# Every OAuth provider: setup reference

> Setup reference for all 19 OAuth providers on SupaHost: the provider key for signInWithOAuth, where to create the app, what to paste into the Auth tab, and the extra URL fields.

Source: https://supahost.app/docs/auth/oauth-providers · Updated 2026-11-11

SupaHost supports 19 OAuth providers. Every one follows the same three steps, so this page only lists what differs. For the full walkthrough of the shared steps, read [Social login (OAuth)](/docs/auth/social-login) first. Google, GitHub and Apple have their own pages: [Google](/docs/auth/google), [GitHub](/docs/auth/github), [Apple](/docs/auth/apple).

## The shared steps

1. **Copy the callback URL** from *Dashboard → your project → **Auth** tab → **OAuth providers***. It's the same for every provider: `https://<project host or active custom domain>/auth/v1/callback`, for example `https://app-one.acme.supahost.space/auth/v1/callback`.
2. **Create an app at the provider** and paste that URL wherever it asks for a redirect, callback or return URL.
3. **Enable the provider in SupaHost**: click its row in the **OAuth providers** card, switch on **Enabled**, paste the ID and secret, fill the URL field if there is one, and click the save button. Secrets are stored encrypted and never shown again; leave the secret field empty to keep the stored one. Changes apply within about a minute.

Then call `signInWithOAuth` with the provider's key from the table below, and add your app's landing pages to **Redirect URLs** on the **Auth** card.

## Provider table

| Provider | Key | Where to create the app | What to create | Fields in SupaHost |
|---|---|---|---|---|
| Google | `google` | [Google Cloud console](https://console.cloud.google.com/apis/credentials) | OAuth client ID, type "Web application" | Client ID, Client secret |
| GitHub | `github` | [GitHub developer settings](https://github.com/settings/developers) | OAuth App | Client ID, Client secret |
| Apple | `apple` | [Apple Developer: Services IDs](https://developer.apple.com/account/resources/identifiers/list/serviceId) | App ID, Services ID and a Sign in with Apple key | Services ID, Secret key (JWT generated from your .p8 key) |
| Microsoft (Azure) | `azure` | [Azure portal: App registrations](https://portal.azure.com/#view/Microsoft_AAD_RegisteredApps) | App registration with a Web redirect URI, plus a client secret | Application (client) ID, Client secret, Tenant URL (optional) |
| GitLab | `gitlab` | [GitLab applications](https://gitlab.com/-/user_settings/applications) | Application, confidential, scope `read_user` | Client ID, Client secret, GitLab URL (self-hosted only, optional) |
| Bitbucket | `bitbucket` | [Bitbucket settings](https://bitbucket.org/account/settings/) | OAuth consumer with Account: Email and Read permissions | Key, Client secret |
| Discord | `discord` | [Discord developer portal](https://discord.com/developers/applications) | Application, with the callback under OAuth2 → Redirects | Client ID, Client secret |
| Facebook | `facebook` | [Meta for Developers](https://developers.facebook.com/apps) | App with Facebook Login; callback in "Valid OAuth Redirect URIs" | App ID, App secret |
| Figma | `figma` | [Figma developer apps](https://www.figma.com/developers/apps) | App with a redirect URL and the user-read scope | Client ID, Client secret |
| Kakao | `kakao` | [Kakao developers console](https://developers.kakao.com/console/app) | App with Kakao Login on, the callback as Redirect URI, and a client secret | REST API key, Client secret |
| Keycloak | `keycloak` | Your Keycloak admin console ([docs](https://www.keycloak.org/docs/latest/server_admin/)) | OpenID Connect client with client authentication on | Client ID, Client secret, **Realm URL (required)** |
| LinkedIn | `linkedin_oidc` | [LinkedIn developer apps](https://www.linkedin.com/developers/apps) | App with the "Sign In with LinkedIn using OpenID Connect" product | Client ID, Client secret |
| Notion | `notion` | [Notion integrations](https://www.notion.so/my-integrations) | Public integration (OAuth) with the callback as a redirect URI | OAuth client ID, Client secret |
| Slack | `slack_oidc` | [Slack apps](https://api.slack.com/apps) | App with "Sign in with Slack" (OpenID Connect) and the callback under Redirect URLs | Client ID, Client secret |
| Spotify | `spotify` | [Spotify developer dashboard](https://developer.spotify.com/dashboard) | App with the callback as a Redirect URI | Client ID, Client secret |
| Twitch | `twitch` | [Twitch developer console](https://dev.twitch.tv/console/apps) | Application, client type Confidential | Client ID, Client secret |
| X (Twitter) | `twitter` | [X developer portal](https://developer.x.com/en/portal/dashboard) | App with OAuth 1.0a user authentication and "Request email from users" | API key, API secret key |
| WorkOS | `workos` | [WorkOS dashboard](https://dashboard.workos.com) | Redirect URI under Redirects; client ID and API key | Client ID, Client secret, WorkOS URL (optional) |
| Zoom | `zoom` | [Zoom App Marketplace](https://marketplace.zoom.us/develop/create) | General (OAuth) app with the callback as redirect URL and allow-listed | Client ID, Client secret |

