infrastructure//Supabase//auth

Auth is Supabase's built-in authentication system: OAuth plugs in through its SDK and talks directly to Google's API. Google creates the tokens; Supabase only handles the handshake and stores the result. It wraps the OAuth handshake into a managed flow: the credentials are configured once, and Supabase handles the code exchange, the token storage and the session from then on.

Auth is Supabase's built-in authentication system: OAuth plugs in through its SDK and talks directly to Google's API. Google creates the tokens; Supabase only handles the handshake and stores the result. It wraps the OAuth handshake into a managed flow: the credentials are configured once, and Supabase handles the code exchange, the token storage and the session from then on.

The full chain runs once per user, at the beginning:

1The frontend triggers OAuth2Google shows the consent popup3The user accepts4Google sends a code to the callback URL5Supabase exchanges the code for tokens6The app stores the tokens and the session

The publishable key sits in the frontend so that it knows how to open the OAuth popup. Google's account system sees which site is making the request and asks for consent (This app wants to read your email. Allow?). Once the user accepts, Google still has to know whom the permission is for, and that is the job of the callback URL: Google knows the backend because Supabase's URL was given to it when the Google Cloud project was configured.

Supabase catches the code automatically, verifies it, receives the tokens (access and refresh, for Gmail), creates the user in auth.users and hands the tokens over once. The Gmail tokens are stored in a custom profiles table and the session token goes into the browser's cookies. From then on every request carries identity, and the backend uses the stored Gmail tokens to read email through the Gmail API.

This works because the Client Secret was entered under Credentials in the Google Cloud Console: that is how Supabase proves it is the app's legitimate service during the handshake. Google Cloud is where the app was registered and told to trust Supabase when it sends the app's users. After that single handshake per user everything flows, and RLS on the database side ensures each user only sees their own data.

It works like a toboggan that catches things: the code slides into Supabase, and like a mafia guy it handles everything from there.