infrastructure//Supabase//auth//handshake

The handshake is the one-time exchange in which Google and Supabase establish trust for a user. It happens once per user, at login, and after it everything flows.

The handshake is the one-time exchange in which Google and Supabase establish trust for a user. It happens once per user, at login, and after it everything flows.

1The frontend calls supabase.auth.signInWithOAuth({ provider: 'google' })2The SDK opens a Google popup3Google shows the consent screen for the requesting site4The user accepts5Google looks up the registered callback URLit points to Supabase6Google sends an authorization code to Supabase7Supabase verifies the code and creates the user8Supabase hands the tokens to the apponce

The consent screen asks whether the app may read the user's email. The callback URL is the one registered in Google Cloud Console. Supabase catches the authorization code (like a mafia guy) and handles everything: it verifies the code with the Client Secret (from the credentials), receives the access and refresh tokens for Gmail, and creates the user in auth.users. The app stores the Gmail tokens in its profiles table (server-side, never in the browser), and the session token goes into the browser's cookies.

From then on, every request follows the same path.

1The frontend request carries the session cookie2The backend reads it and knows who the user is3The backend calls the Gmail API with the stored Gmail tokens4RLS ensures each user only sees their own data

There is one handshake, done one time. The Client ID and Client Secret are configured in Google Cloud so that Supabase can prove, during this exchange, that it is the app's legitimate service.