Custom OIDC Providers for Supabase Auth

Summary

Supabase has launched Custom OIDC Providers, enabling projects to connect standards-compliant external OpenID Connect identity providers beyond its built-in social options. Configuration requires an issuer URL, client credentials, and scopes; Supabase automatically resolves the discovery document, endpoints, and JWKS, and verifies ID tokens against the provider’s JWKS. After enablement, users use the standard OAuth sign-in flow through existing JavaScript, Flutter, or Swift clients, while the auth server handles redirects, code exchange, profile retrieval, and user creation or linking. Custom providers include default PKCE, authorization-parameter support, multi-platform audience validation through acceptable_client_ids, and an email_optional setting for providers that do not return email addresses. They can be created, listed, updated, or deleted via the Dashboard or Admin API, with a limit of three per project.

Takeaways

1. 1

   The issuer's /.well-known/openid-configuration document, endpoints, and JWKS are resolved automatically, while ID tokens are verified against the provider's JWKS.

2. 2

   PKCE is enabled by default for every custom provider, with the auth server generating the code challenge and verifier during authorization.

3. 3

   Projects can configure acceptable_client_ids for multi-platform audience validation and email_optional for providers that do not return email addresses.