I launched Repplo (DM reply tool for creators) a couple weeks ago. Numbers looked off. Traced it back to the login verification step.
Bug 1: OTP verification was waiting on a Supabase promise to redirect. Supabase fires SIGNED_IN on the auth state listener before that promise settles. No listener = spinner hangs forever even though the session is active.
Bug 2: Service worker was caching navigate requests. Redirect to the app was taking 8+ seconds despite the server responding in 200ms.
Together they created a flow where users entered their code, saw a spinner, waited, and left. Fully authenticated the whole time. Fixes were small. The cost wasn't.
If you're building a PWA with Supabase OTP auth — add onAuthStateChange as your redirect source of truth, not the verifyOtp() promise. And passthrough all navigate requests in your service worker.