Does auth.users ever clean itself? Like does it auto remove rows where email_confirmed_at == null or something? after x amount of time?

I don't believe so. pg_cron is an optional extension so that is not being used and I have 2 month old fake users sitting with out email confirmed.

That makes sense. Dose the

token

in the URL have an expiration?

24 hours I'm pretty sure. Same for magic links.

Makes sense !

I'm more worried about the auth.refresh_tokens table... but I figure other large players will hit it and some resolution will come up before I get there. I've not researched it though.

Hmm

Worried is probably too strong, I've just noticed it and thought may want to clean it myself some day with chron.

Yeah I get that. Seems like a problem that'll come from being successful lol

The size of that table is probably the least of your worries if you have that many users...

Yeah absolutely . Thanks