What happened

Task: Configure Supabase Auth to send a numeric email OTP instead of a magic link, while the iOS client accepts exactly 6 digits.

Skill said: The skill correctly required checking current documentation and verifying the change, but it did not include an Auth email-OTP workflow or warn that rendering {{ .Token }} only changes the template content. We updated the Magic Link or OTP template to say “6-digit code” without first checking the project’s MAILER_OTP_LENGTH setting.

Expected: When configuring an email OTP template, the workflow should explicitly inspect Authentication → Sign In / Providers → Email → Email OTP length, compare it with any hard-coded template wording and client-side validation, update the value if needed, and then request a new OTP to verify the emitted digit count. In this case the project was configured for 8 digits while the Swift app only accepted 6, so the emailed code could not be entered successfully.

Source

File: SKILL.md

Section: Core Principles > 2. Verify your work and Supabase Documentation

Fix suggestion

Add an Email OTP consistency checklist to the Auth guidance:

1. Confirm the client calls the OTP endpoint and uses {{ .Token }} in the relevant template.
2. Read MAILER_OTP_LENGTH / Dashboard “Email OTP length”; do not infer digit count from template wording.
3. Match backend length, email copy, UI input limit, and client validation.
4. Check OTP expiration against template copy as well.
5. Send a fresh OTP after saving and verify the actual length and end-to-end sign-in.