diff --git a/.env.example b/.env.example
index 363b424..b32dbb9 100644
--- a/.env.example
+++ b/.env.example
@@ -22,6 +22,15 @@ SUPABASE_URL=
#
# On the Supabase dashboard, it's labeled as "service_role" under "Project API keys"
SUPABASE_SERVICE_KEY=
+SUPABASE_ANON_KEY=
+
+# Frontend Supabase Configuration (used by Vite)
+# These variables are automatically picked up by the frontend build process
+# Note: Vite doesn't expand ${VAR} syntax, so these need explicit values (same as above)
+# Get the ANON (public) key from Supabase Dashboard > Settings > API
+# This is DIFFERENT from the SERVICE_ROLE key - frontend uses ANON key for client-side auth
+VITE_SUPABASE_URL=
+VITE_SUPABASE_ANON_KEY=
# Optional: Set log level for debugging
LOGFIRE_TOKEN=
diff --git a/AUTHENTICATION_SETUP.md b/AUTHENTICATION_SETUP.md
new file mode 100644
index 0000000..937c8d1
--- /dev/null
+++ b/AUTHENTICATION_SETUP.md
@@ -0,0 +1,286 @@
+# Authentication Setup Guide
+
+This guide explains how to set up and use Supabase authentication in Archon.
+
+## Overview
+
+Archon now supports user authentication using Supabase Auth. This allows you to:
+- Create user accounts
+- Secure your data with user-specific access
+- Protect routes and API endpoints
+- Manage sessions and tokens
+
+## Prerequisites
+
+1. A Supabase project (create one at [supabase.com](https://supabase.com))
+2. Node.js and Python environment set up
+
+## Step 1: Verify Environment Variables
+
+The authentication system uses the Supabase configuration already present in your root `.env` file:
+
+```bash
+# Supabase Configuration (Backend)
+SUPABASE_URL=https://supabase.automatizase.com.br
+SUPABASE_SERVICE_KEY=eyJhbGc... # Your service role key
+SUPABASE_ANON_KEY=eyJhbGc... # Your anon/public key
+
+# Frontend Supabase Configuration (automatically configured)
+VITE_SUPABASE_URL=${SUPABASE_URL}
+VITE_SUPABASE_ANON_KEY=${SUPABASE_ANON_KEY}
+```
+
+**Important Notes:**
+- The frontend uses `VITE_SUPABASE_ANON_KEY` (safe for client-side)
+- The backend uses `SUPABASE_SERVICE_KEY` (server-side only)
+- These variables are automatically loaded from the root `.env` file
+- The Vite config has been updated to read from the root directory
+
+## Step 2: Install Frontend Dependencies
+
+```bash
+cd archon-ui-main
+npm install
+```
+
+This will install the `@supabase/supabase-js` package required for authentication.
+
+## Step 3: Enable Email Authentication in Supabase
+
+1. Go to **Authentication** > **Providers** in your Supabase Dashboard
+2. Enable **Email** provider
+3. Configure email templates if desired
+4. Add allowed redirect URLs:
+ - Development: `http://localhost:3737/*`
+ - Production: Your production URL
+
+## Step 4: Enable Authentication Middleware (Optional)
+
+By default, the authentication middleware is **disabled** to avoid breaking existing installations. To enable it:
+
+1. Open `python/src/server/main.py`
+2. Find the section labeled "Authentication Middleware (OPTIONAL)"
+3. Uncomment the two lines:
+ ```python
+ from .middleware.auth_middleware import AuthMiddleware
+ app.add_middleware(AuthMiddleware)
+ ```
+
+When enabled, all API routes will require authentication except:
+- `/health` - Health check
+- `/docs`, `/redoc`, `/openapi.json` - API documentation
+- `/api/auth/*` - Authentication endpoints
+
+## Step 5: Start the Application
+
+```bash
+# Frontend
+cd archon-ui-main
+npm run dev
+
+# Backend
+cd python
+uv run python -m src.server.main
+```
+
+## Step 6: Create Your First User
+
+1. Navigate to `http://localhost:3737/signup`
+2. Enter your email and password
+3. You'll be automatically logged in and redirected to the dashboard
+
+## Features
+
+### Frontend Features
+
+- **Login Page** (`/login`) - Sign in with email/password
+- **Sign Up Page** (`/signup`) - Create a new account
+- **Protected Routes** - All main routes require authentication
+- **AuthContext** - Global authentication state management
+- **Persistent Sessions** - Sessions saved in localStorage
+
+### Backend Features
+
+- **JWT Token Validation** - Verify Supabase JWT tokens
+- **Auth Middleware** - Protect API routes automatically
+- **User Context** - Access current user in request handlers
+- **Auth Service** - Reusable authentication utilities
+
+## Usage in Components
+
+### Using Auth Context
+
+```typescript
+import { useAuth } from '@/features/auth/context/AuthContext';
+
+function MyComponent() {
+ const { user, isAuthenticated, isLoading, signOut } = useAuth();
+
+ if (isLoading) return