Create a registration endpoint (e.g., /register) in your backend.

In the endpoint logic, hash the user’s password and insert the new user into the custom_users table:
```javascript
const bcrypt = require('bcrypt');

app.post('/register', async (req, res) => {
const { email, password } = req.body;
const passwordHash = await bcrypt.hash(password, 10);

const { data, error } = await supabase
.from('custom_users')
.insert([{ email, password_hash: passwordHash }]);
if (error) return res.status(400).json({ error: error.message });
res.status(201).json({ message: 'User registered successfully' });
});
```

Create a login endpoint (e.g., /login) in your backend.

In the endpoint logic, compare the given password to the stored password hash:
```javascript
app.post('/login', async (req, res) => {
const { email, password } = req.body;

const { data, error } = await supabase
.from('custom_users')
.select('*')
.eq('email', email)
.single();
if (error || !data) return res.status(400).json({ error: 'Invalid email or password' });

const isPasswordValid = await bcrypt.compare(password, data.password_hash);
if (!isPasswordValid) return res.status(400).json({ error: 'Invalid email or password' });

res.status(200).json({ message: 'Login successful' });
});
```

To protect certain routes, add a middleware that verifies the user's session or token. You can use jsonwebtoken or any other session management library.

Example middleware to authenticate routes:
```javascript
const jwt = require('jsonwebtoken');

const authenticateToken = (req, res, next) => {
const token = req.headers['authorization'];
if (!token) return res.sendStatus(403);

jwt.verify(token, process.env.JWT_SECRET, (err, user) => {
if (err) return res.sendStatus(403);
req.user = user;
next();
});
};

app.get('/protected', authenticateToken, (req, res) => {
res.status(200).json({ message: 'This is a protected route' });
});
```