add-external-oauth

Implement Next.js as the OAuth client: create API routes for the authorization redirect and callback, exchange the code with PKCE, then provision users via the Supabase Admin API. Self-hosted Supabase does not expose IDP configuration, so the built-in OAuth flow cannot be used.

Generate a 32-byte random code_verifier encoded as base64url, then create the code_challenge as its SHA-256 hash. Send the challenge to the authorize endpoint and the verifier during token exchange, storing the verifier in an AES-256-GCM encrypted state cookie.

Manually setting sb-access-token cookies does not match the format Supabase SSR middleware expects. Use createServerClient from @supabase/ssr and call supabase.auth.setSession() with the access and refresh tokens so cookies are written in the correct format.

Some providers return email in the access_token or userinfo endpoint instead of the id_token, and claim names vary (preferred_username, upn, mail, login). Decode all token sources and check multiple claim name variants when normalizing user data.

No, the Supabase Admin API does not provide getUserByEmail. You must paginate through auth.admin.listUsers() and match the email address case-insensitively to find an existing user before creating a new one.

It supports Azure AD, Google, Okta, Auth0, and any generic OIDC-compliant provider configured through environment variables. Each provider supplies authorization, token, JWKS, and issuer URLs, with optional userinfo endpoints.