---
title: "Supabase Auth: SSO,  Mobile, and Server-side support"
description: "Supabase Auth announces SAML 2.0 Single Sign-On, PKCE support for server-side rendering and mobile authentication, and native Sign in with Apple on iOS. SSO lets users authenticate through a company identity provider, with dashboard configuration, Supabase CLI commands, a `signInWithSSO()` call, and PostgreSQL Row Level Security support using the provider identifier in a user JWT. PKCE addresses implicit-flow risks with a code verifier, code challenge, authorization code, and server-side exchange for a session, enabling same-domain cookies, protected server-rendered pages, and downstream actions after authentication. The release also allows an iOS Bundle ID to be configured for Apple provider access and supports `supabase.auth.signInWithApple()` in supabase-flutter without deep links or parameters. SSO is available on the Pro Plan and above and self-hosted, while server-side Auth using PKCE is now available on all projects."
---

# Supabase Auth: SSO,  Mobile, and Server-side support

[Supabase](https://yomu.fyi/company/supabase) · stojan,joel,kangmingtay · Apr 13, 2023

**Type:** Announcement

## Summary

Supabase Auth announces SAML 2.0 Single Sign-On, PKCE support for server-side rendering and mobile authentication, and native Sign in with Apple on iOS. SSO lets users authenticate through a company identity provider, with dashboard configuration, Supabase CLI commands, a \`signInWithSSO()\` call, and PostgreSQL Row Level Security support using the provider identifier in a user JWT. PKCE addresses implicit-flow risks with a code verifier, code challenge, authorization code, and server-side exchange for a session, enabling same-domain cookies, protected server-rendered pages, and downstream actions after authentication. The release also allows an iOS Bundle ID to be configured for Apple provider access and supports \`supabase.auth.signInWithApple()\` in supabase-flutter without deep links or parameters. SSO is available on the Pro Plan and above and self-hosted, while server-side Auth using PKCE is now available on all projects.

## Context

Enterprise customers commonly require Single Sign-On through their company identity provider, while URL fragments create problems for email verification on server-side routes and the implicit grant flow presents security concerns for mobile applications. Server-side authentication is also needed for same-domain cookies, protected server-rendered pages, and downstream actions after authentication.

## Approach / What changed

Supabase Auth adds SAML 2.0 SSO with dashboard and CLI configuration, PKCE for authorization-code exchanges using a verifier and challenge, and native Sign in with Apple configured through an iOS Bundle ID. The JavaScript client and auth helpers support PKCE, while supabase-flutter exposes native Apple sign-in.

## Takeaways

- SAML 2.0 SSO can be configured through the dashboard and Supabase CLI, then initiated with \`signInWithSSO()\`; its provider identifier can also be used with PostgreSQL Row Level Security for multi-tenant access policies.
- PKCE keeps the authorization code exchange tied to a randomly generated code verifier, so intercepting the code alone is insufficient to obtain the user session.
- Native Sign in with Apple on iOS requires configuring the app's Bundle ID in the Apple provider settings; supabase-flutter can then call \`signInWithApple()\` without deep links or parameters.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [iOS](https://yomu.fyi/topic/ios), [Postgres](https://yomu.fyi/topic/postgres)

- Source: [Supabase](https://supabase.com/blog/supabase-auth-sso-pkce)
- Source URL: https://supabase.com/blog/supabase-auth-sso-pkce
- Ingested by Yomu: 2026-08-29T01:17:20.877Z

[Read original post](https://supabase.com/blog/supabase-auth-sso-pkce)