Supabase.Auth.Admin.CustomProviders (supabase_auth v1.0.1)

View Source

Admin custom OIDC/OAuth provider management for Supabase Auth.

Provides functions to manage custom identity providers programmatically via the admin API. All operations require a client configured with a service_role key.

Provider Types

  • "oidc" — OpenID Connect providers. The server fetches and validates the discovery document from the issuer's well-known endpoint at creation/update time.
  • "oauth2" — Generic OAuth 2.0 providers. Requires explicit endpoint URLs.

Examples

# Create an OIDC provider
{:ok, provider} = Admin.CustomProviders.create_provider(client, %{
  provider_type: "oidc",
  identifier: "custom:mycompany",
  name: "My Company SSO",
  client_id: "abc123",
  client_secret: "secret",
  issuer: "https://sso.mycompany.com"
})

# List all providers
{:ok, providers} = Admin.CustomProviders.list_providers(client)

# List only OIDC providers
{:ok, providers} = Admin.CustomProviders.list_providers(client, %{type: "oidc"})

# Update a provider
{:ok, updated} = Admin.CustomProviders.update_provider(client, "custom:mycompany", %{
  name: "My Company SSO v2"
})

# Delete a provider
:ok = Admin.CustomProviders.delete_provider(client, "custom:mycompany")

Summary

Functions

create_provider(client, attrs)

Creates a new custom OIDC/OAuth provider.

delete_provider(client, identifier)

Deletes a custom provider.

get_provider(client, identifier)

Gets details of a specific custom provider by identifier.

list_providers(client, params \\ %{})

Lists all custom providers with optional type filter.

update_provider(client, identifier, attrs)

Updates an existing custom provider.

Functions

create_provider(client, attrs)

Creates a new custom OIDC/OAuth provider.

For OIDC providers, the server fetches and validates the OpenID Connect discovery document from the issuer's well-known endpoint at creation time.

Parameters

  • client - The Supabase client to use for the request.
  • attrs - The provider attributes:
    • provider_type - "oidc" or "oauth2" (required)
    • identifier - Provider identifier, e.g. "custom:mycompany" (required)
    • name - Human-readable name (required)
    • client_id - OAuth client ID (required)
    • client_secret - OAuth client secret (required, write-only)
    • issuer - OIDC issuer URL (required for OIDC)
    • scopes - List of OAuth scopes
    • pkce_enabled - Whether to use PKCE
    • attribute_mapping - Map of provider attributes to user attributes
    • authorization_params - Additional authorization request params
    • enabled - Whether the provider is enabled
    • email_optional - Whether email is optional
    • discovery_url - Custom OIDC discovery URL
    • skip_nonce_check - Whether to skip nonce validation (OIDC)
    • authorization_url - OAuth2 authorization endpoint (for oauth2 type)
    • token_url - OAuth2 token endpoint (for oauth2 type)
    • userinfo_url - OAuth2 userinfo endpoint (for oauth2 type)
    • jwks_uri - JWKS URI for token verification

Returns

  • {:ok, provider} - The created provider
  • {:error, error} - Failed to create provider

delete_provider(client, identifier)

Deletes a custom provider.

Parameters

  • client - The Supabase client to use for the request.
  • identifier - The provider identifier.

Returns

  • :ok - Successfully deleted the provider
  • {:error, error} - Failed to delete provider

get_provider(client, identifier)

Gets details of a specific custom provider by identifier.

Parameters

  • client - The Supabase client to use for the request.
  • identifier - The provider identifier (e.g. "custom:mycompany").

Returns

  • {:ok, provider} - The provider details
  • {:error, error} - Failed to retrieve provider

list_providers(client, params \\ %{})

Lists all custom providers with optional type filter.

Parameters

  • client - The Supabase client to use for the request.
  • params - Optional filter parameters:
    • type - Filter by provider type: "oidc" or "oauth2"

Returns

  • {:ok, providers} - List of custom providers
  • {:error, error} - Failed to list providers

Examples

iex> Supabase.Auth.Admin.CustomProviders.list_providers(client)
{:ok, [%{id: "...", identifier: "custom:mycompany", ...}]}

iex> Supabase.Auth.Admin.CustomProviders.list_providers(client, %{type: "oidc"})
{:ok, [%{provider_type: "oidc", ...}]}

update_provider(client, identifier, attrs)

Updates an existing custom provider.

When issuer or discovery_url is changed on an OIDC provider, the server re-fetches and validates the discovery document before persisting.

Note: provider_type and identifier are immutable and cannot be changed.

Parameters

  • client - The Supabase client to use for the request.
  • identifier - The provider identifier.
  • attrs - The attributes to update (all optional).

Returns

  • {:ok, provider} - The updated provider
  • {:error, error} - Failed to update provider