I’m building an extension for Google Chrome and using supabase-js to handle the authentication. I’m creating the supabase client and interacting with it from the service worker.

I’m having issues with the reset password flow. Since the user is not authenticated by the time they are resetting their password, no session exists, and I get an “”Auth Session Missing”” error when calling supabase.auth.updateUser()

To solve, I am trying to create a new session before calling updateUser(). The issue is the access_token and refresh_token are missing from the URL in the email sent from Supabase. The email structure is shown below:

https://abc123.supabase.co/auth/v1/verify?token=76dfa790e3f0c476e5344cc7a4c29e90a8d1566e42db0e306397dc13&type=recovery&redirect_to=https://abc123.org/

How am I supposed to create a new session if there isn’t an access_token and refresh_token? What is the token I’m being sent?

It seems like supabase is expecting supabase.auth.onAuthStateChange to get triggered, and I’d call the function from there, but it is not receiving the event. (possibly because it’s being forwarded to a new tab and not the extension popup).

Is there a different function I should be using to get the access_token and refresh_token in the URL?

Thanks