Every OAuth provider: setup reference

SupaHost supports 19 OAuth providers. Every one follows the same three steps, so this page only lists what differs. For the full walkthrough of the shared steps, read Social login (OAuth) first. Google, GitHub and Apple have their own pages: Google, GitHub, Apple.

The shared steps

1. Copy the callback URL from Dashboard → your project → Auth tab → OAuth providers. It's the same for every provider: https://<project host or active custom domain>/auth/v1/callback, for example https://app-one.acme.supahost.space/auth/v1/callback.
2. Create an app at the provider and paste that URL wherever it asks for a redirect, callback or return URL.
3. Enable the provider in SupaHost: click its row in the OAuth providers card, switch on Enabled, paste the ID and secret, fill the URL field if there is one, and click the save button. Secrets are stored encrypted and never shown again; leave the secret field empty to keep the stored one. Changes apply within about a minute.

Then call signInWithOAuth with the provider's key from the table below, and add your app's landing pages to Redirect URLs on the Auth card.

Provider table

URL fields must start with https://.

Notes per provider

Microsoft (Azure)

• In Certificates & secrets, create a client secret and copy its Value, not its Secret ID.
• Tenant URL limits sign-in to one directory, for example https://login.microsoftonline.com/0f1e2d3c-4b5a-6978-8f9e-a0b1c2d3e4f5. Leave it empty to accept any Microsoft account the app registration allows.
• Ask for the email scope so Auth receives an address:

await supabase.auth.signInWithOAuth({ provider: 'azure', options: { scopes: 'email', redirectTo } })

GitLab

Use GitLab URL (self-hosted only) only for a self-managed GitLab, such as https://gitlab.example.com. Leave it empty for gitlab.com.

Keycloak

Realm URL is required and points at the realm, not the admin console: https://keycloak.example.com/realms/staff. In the client, set Valid redirect URIs to the SupaHost callback URL and copy the secret from the Credentials tab. Request the openid scope:

await supabase.auth.signInWithOAuth({ provider: 'keycloak', options: { scopes: 'openid', redirectTo } })

LinkedIn and Slack

Both use their OpenID Connect versions, so the keys are linkedin_oidc and slack_oidc. LinkedIn asks you to associate the app with a LinkedIn company page before it can be created.

X (Twitter)

The twitter provider uses OAuth 1.0a, so the credentials are the app's API key and API secret key from "Keys and tokens" (the consumer keys), not the OAuth 2.0 client ID. Turn on "Request email from users" in the app's user authentication settings, or users arrive without an email address.

WorkOS

WorkOS fronts enterprise SSO connections (SAML, Okta, Entra ID and others). The client secret is your WorkOS API key. WorkOS URL is optional and defaults to WorkOS's public API. Tell WorkOS which connection or organization to use when you start sign-in:

await supabase.auth.signInWithOAuth({
  provider: 'workos',
  options: { redirectTo, queryParams: { organization: 'org_01HZX3EXAMPLE' } },
})

Kakao

The client ID field is labelled REST API key: copy it from the app's keys page. Enable the client secret in the app's security settings and paste it as the secret.

Facebook, Discord, Spotify, Twitch, Figma, Notion, Zoom, Bitbucket

These need nothing beyond the shared steps. Ask for any extra permissions in the provider's console, or with scopes when you call signInWithOAuth.

Checklist when a provider doesn't work

1. The provider row shows Enabled, and both the ID and a secret were saved. A provider isn't switched on without both.
2. The callback URL at the provider matches the one in the card exactly. If you added a custom domain, the callback host changed.
3. Your redirectTo is in Redirect URLs.
4. You waited a minute after saving.

See Redirected to the wrong URL and OAuth broke after adding a custom domain for the usual causes.