---
title: "Custom OIDC Providers for Supabase Auth"
description: "Supabase has launched Custom OIDC Providers, enabling projects to connect standards-compliant external OpenID Connect identity providers beyond its built-in social options. Configuration requires an issuer URL, client credentials, and scopes; Supabase automatically resolves the discovery document, endpoints, and JWKS, and verifies ID tokens against the provider’s JWKS. After enablement, users use the standard OAuth sign-in flow through existing JavaScript, Flutter, or Swift clients, while the auth server handles redirects, code exchange, profile retrieval, and user creation or linking. Custom providers include default PKCE, authorization-parameter support, multi-platform audience validation through acceptable_client_ids, and an email_optional setting for providers that do not return email addresses. They can be created, listed, updated, or deleted via the Dashboard or Admin API, with a limit of three per project."
---

# Custom OIDC Providers for Supabase Auth

[Supabase](https://yomu.fyi/company/supabase) · cemal\_kilic · Apr 8, 2026

**Type:** Announcement

## Summary

Supabase has launched Custom OIDC Providers, enabling projects to connect standards-compliant external OpenID Connect identity providers beyond its built-in social options. Configuration requires an issuer URL, client credentials, and scopes; Supabase automatically resolves the discovery document, endpoints, and JWKS, and verifies ID tokens against the provider’s JWKS. After enablement, users use the standard OAuth sign-in flow through existing JavaScript, Flutter, or Swift clients, while the auth server handles redirects, code exchange, profile retrieval, and user creation or linking. Custom providers include default PKCE, authorization-parameter support, multi-platform audience validation through acceptable\_client\_ids, and an email\_optional setting for providers that do not return email addresses. They can be created, listed, updated, or deleted via the Dashboard or Admin API, with a limit of three per project.

## Context

Built-in providers cover common identity systems but do not include every provider, including regional compliance providers, self-hosted services, and niche or industry-specific identity platforms.

## Approach / What changed

Supabase added configurable custom OIDC providers managed through the Dashboard or Auth Admin API. Projects supply an issuer, credentials, and scopes; the auth server discovers provider metadata, performs the OAuth flow, validates ID tokens, and exposes the provider through existing client sign-in methods.

## Takeaways

- The issuer's /.well-known/openid-configuration document, endpoints, and JWKS are resolved automatically, while ID tokens are verified against the provider's JWKS.
- PKCE is enabled by default for every custom provider, with the auth server generating the code challenge and verifier during authorization.
- Projects can configure acceptable\_client\_ids for multi-platform audience validation and email\_optional for providers that do not return email addresses.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [Developer Experience](https://yomu.fyi/topic/developer-experience)

- Source: [Supabase](https://supabase.com/blog/custom-oauth-oidc-providers)
- Source URL: https://supabase.com/blog/custom-oauth-oidc-providers
- Ingested by Yomu: 2026-08-29T16:00:57.259Z

[Read original post](https://supabase.com/blog/custom-oauth-oidc-providers)