Supabase OAuth Server Flutter: 'Sign in With Your App'
Turn your project into an identity provider with this supabase oauth server flutter walkthrough: PKCE authorization code flow, token exchange, userinfo, and a decision guide.
Imagine a "Sign in with Acme" button on someone else's app — and Acme is you. Your Supabase project's users log in once, approve access, and the third-party app gets a scoped token without ever seeing a password. That is what the Supabase OAuth 2.1 server gives you: your project becomes the identity provider, running the same authorization-code-plus-PKCE flow the big platforms use. This guide is the end-to-end supabase oauth server flutter walkthrough: enable the server, register a client, run the PKCE flow from a Flutter app, and read the user's profile from the userinfo endpoint. By the end you will have a working "Sign in with Your App" demo and a clear map of when this beats simpler options. *Last updated: 2026-10-10* What you'll build and learn How the Supabase OAuth 2.1 server turns your project into an identity provider What the authorize, token, userinfo, JWKS, and discovery endpoints each do How to enable the server and register an OAuth client in the dashboard A complete PKCE authorization-code flow in Dart (Flutter 3.47.6, supabase_flutter 2.x) How to exchange the code, read userinfo, and refresh tokens When the OAuth server beats simpler alternatives — and when it is overkill How the Supabase OAuth 2.1 server works Think of it as the inverse of Sign in with Google . In that flow your app trusts Google; here, third-party apps trust *you*. Your Supabase project plays the authorization server: it authenticates your users, shows them a consent screen ("Acme Notes wants to access your profile"), and issues tokens scoped to what they approved. The moving parts are standard OAuth 2.1. The authorize endpoint starts the flow in the user's browser. The token endpoint exchanges the authorization code for tokens. The userinfo endpoint returns…