Skip to main content

ADR 003: Supabase/OIDC Auth Direction

Context​

The platform evolved from earlier custom/legacy auth paths toward Supabase and OIDC/DEEP-ID integration.

Decision​

Support Supabase/OIDC auth modes with backend JWT validation, profile DID mapping, bearer/cookie/API-key auth forms, and frontend same-origin auth routes.

Consequences​

  • Auth changes must account for issuer, audience, JWKS, cookies, and profile mapping.
  • sub is not always a UUID; code must use canonical user id resolution.
  • API keys are a separate auth surface and must remain documented/tested.