Your OTP regex assumes six digits. Supabase magic links don't.

Short summary

A hardcoded 6-digit regex for OTP validation silently rejected Supabase's 8-digit codes, breaking authentication for all users except the developer. The fix: use a looser regex (^\d{6,10}$) that tolerates server-side length changes, and strip non-digits to handle pasted content. Key principle: keep client-side token validation looser than server-side verification—the server is the actual authority.

• •Hardcoding OTP length couples client code to mutable server config; use a range instead
• •Client-side format checks are UX affordances only; server validation is the real security boundary
• •Strip non-digits from pasted codes rather than trimming to match user behavior

Generated with AI, which can make mistakes.