URL fields must start with `https://`.

## Notes per provider

### Microsoft (Azure)

- In **Certificates & secrets**, create a client secret and copy its **Value**, not its Secret ID.
- **Tenant URL** limits sign-in to one directory, for example `https://login.microsoftonline.com/0f1e2d3c-4b5a-6978-8f9e-a0b1c2d3e4f5`. Leave it empty to accept any Microsoft account the app registration allows.
- Ask for the `email` scope so Auth receives an address:

```ts
await supabase.auth.signInWithOAuth({ provider: 'azure', options: { scopes: 'email', redirectTo } })
```

### GitLab

Use **GitLab URL (self-hosted only)** only for a self-managed GitLab, such as `https://gitlab.example.com`. Leave it empty for gitlab.com.

### Keycloak

**Realm URL** is required and points at the realm, not the admin console: `https://keycloak.example.com/realms/staff`. In the client, set **Valid redirect URIs** to the SupaHost callback URL and copy the secret from the **Credentials** tab. Request the `openid` scope:

```ts
await supabase.auth.signInWithOAuth({ provider: 'keycloak', options: { scopes: 'openid', redirectTo } })
```

### LinkedIn and Slack

Both use their OpenID Connect versions, so the keys are `linkedin_oidc` and `slack_oidc`. LinkedIn asks you to associate the app with a LinkedIn company page before it can be created.

### X (Twitter)

The `twitter` provider uses OAuth 1.0a, so the credentials are the app's **API key** and **API secret key** from "Keys and tokens" (the consumer keys), not the OAuth 2.0 client ID. Turn on "Request email from users" in the app's user authentication settings, or users arrive without an email address.

### WorkOS

WorkOS fronts enterprise SSO connections (SAML, Okta, Entra ID and others). The client secret is your WorkOS API key. **WorkOS URL** is optional and defaults to WorkOS's public API. Tell WorkOS which connection or organization to use when you start sign-in:

```ts
await supabase.auth.signInWithOAuth({
  provider: 'workos',
  options: { redirectTo, queryParams: { organization: 'org_01HZX3EXAMPLE' } },
})
```

### Kakao

The client ID field is labelled **REST API key**: copy it from the app's keys page. Enable the client secret in the app's security settings and paste it as the secret.

### Facebook, Discord, Spotify, Twitch, Figma, Notion, Zoom, Bitbucket

These need nothing beyond the shared steps. Ask for any extra permissions in the provider's console, or with `scopes` when you call `signInWithOAuth`.

## Checklist when a provider doesn't work

1. The provider row shows **Enabled**, and both the ID and a secret were saved. A provider isn't switched on without both.
2. The callback URL at the provider matches the one in the card exactly. If you added a custom domain, the callback host changed.
3. Your `redirectTo` is in **Redirect URLs**.
4. You waited a minute after saving.

See [Redirected to the wrong URL](/kb/redirect-to-wrong-url) and [OAuth broke after adding a custom domain](/kb/oauth-after-custom-domain) for the usual causes.