security//OAuth 2.0

OAuth 2.0 is an authorization protocol that lets a user grant a third-party app access to their data on another service without sharing their password. The user talks directly to the service (Google, GitHub and so on), gives permission, and the service hands the app a scoped token. The app never sees the password; it only gets a token with specific permissions (scopes) such as reading emails, viewing the profile or managing the calendar.

OAuth 2.0 is an authorization protocol that lets a user grant a third-party app access to their data on another service without sharing their password. The user talks directly to the service (Google, GitHub and so on), gives permission, and the service hands the app a scoped token. The app never sees the password; it only gets a token with specific permissions (scopes) such as reading emails, viewing the profile or managing the calendar.

Seen from the user, the flow is short:

1The user clicks Sign in with Google2The browser is redirected to Google3The user consents4Google sends a token back to the app5The app calls Google APIs on behalf of the user

Underneath, the handshake is one round trip, after which everything flows:

1The frontend opens the OAuth popup2Google asks for consent3The user accepts4Google sends a code to the callback URL5The server (or Supabase Auth) exchanges the code for access and refresh tokens

The publishable key lives in the frontend, to trigger the popup; the secret key lives on the server, to complete the exchange. Google Cloud Console is where the app is registered, both keys are issued and the callback URL is set.

The credentials cannot be skipped in favor of a library alone, because Google needs to control who accesses its users' data. They are the permission: they say which app this is, where its callback is and how it proves it. Without them Google rejects everything. The library (SDK) knows how to talk to Google; the credentials are the permission to do it.

Tokens expire. Refresh tokens let the app get new access tokens without bothering the user again.

With the Gmail API, a service carries an appendix of Google inside it: the user gives permission to Google directly, and Google hands the service the key to the mailbox. The same pattern serves Drive, Calendar, GitHub repositories and Slack workspaces.

Supabase uses OAuth 2.0 for its built-in auth: users can sign in with Google, GitHub and others, and Supabase handles the token exchange.