Idea: document what

.setAuth()

doesn't do - I see people trying to use it like it's an API for signing in with access_token, when it seems to be a very low level tool.

@User looks like its documentded here! https://supabase.com/docs/reference/javascript/auth-setauth

It's not missing from the documentation, I just think it would make sense to add a note (somewhere high on the page) that says when this function should, and when it should not be used.

Well in the docs it shows examples

yes, it is in the docs and it has examples. And people take those examples and use it, for example after getting the access_token from an invite or log in link. Instead of using signIn with refresh_token. I've went down the wrong path too (with the Python SDK, but still) - only after looking at SDK's code I've understood that setAuth should only be used in some very specific contexts, where the refresh_token is not available at all.