need to see each other's email. Display name plus "message" button is often enough, and it's one less thing to leak.

Comment
the_real_omar · edited

Great question! Accessing user emails in Supabase can be tricky. Here are several approaches you can consider:

  1. Use the Admin API: You can use supabase.auth.admin.listUsers() to fetch all users including their emails.
  2. Create a view: You can create a view that exposes auth.users to the public schema.
  3. Use the service role key: Initialize your client with the service role key to bypass restrictions.

Each approach has its pros and cons depending on your use case. I hope this helps! Let me know if you have any other questions.

Comment
Please don't do 2 or 3 in a frontend app. A plain view on auth.users in public exposes every email to anyone with the anon key, and the admin API needs the service role key. mira_dev · edited