How to fix hook_timeout: Auth hook timed out in Supabase

# Navigate to Authentication > Hooks in Supabase Dashboard
# Or check your supabase/config.toml file

// ❌ BAD - Makes external API call
export async function POST(request: Request) {
  const { user } = await request.json();

  // This could timeout!
  await supabase.auth.admin.updateUserById(user.id, {
    app_metadata: { role: 'user' }
  });

  return Response.json({ user });
}

// ✅ GOOD - Lightweight processing only
export async function POST(request: Request) {
  const { user } = await request.json();

  // Just add claims, don't make API calls
  return Response.json({
    user: {
      ...user,
      app_metadata: {
        ...user.app_metadata,
        role: 'user'
      }
    }
  });
}

-- ❌ BAD - Complex queries in hook
CREATE OR REPLACE FUNCTION custom_access_token_hook(event jsonb)
RETURNS jsonb AS $$
BEGIN
  -- Heavy query could timeout
  SELECT * FROM large_table WHERE user_id = (event->>'user_id')::uuid;
  RETURN event;
END;
$$ LANGUAGE plpgsql;

-- ✅ GOOD - Minimal processing
CREATE OR REPLACE FUNCTION custom_access_token_hook(event jsonb)
RETURNS jsonb AS $$
BEGIN
  -- Simple, fast operation
  RETURN jsonb_set(event, '{claims,role}', '"user"');
END;
$$ LANGUAGE plpgsql;

-- Create a trigger that runs AFTER user creation
CREATE OR REPLACE FUNCTION handle_new_user()
RETURNS trigger AS $$
BEGIN
  -- This runs outside the auth transaction
  INSERT INTO public.profiles (id, email)
  VALUES (NEW.id, NEW.email);
  RETURN NEW;
END;
$$ LANGUAGE plpgsql;

CREATE TRIGGER on_auth_user_created
  AFTER INSERT ON auth.users
  FOR EACH ROW EXECUTE FUNCTION handle_new_user();

// Handle heavy operations after successful auth
const { data, error } = await supabase.auth.signUp({
  email: '[email protected]',
  password: 'password123'
});

if (data.user) {
  // Now make your API calls outside the auth flow
  await fetch('/api/setup-user-profile', {
    method: 'POST',
    body: JSON.stringify({ userId: data.user.id })
  });
}

// In your auth hook, just queue a job
export async function POST(request: Request) {
  const { user } = await request.json();

  // Fast operation - just queue for later
  await queue.publish('user-created', { userId: user.id });

  return Response.json({ user });
}

// ❌ NEVER DO THIS in an auth hook
export async function POST(request: Request) {
  const { user } = await request.json();

  // This will always timeout because the auth transaction is locked
  await supabase.auth.admin.updateUserById(user.id, {
    app_metadata: { onboarded: true }
  });

  return Response.json({ user });
}

// ✅ Instead, modify the returned object directly
export async function POST(request: Request) {
  const { user } = await request.json();

  // Modify the user object being returned
  const updatedUser = {
    ...user,
    app_metadata: {
      ...user.app_metadata,
      onboarded: true
    }
  };

  return Response.json({ user: updatedUser });
}

// Deploy as Edge Function for low latency
import { serve } from 'https://deno.land/[email protected]/http/server.ts';

serve(async (req) => {
  // Set aggressive timeout
  const controller = new AbortController();
  const timeoutId = setTimeout(() => controller.abort(), 4000); // 4s max

  try {
    const { user } = await req.json();

    // Fast, synchronous processing only
    const claims = {
      role: user.email?.endsWith('@admin.com') ? 'admin' : 'user'
    };

    clearTimeout(timeoutId);
    return new Response(JSON.stringify({ user, claims }), {
      headers: { 'Content-Type': 'application/json' }
    });
  } catch (error) {
    clearTimeout(timeoutId);
    // Return user unchanged on error
    return new Response(JSON.stringify({ user: req.user }), {
      status: 200,
      headers: { 'Content-Type': 'application/json' }
    });
  }
});

-- Check for locks in auth schema
SELECT
  pid,
  usename,
  pg_blocking_pids(pid) as blocked_by,
  query as blocked_query
FROM pg_stat_activity
WHERE
  (pg_blocking_pids(pid)::text != '{}')
  AND query LIKE '%auth%';

-- Check long-running transactions
SELECT
  pid,
  now() - pg_stat_activity.query_start AS duration,
  query,
  state
FROM pg_stat_activity
WHERE state != 'idle'
  AND now() - pg_stat_activity.query_start > interval '1 second'
ORDER BY duration DESC;

// Test HTTP hook locally
async function testHook() {
  const startTime = Date.now();

  const response = await fetch('http://localhost:54321/functions/v1/auth-hook', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      user: { id: 'test-id', email: '[email protected]' }
    })
  });

  const duration = Date.now() - startTime;
  console.log(`Hook took ${duration}ms`);

  if (duration > 4000) {
    console.warn('⚠️ Hook is too slow! Must be under 5000ms');
  }
}

-- Enable timing
\timing on

-- Test your hook
SELECT custom_access_token_hook('{"user_id": "test-id"}'::jsonb);

-- Should complete in under 2000ms

# supabase/config.toml
[auth.hook.custom_access_token]
enabled = false
# uri = "..."

supabase db push