oauth/concepts

25 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

OAuth scopes control OIDC data, not database access

OAuth scopes (openid, email, profile, phone) control what user information is included in ID tokens and returned by the UserInfo endpoint. They do not control access to database tables or API endpoints. Row Level Security (RLS) policies must be used to define which OAuth clients can access which data, regardless of the scopes they requested.

Invertase Apple authentication on iOS requires simulator workaround

To test Invertase's React Native Apple authentication functionality on the iOS simulator, remove the `getCredentialStateForUser` check from the implementation.

Apple authentication library options for React Native

Three options are available for Apple authentication in React Native apps: (1) Invertase's React Native Apple Authentication library supporting iOS and Android, (2) react-apple-signin-auth supporting Web (also suggested by Invertase), and (3) Expo's AppleAuthentication library supporting iOS only. Each requires obtaining a Service ID from the Apple Developer Console.

Apple authentication on Android and Web requires tunneled URL registration

To enable Apple sign-up on Android and Web in Expo React Native, you must register the tunneled URL (obtained by running `npx expo start --tunnel`) to the Redirect URLs field in your Supabase dashboard Authentication configuration.

Google authentication library options for React Native

Three options are available for Google authentication in React Native: (1) GN Google Sign In Premium supporting iOS, Android, and Web using Google's One Tap sign-in (requires subscription), (2) @react-oauth/google supporting Web only, and (3) Supabase's signInWithOAuth function supporting iOS, Android, and Web. All require obtaining a Web Client ID from Google Cloud Engine.

Google Sign In Free doesn't support iOS or Android for custom nonce

The GN Google Sign In Free version does not support iOS or Android because it does not allow passing a custom nonce to the sign-in request.

Google authentication on Web with Expo requires tunneled URL registration

When testing Google Sign In on Web with Expo, you must register the tunneled URL to the Authorized JavaScript origins list of your Google Cloud Console's OAuth 2.0 Client IDs configuration to allow Google Sign In to work.

Expo Apple authentication via Expo library requires iOS capability setup

When using Expo's AppleAuthentication library, you must enable the Apple authentication capability in iOS by setting `usesAppleSignIn: true` in the iOS configuration in app.json and adding the plugin `expo-apple-authentication`. The Expo Apple Sign In button does not support the Simulator, requiring testing on a physical device.

Expo web browser plugin configuration for Google authentication

When implementing Google authentication on Web with Expo, enable the `expo-web-browser` plugin in app.json with the configuration `experimentalLauncherActivity: false`.

Invertase React Native Apple authentication requires dependency cleanup on iOS rebuild

Before testing the Invertase React Native Apple authentication on iOS, if you've already built the iOS app, clean the project artifacts using `npx react-native-clean-project clean-project-auto`. If issues persist, completely clear the cache, as many users have reported needing this step.

Custom OAuth/OIDC provider support

Supabase Auth supports integration with OAuth2 or OIDC-compatible providers that are not in the list of built-in social providers through Custom OAuth/OIDC Providers.

Provider tokens usage

Provider tokens and provider refresh tokens returned from OAuth flows can be used to make API calls to the OAuth provider on behalf of the user. For example, a Google provider token can be used to access Google APIs on behalf of the user.

Supabase does not manage provider token refresh

Supabase Auth does not automatically manage refreshing the provider token for users. The application must use the provider refresh token to obtain a new provider token when needed.

Reasons for missing provider refresh token

A provider refresh token may not be returned for two reasons: the OAuth provider does not return a refresh token, or additional scopes need to be specified in the OAuth configuration for the provider to return a refresh token.

Provider tokens not stored in project database

Provider tokens are intentionally not stored in the project's database because they provide access to potentially sensitive user data in third-party systems. Applications have different security and permission requirements, and OAuth scopes may vary significantly between applications.

Safe handling of provider tokens outside browser

If provider tokens need to be used outside of the browser that completed the OAuth flow, they should be sent to a trusted and secure server under your control.

OAuth definition and purpose

OAuth is an open standard for authentication that allows users to log in to one website or application using their credentials from another website or application. It enables users to grant third-party applications access to their online accounts without sharing their passwords.

Social login benefits: user experience

Social login improves user experience because users can register and log in using their existing social media accounts, which is faster and more convenient than creating a new account from scratch. This makes it easier for users to access the application and improves their overall experience.

Social login benefits: user engagement

Social login enables access to additional user data and insights such as interests, demographics, and social connections. This information can be used to tailor content and marketing efforts to better engage users and provide personalized experiences.

Social login benefits: security

Social login improves application security by leveraging the security measures and authentication protocols of social media platforms. This helps protect against unauthorized access and account takeovers.

Sign in with Apple support on Supabase

Supabase Auth supports Sign in with Apple on the web and in native apps for iOS, macOS, watchOS, and tvOS. Support includes OAuth flow on web, Sign in with Apple JS for websites, and native authentication via Apple's Authentication Services.

Three ways to use Sign in with Apple with Supabase

Supabase provides three approaches: (1) OAuth flow on web or web-based apps using Sign in with Apple REST API; (2) Sign in with Apple JS directly in the browser for websites; (3) Native authentication using Apple's Authentication Services for iOS, macOS, watchOS, or tvOS apps.

Amazon Cognito as third-party auth provider

Amazon Cognito User Pools can be used as a third-party authentication provider alongside Supabase Auth or standalone with a Supabase project.

Firebase Auth as third-party provider with Supabase

Firebase Auth can be used as a third-party authentication provider alongside Supabase Auth, or standalone, with your Supabase project. Users authenticate via Firebase and Supabase uses their Firebase JWT tokens.

Auth0 as third-party authentication provider

Auth0 can be used as a third-party authentication provider alongside Supabase Auth, or as a standalone authentication provider with your Supabase project.

Give your agent this brain