Go to Authentication → Sign In / Up (Providers) and make sure:

• Email provider is Enabled.
• Confirm email is ON — this is what makes the 6-digit code / confirmation link get sent.
• Optional: turn on Secure password change and set a minimum password length of 6.

Then Authentication → URL Configuration:

• Site URL → the address where you host this page, e.g. https://your-domain.com (use http://localhost:8000 while testing locally).
• Redirect URLs → add that same address so confirmation links bounce back here.

The default Supabase template only contains a confirmation link. To make the 6-digit code box work, go to Authentication → Email Templates → Confirm signup and add {{ .Token }}.

<h2>Confirm your Usawi Apps account</h2>
<p>Hi {{ .Data.full_name }},</p>
<p>Enter this 6-digit code in the app:</p>
<p style="font-size:28px;letter-spacing:6px;font-weight:700">{{ .Token }}</p>
<p>Or click the link below:</p>
<p><a href="{{ .ConfirmationURL }}">Confirm my email</a></p>

The token expires after 24 hours by default (Authentication → URL Configuration → OTP expiry). Both methods work — the code box and the link.

This page already saves the name in user_metadata, so nothing extra is required. If you also want a queryable table, run this in SQL Editor:

create table if not exists public.profiles (
  id         uuid primary key references auth.users on delete cascade,
  full_name  text,
  email      text,
  created_at timestamptz default now()
);

alter table public.profiles enable row level security;

create policy "own profile readable"
  on public.profiles for select
  using (auth.uid() = id);

create policy "own profile updatable"
  on public.profiles for update
  using (auth.uid() = id);

create or replace function public.handle_new_user()
returns trigger language plpgsql security definer set search_path = public as $$
begin
  insert into public.profiles (id, full_name, email)
  values (new.id, new.raw_user_meta_data->>'full_name', new.email)
  on conflict (id) do nothing;
  return new;
end; $$;

drop trigger if exists on_auth_user_created on auth.users;
create trigger on_auth_user_created
  after insert on auth.users
  for each row execute function public.handle_new_user();

Serve the folder over HTTP — opening index.html straight from disk (file://) blocks the embedded apps and can break auth callbacks:

python3 -m http.server 8000
# then open http://localhost:8000

Common errors:

• “Email rate limit exceeded” — the free tier allows ~2 auth emails per hour. Wait, or plug in your own SMTP under Authentication → SMTP Settings.
• “Invalid login credentials” — the email isn't confirmed yet, or the password is wrong.
• “Email not confirmed” on sign-in — open the Confirm modal and enter the 6-digit code.
• No email arrives — check spam, and confirm Confirm email is ON and your Site URL is registered.
• CORS / network error — the Project URL is mistyped, or you pasted the service_role key.

Dev emails from Supabase are sent from noreply@mail.app.supabase.io.