oauth providers/auth0

10 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Auth0 integration setup steps

To set up Auth0 with Supabase: (1) Add an integration to connect your Supabase project with your Auth0 tenant, providing the tenant ID and region ID if applicable. (2) Add a new Third-party Auth integration in the project's Authentication settings. (3) Assign the 'authenticated' custom claim to all JWTs using an Auth0 Action. (4) Set up the Supabase client in your application.

Auth0 configuration in supabase/config.toml

In the CLI, add Auth0 configuration to supabase/config.toml under [auth.third_party.auth0] with the following keys: enabled (boolean), tenant (string, required - the Auth0 tenant ID), tenant_region (string, optional - include if your tenant has a region).

Auth0 role claim requirement for Supabase

Supabase inspects the 'role' claim in JWTs to assign the correct Postgres role for Data API, Storage, and Realtime authorization. By default, Auth0 JWTs do not contain a 'role' claim, which causes the 'anon' role to be assigned. Most app logic requires the 'authenticated' role, so a custom 'role' claim must be added to JWTs.

Auth0 Action to add role claim to ID tokens

Use the onExecutePostLogin Auth0 Action to add the role claim to ID tokens. The Action code should be: exports.onExecutePostLogin = async (event, api) => { api.idToken.setCustomClaim('role', 'authenticated') }. This must be set on ID tokens, not access tokens, because Auth0 silently strips non-namespaced custom claims from access tokens.

Auth0 JWT must use ID token for Supabase

Auth0 JWTs must use the ID token when passing to Supabase, not the access token. Auth0 silently strips non-namespaced custom claims from access tokens, so setting the 'role' claim on the access token does not work. Supabase requires the literal 'role' claim key in the JWT.

TypeScript example: Auth0 client setup with Supabase

import { createClient } from '@supabase/supabase-js' import { createAuth0Client } from '@auth0/auth0-spa-js' const auth0 = await createAuth0Client({ domain: '<AUTH0_DOMAIN>', clientId: '<AUTH0_CLIENT_ID>', authorizationParams: { redirect_uri: '<MY_CALLBACK_URL>', }, }) const supabase = createClient( 'https://<supabase-project>.supabase.co', 'SUPABASE_PUBLISHABLE_KEY', { accessToken: async () => { const idToken = (await auth0.getIdTokenClaims())?.__raw if (!idToken) throw new Error('Missing ID token') return idToken }, } )

Swift example: Auth0 client setup with Supabase

import Auth0 import Supabase extension CredentialsManager { static let shared = Auth0.CredentialsManager(authentication: Auth0.authentication()) } let supabase = SupabaseClient( supabaseURL: URL(string: "https://<supabase-project>.supabase.co")!, supabaseKey: "SUPABASE_PUBLISHABLE_KEY", options: SupabaseClientOptions( auth: Sup••••••ns.AuthOptions( accessToken: { try await CredentialsManager.shared.credentials().idToken } ) ) )

Flutter example: Auth0 client setup with Supabase

import 'package:auth0_flutter/auth0_flutter.dart'; import 'package:flutter/material.dart'; import 'package:supabase_flutter/supabase_flutter.dart'; Future<void> main() async { final auth0 = Auth0('AUTH0_DOMAIN', 'AUTH0_CLIENT_ID'); await Supabase.initialize( url: 'https://<supabase-project>.supabase.co', publishableKey: 'SUPABASE_PUBLISHABLE_KEY', accessToken: () async { final credentials = await auth0.credentialsManager.credentials(); return credentials.idToken; }, ); runApp(const MyApp()); }

Kotlin example: Auth0 client setup with Supabase

import com.auth0.android.result.Credentials val supabase = createSupabaseClient( "https://<supabase-project>.supabase.co", "SUPABASE_PUBLISHABLE_KEY" ) { accessToken = { val credentials: Credentials = ...; // Get credentials from Auth0 credentials.idToken } }

Auth0 signing algorithms not supported with Supabase

Auth0 tenants using the following signing algorithms are not supported with Supabase: HS256 (HMAC with SHA-256, also known as symmetric JWTs) and PS256 (RSA-PSS with SHA-256).

Give your agent this brain