JavaScript API

@exegia/plugin-supabase-auth wraps Tauri’s invoke with types. There is no client to construct and no provider to mount — import the function you need.

import {
  signInWithPassword,
  onAuthStateChange,
  isAuthError,
} from "@exegia/plugin-supabase-auth";

Sessions returned to the webview are sanitized: they carry the access token, expiry, token type and user, and never a refresh token.

Session lifecycle

{ status: "signedIn" | "pendingConfirmation", session? }. Reports pendingConfirmation when the project requires email confirmation. data becomes user_metadata.

Email and password sign-in.

Sends a magic link or one-time code.

Promise<Session>

Redeems a code. type is "email" | "sms" | "recovery".

Opens the system browser and resolves when the loopback round-trip completes. See OAuth. redirectTo is web-only: it picks the page GoTrue returns the browser to (omitted, the project’s Site URL; provided, it must be in the project’s Redirect URLs allow-list). On Tauri it is accepted and ignored — the loopback listener owns the redirect.

Promise<void>

Aborts an in-flight browser round-trip so the plugin stops waiting on the loopback instead of holding it for the full flow timeout.

Promise<void>

Local-first: state clears even if the network is down.

Promise<Session | null>

The current session, or null.

Promise<User | null>

The current user, or null.

Promise<Session>

Manual refresh. Background refresh is automatic unless autoRefresh is disabled.

Account

These require opt-in permissions.

Promise<void>

Sends a recovery message. Needs allow-reset-password-for-email.

Promise<User>

Updates the signed-in user. Needs allow-update-user.

Promise<Identity[]>

The sign-in identities attached to the account. Needs allow-get-identities.

Promise<Identity[]>

Attaches a provider identity to the current account via the system browser. Needs allow-link-identity and enable_manual_linking on the project. redirectTo behaves as in signInWithOAuth: web-only, allow-listed, ignored on Tauri.

Promise<Identity[]>

Disconnects an identity. Removing the last sign-in method is refused with lastSignInMethod. Needs allow-unlink-identity.

Passkeys

Promise<PasskeyCapability>

{ usable, reason? }. Never touches the network — gate passkey UI on it.

Discoverable sign-in, no email needed. Resolves { status: "cancelled" } when the user dismisses the OS prompt — that is not an error.

Promise<PasskeyRegistrationResult>

Adds a passkey to the current account. The name is server-derived; rename it afterwards.

Promise<Passkey[]>

Credentials registered on the account.

Promise<Passkey>

friendlyName is 1–120 characters.

Promise<void>

Deleting the last passkey is not blocked server-side. Confirm with the user first.

Promise<PasskeyChallenge> / Promise<PasskeyRegistrationResult>

Two-step surface for apps running their own WebAuthn ceremony.

Promise<PasskeyChallenge> / Promise<PasskeySignInResult>

The authentication half of the same surface.

Auth state events

The plugin pushes state changes over a Tauri event. There is no polling.

import { onAuthStateChange } from "@exegia/plugin-supabase-auth";

const unlisten = await onAuthStateChange(({ event, session }) => {
  switch (event) {
    case "SIGNED_IN":
    case "TOKEN_REFRESHED":
      setSession(session);
      break;
    case "SIGNED_OUT":
      setSession(null);
      break;
  }
});

// later
unlisten();

Event	Fires when
`SIGNED_IN`	A session was established, including a session restored at startup
`SIGNED_OUT`	The session was cleared
`TOKEN_REFRESHED`	A background or manual refresh produced a new access token
`PASSWORD_RECOVERY`	A recovery code was redeemed and a session exists for the password change
`IDENTITIES_CHANGED`	An identity was linked or unlinked
`PASSKEYS_CHANGED`	A passkey was registered, renamed or deleted

Types

/** Frontend-sanitized session — never contains the refresh token. */
interface Session {
  accessToken: string;
  expiresAt: string; // ISO 8601
  tokenType: string;
  user: User;
}

interface User {
  id: string;
  email: string | null;
  phone: string | null;
  emailConfirmedAt: string | null;
  phoneConfirmedAt: string | null;
  lastSignInAt: string | null;
  createdAt: string;
  updatedAt: string;
  userMetadata: Record<string, unknown>;
  appMetadata: Record<string, unknown>;
}

interface Identity {
  identityId: string; // row key used for unlinking
  providerSubject: string;
  provider: string;
  email: string | null;
  createdAt: string | null;
  lastSignInAt: string | null;
}

interface Passkey {
  id: string;
  friendlyName: string | null;
  createdAt: string | null;
  lastUsedAt: string | null;
}

interface PasskeyCapability {
  usable: boolean;
  reason?: "unsupportedPlatform" | (string & {});
}

type Provider =
  | "google"
  | "github"
  | "gitlab"
  | "bitbucket"
  | "azure"
  | "facebook"
  | "twitter"
  | "discord"
  | "slack"
  | "apple"
  | (string & {});

Rejections are always a structured AuthError, never a bare string.

Setup

API

Flows

Session lifecycle

Account

Passkeys

Auth state events

Types

​Session lifecycle

​Account

​Passkeys

​Auth state events

​Types

Session lifecycle

Account

Passkeys

Auth state events

Types