OAuth providers

Let users sign in with Google, GitHub, Apple, Microsoft and other OAuth providers.

#Supported providers

Google, GitHub, GitLab, Microsoft (Azure), Apple, Discord, Facebook, Bitbucket, Twitch, Twitter (X), Spotify, Slack, LinkedIn, Notion, Zoom, Figma, Kakao, Keycloak and WorkOS.

#Set up a provider

1. Create an OAuth app with the provider and set its callback (redirect) URL to https://<project-ref>.p.stitchdb.com/auth/v1/callback.
2. In Studio → Authentication → Sign-in methods, open the provider, paste the Client ID and Client secret and enable it. Keycloak needs its realm URL (for example https://keycloak.example.com/realms/myrealm); GitLab, Microsoft and WorkOS accept an optional URL for self-hosted or tenant-specific setups. Google and Apple have a Skip nonce check option for native sign-in libraries.
3. Add your app's URLs to Redirect URLs.

The secret is stored encrypted and never shown again.

#Sign in

await stitchdb.auth.signInWithOAuth({
  provider: 'github',
  options: { redirectTo: 'https://example.com/welcome', scopes: 'read:user' },
})

The browser goes to the provider and comes back to redirectTo signed in; the SDK reads the session from the URL. For server-rendered apps use the PKCE flow:

const stitchdb = createClient('https://<project-ref>.p.stitchdb.com', '<anon-key>', { auth: { flowType: 'pkce' } })
// on the redirect page:
await stitchdb.auth.exchangeCodeForSession(new URL(location.href).searchParams.get('code'))

#Native ID tokens and linked identities

// A Google or Apple ID token from a native sign-in library
await stitchdb.auth.signInWithIdToken({ provider: 'google', token: idToken })

// Identities of the signed-in user, link and unlink providers
const { data } = await stitchdb.auth.getUserIdentities()
await stitchdb.auth.linkIdentity({ provider: 'github' })