Supabase Auth: SSO, Mobile, and Server-side support

Summary

Supabase Auth announces SAML 2.0 Single Sign-On, PKCE support for server-side rendering and mobile authentication, and native Sign in with Apple on iOS. SSO lets users authenticate through a company identity provider, with dashboard configuration, Supabase CLI commands, a `signInWithSSO()` call, and PostgreSQL Row Level Security support using the provider identifier in a user JWT. PKCE addresses implicit-flow risks with a code verifier, code challenge, authorization code, and server-side exchange for a session, enabling same-domain cookies, protected server-rendered pages, and downstream actions after authentication. The release also allows an iOS Bundle ID to be configured for Apple provider access and supports `supabase.auth.signInWithApple()` in supabase-flutter without deep links or parameters. SSO is available on the Pro Plan and above and self-hosted, while server-side Auth using PKCE is now available on all projects.

Takeaways

1. 1

   SAML 2.0 SSO can be configured through the dashboard and Supabase CLI, then initiated with `signInWithSSO()`; its provider identifier can also be used with PostgreSQL Row Level Security for multi-tenant access policies.

2. 2

   PKCE keeps the authorization code exchange tied to a randomly generated code verifier, so intercepting the code alone is insufficient to obtain the user session.

3. 3

   Native Sign in with Apple on iOS requires configuring the app's Bundle ID in the Apple provider settings; supabase-flutter can then call `signInWithApple()` without deep links or parameters.