Quickstart

Email/password, magic links and one-time codes work against a fresh local Supabase stack with no extra credentials. OAuth, account linking and passkeys need project configuration described in Provider setup.

Prerequisites

A Tauri v2 app with a Rust src-tauri/ crate
A Supabase project (hosted, or a local stack via supabase start)
A GitHub token with read:packages to install the bindings package from GitHub Packages (@exegia/use-auth comes from the public npm registry and needs no token)

Install the plugin

src-tauri/Cargo.toml

[dependencies]
tauri-plugin-supabase-auth = { git = "https://github.com/exegia/corpora-auth" }

src-tauri/src/lib.rs

tauri::Builder::default()
    .plugin(tauri_plugin_supabase_auth::init())

Install the frontend packages

Both packages live on the public npm registry, so this needs no .npmrc and no token:

bun add @exegia/use-auth        # optional: the React hooks
bun add @exegia/plugin-supabase-auth

Adding the hooks pulls the bindings in with them — install the bindings on their own only if you are not using React.

Configure the project

src-tauri/tauri.conf.json

{
  "plugins": {
    "supabase-auth": {
      "url": "https://your-project.supabase.co",
      "publishableKey": "your-publishable-or-anon-key"
    }
  }
}

Never use the service-role key here. It is readable from the app bundle and bypasses row-level security.

Everything else has defaults — see Configuration.

Grant permissions

src-tauri/capabilities/default.json

{
  "permissions": ["core:default", "supabase-auth:default"]
}

supabase-auth:default covers the everyday lifecycle. Account mutations such as password reset, profile updates, identity linking and passkey management are opt-in — see Permissions.

Sign someone in

The fastest path from React is the hooks — headless, so the markup is yours:

import { useAuth, useSession } from "@exegia/use-auth";

export default function App() {
  const { status, user } = useSession();
  const auth = useAuth();

  if (status === "loading") return <p>Restoring session…</p>;
  if (status === "signedIn") return <p>Signed in as {user?.email}</p>;

  return (
    <form
      onSubmit={async (event) => {
        event.preventDefault();
        const result = await auth.signIn({ email, password });
        if (!result.ok) setError(resolveMessage(result.error));
      }}
    >
      {/* your fields */}
    </form>
  );
}

Or call the bindings directly:

import {
  signUp,
  signInWithPassword,
  onAuthStateChange,
} from "@exegia/plugin-supabase-auth";

await signUp({ email, password });
await signInWithPassword({ email, password });

const unlisten = await onAuthStateChange(({ event, session }) => {
  // "SIGNED_IN" | "SIGNED_OUT" | "TOKEN_REFRESHED" | "PASSWORD_RECOVERY" | "IDENTITIES_CHANGED"
});

And from Rust, symmetrically:

use tauri_plugin_supabase_auth::SupabaseAuthExt;

let auth = app.supabase_auth();
let session = auth.sign_in_with_password("person@example.com", "correct horse battery").await?;
auth.on_auth_state_change(|payload| println!("auth: {:?}", payload.event));

Try the example app

The repository ships a runnable multi-window demo wired to every block against a local Supabase stack.

git clone https://github.com/exegia/corpora-auth && cd corpora-auth
make setup                # bun install + toolchain preflight
make supabase-up          # local stack; mail UI at http://127.0.0.1:54324
make -C examples/tauri-app dev

Next steps

Handle errors

Every rejection is a structured AuthError with a switchable kind.

Add social sign-in

How the loopback + PKCE round-trip works, and what to allow-list.

Get started

Contributing

Prerequisites

Try the example app

Next steps

Handle errors

Add social sign-in

​Prerequisites

​Try the example app

​Next steps

Handle errors

Add social sign-in

Prerequisites

Try the example app

Next steps