Supabase custom OIDC provider: Dazr Identity setup

Sign-in with Dazr Identity: free OpenID Connect, hosted in the EU, with passkeys, email codes and Google or Microsoft accounts behind one button.

You need three values from the developer console: the client ID, the client secret (web server apps only) and the redirect URI you registered. Everything else comes from the discovery document at https://identity.dazr.eu/.well-known/openid-configuration.

Supabase Auth supports custom OAuth and OpenID Connect providers. Add Dazr Identity as one, and your users sign in to your Supabase project with a passkey, an email code or their Google or Microsoft account, through one button.

1. Register an app in Dazr Identity

In Dazr Identity → Developers, register a web server app. Use the callback URL that Supabase shows when you add the provider as its redirect URI. For a project hosted by Supabase it is https://<project-ref>.supabase.co/auth/v1/callback. Keep the client ID and the client secret for the next step.

2. Add the provider in Supabase

In the Supabase dashboard, open the Auth providers of your project, click New Provider and choose Auto-discovery (OIDC). Fill in these values, then click Create and enable provider.

Supabase reads the discovery document at https://identity.dazr.eu/.well-known/openid-configuration and checks every ID token against the public keys it lists. PKCE is on by default. Leave it on: Dazr Identity rejects sign-ins without PKCE.

You can also create the provider in code, on a server, with the Supabase Admin API:

// Server only: this client uses the service role key.
const { data, error } = await supabase.auth.admin.customProviders.createProvider({
  provider_type: 'oidc',
  identifier: 'custom:dazr',
  name: 'Dazr Identity',
  client_id: process.env.DAZR_CLIENT_ID,
  client_secret: process.env.DAZR_CLIENT_SECRET,
  issuer: 'https://identity.dazr.eu',
  scopes: ['openid', 'profile', 'email'],
})

3. Sign people in

Start the sign-in with the identifier of the provider. Supabase handles the redirect to Dazr Identity, PKCE and the callback, then creates the user or signs in the existing one.

const { data, error } = await supabase.auth.signInWithOAuth({
  provider: 'custom:dazr',
  options: { redirectTo: 'https://app.example.eu/auth/callback' },
})

Style the button as shown under The button. Row level security works as usual: the signed-in person has a normal Supabase user ID.

Good to know

• Supabase expects an email address by default. Keep the email scope: Dazr Identity only issues verified email addresses.
• While your app is in testing at Dazr, http://localhost and http://127.0.0.1 redirect URIs on any port also work, for example for a local Supabase stack.
• Supabase limits how many custom providers a project can have, depending on the plan. See Custom OAuth and OIDC providers in the Supabase docs. Last checked in October 2026.

More for developers

Developer docsAll integration guidesAny OpenID Connect libraryPricing