One thing about the recommended command, for anyone using it as their only backup: --schema=public leaves out auth, so the file has every table and none of the accounts. As a rollback point before a migration that's fine, because you restore into the same project and the users are still there. Not if the project's gone. Restore into a fresh one and nobody can sign in, and if profiles references auth.users (Supabase's own starter does), pg_restore errors on that foreign key too.

A second, data-only dump of the auth schema covers it. Data only, because a new project already has its own auth tables and what you want back is the rows in them. Putting those back has two traps Supabase documents, triggers that have to be off during the replay and a couple of owner lines to comment out, which is most of what I wrote up here: https://reeve.page/blog/supabase-backup-auth-users

Also, pg_restore -l lists what the dump meant to include, not whether the rows made it in. Restoring into a scratch database and counting a few tables is the check that tells you.