Expo + Supabase GitHub Auth Broke 3 Times — Here's the Fix
TL;DR: GitHub login in my Expo app broke three separate times. A deep link that went nowhere. A PKCE flow I wired backwards. A redirect URL with a typo. Each fix is copy-pasteable below. Total auth code is under a hundred lines. Steal it. Auth is the worst part of every app. Nobody downloads your app for the login screen. They tolerate it. Every minute you spend on OAuth is a minute nobody will…
Expo app developers using Supabase for GitHub authentication encountered three distinct issues over the course of three days. The first problem was that the deep link failure occurred when GitHub redirected to a URL that could not reopen the app. This issue was caused by a problem with the redirect URL in Supabase, which registered the wrong URL for the landing page on mobile devices. The fix involved registering the app's scheme as the redirect URL and updating both Supabase and GitHub settings accordingly.
The second issue stemmed from the developer's incorrect implementation of PKCE (Proof Key for Code Exchange) in the mobile OAuth flow. By generating the verifier and discarding it, the app failed to exchange the returned code for a session, as Supabase required the original verifier to be present during the exchange. The correction was to let the Supabase client handle the entire flow, exchanging the code for a session with just one call.
The third problem was a tiny redirect URL typo that only manifested on Android devices. The problem arose because Android verified app links against the package name, and the developer had renamed the package halfway through the project, causing inconsistencies between the Supabase redirect list and the project's configuration. The solution was to update the redirect URL in the Supabase dashboard and rebuild the Android APK.
To avoid these pitfalls, the developer recommends the following checklist:
1. Use your app's scheme as the redirect URL everywhere - Supabase, GitHub OAuth app, and your code.
2. Ensure that one library owns the entire OAuth flow, with signInWithOAuth initiating the flow and exchangeCodeForSession concluding it.
3. After renaming any elements, search your entire project for the old name, checking package names, bundle IDs, schemes, and redirect URLs.
4. Test the authentication process on a real device early on, as iOS and Android simulators may not fully replicate the issues encountered in the wild.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
