Skip to main content
Streamly uses Supabase Auth with two isolated cookie jars so the operator console and viewer storefront never share a session by accident. Implemented in lib/supabase/auth-scope.ts.

​
Operator flow (production)

  1. Open /admin/login.
  2. Enter your Envato/CodeCanyon purchase code (verified with ENVATO_PERSONAL_TOKEN in production). Optional: restrict to one item with ENVATO_ITEM_ID.
  3. Streamly sends a magic-link email via Resend (RESEND_API_KEY + STREAMLY_FROM_EMAIL).
  4. If the account is unverified, the operator is sent to /verify-email until verification completes.
  5. After success → /admin/overview (or /admin/onboarding when required).
On real installs, Resend is required for operator sign-in (unless you intentionally enable the demo license gate). Treat RESEND_API_KEY as a launch blocker, not optional polish.

​
Demo license (sandbox only)

When ENABLE_DEMO=true or ADMIN_ALLOW_DEMO_LICENSE is set: Turn demo flags off on production buyer installs.

​
Viewer flow

  1. Viewer opens /login or /signup.
  2. Supabase issues a session stored in the viewer cookie jar.
  3. /auth/callback completes OAuth / magic-link style redirects when used.
  4. Middleware may require a Who’s Watching profile (/profiles) before gated routes.
  5. /movies and /shows require authentication.
Optional demo viewer (auto-created when configured): demo@streamly.watch / demo123456 — not the operator account.

​
Refresh

/api/auth/refresh renews sessions. Middleware stays intentionally small for Cloudflare Worker size limits. Landing helpers: /api/landing/session, /api/landing/logout.