auth-kt/io.github.jan.supabase.auth.admin.custom.provider/CustomOAuthProvider

CustomOAuthProvider

@Serializable

data class CustomOAuthProvider(val id: String, val providerType: CustomProviderType, val identifier: String, val name: String, val clientId: String, val acceptableClientIds: List<String>? = null, val customClaimsAllowlist: List<String>? = null, val scopes: List<String>? = null, val pkceEnabled: Boolean? = null, val attributeMapping: JsonObject? = null, val authorizationParams: Map<String, String>? = null, val enabled: Boolean? = null, val emailOptional: Boolean? = null, val issuer: String? = null, val discoveryUrl: String? = null, val skipNonceCheck: Boolean? = null, val authorizationUrl: String? = null, val tokenUrl: String? = null, val userinfoUrl: String? = null, val jwksUri: String? = null, val discoveryDocument: OIDCDiscoveryDocument? = null, val createdAt: Instant, val updatedAt: Instant)(source)

Parameters

Unique identifier (UUID)

providerType

Provider type

identifier

Provider identifier (e.g. custom:mycompany)

name

Human-readable name

clientId

OAuth client ID

acceptableClientIds

Additional client IDs accepted during token validation

scopes

OAuth scopes requested during authorization

pkceEnabled

Whether PKCE is enabled

attributeMapping

Mapping of provider attributes to Supabase user attributes

authorizationParams

Additional parameters sent with the authorization request

enabled

Whether the provider is enabled

emailOptional

Whether email is optional for this provider

issuer

OIDC issuer URL

discoveryUrl

OIDC discovery URL

skipNonceCheck

Whether to skip nonce check (OIDC)

authorizationUrl

OAuth2 authorization URL

tokenUrl

OAuth2 token URL

userinfoUrl

OAuth2 userinfo URL

jwksUri

JWKS URI for token verification

discoveryDocument

OIDC discovery document (OIDC providers only)

createdAt

Timestamp when the provider was created

updatedAt

Timestamp when the provider was last updated

customClaimsAllowlist

Allowlist of raw identity provider claim keys to copy verbatim into the user's custom_claims field (within identity_data and raw_user_meta_data), e.g. ["groups", "org_id", "mail"]. This is an opt-in allowlist that defaults to empty (no claims captured) and operates independently from attribute_mapping.

Constructors

CustomOAuthProvider

constructor(id: String, providerType: CustomProviderType, identifier: String, name: String, clientId: String, acceptableClientIds: List<String>? = null, customClaimsAllowlist: List<String>? = null, scopes: List<String>? = null, pkceEnabled: Boolean? = null, attributeMapping: JsonObject? = null, authorizationParams: Map<String, String>? = null, enabled: Boolean? = null, emailOptional: Boolean? = null, issuer: String? = null, discoveryUrl: String? = null, skipNonceCheck: Boolean? = null, authorizationUrl: String? = null, tokenUrl: String? = null, userinfoUrl: String? = null, jwksUri: String? = null, discoveryDocument: OIDCDiscoveryDocument? = null, createdAt: Instant, updatedAt: Instant)