GitHub

The GitHub button is already on the sign-in and sign-up screens, beside email and password. It is the simplest of the three providers: one OAuth app, two values, and the same browser flow on every platform, since GitHub has no native SDK, so there is nothing platform-specific to configure.

There is no ENABLE_ flag for GitHub

Unlike Google Sign-In, GitHub is not behind a feature flag. Nothing to flip in .env.local; what gates it is [auth.external.github].enabled in supabase/config.toml, which ships false.

GitHub Developer Settings

Register a new OAuth app

Go to OAuth apps page → New OAuth App

Application name > give a meaningful name
Homepage URL > type the full URL to your app's website
Authorization callback URL > options:

http://127.0.0.1:54321/auth/v1/callback

Enable Device Flow > unchecked

→ Register application

That callback is Supabase's, not your app's

The URL above is where GitHub returns the user to Supabase Auth. Getting the user from there back into your app is a second, separate hop over a deep link; see Deep Links.

Get Credentials

Open your created OAuth app

Client ID

Copy and save your Client ID

Client Secret

Click Generate a new client secret
Copy and save your Client secret

Your deployed backend takes a Client ID and Secret too, on its own GitHub provider; see In production.

Floot App Setup

The Supabase environment

Both values are backend-only: the Flutter app never sees a GitHub credential.

supabase/.env.local

OAUTH_GITHUB_CLIENT_ID=Ov23li...
OAUTH_GITHUB_SECRET=...
SB_AUTH_EXTERNAL_REDIRECT_URI=http://127.0.0.1:54321/auth/v1/callback

SB_AUTH_EXTERNAL_REDIRECT_URI is the same callback you registered as the Authorization callback URL, and it is shared with Google Sign-In. It is also one of the values the Edge Functions require at startup: blank it out and supabase functions serve refuses to boot, taking sign-up confirmation and password-reset emails with it. floot create prefills the local value.

The Supabase config

supabase/config.toml already wires every key to a variable. Only enabled needs your hand:

supabase/config.toml

[auth.external.github]
enabled = true

Key	Ships as	What to do
`enabled`	`false`	Flip it to `true`
`client_id`	`env(OAUTH_GITHUB_CLIENT_ID)`	Leave it; fill the variable
`secret`	`env(OAUTH_GITHUB_SECRET)`	Leave it; fill the variable
`redirect_uri`	`env(SB_AUTH_EXTERNAL_REDIRECT_URI)`	Leave it; fill the variable

config.toml and supabase/.env.local configure your local stack. Your deployed backend takes the provider from its own settings; see In production.

OAuth deep link redirection

The return trip uses OAUTH_REDIRECT_URL, and Supabase only honours it because the same URL is on the additional_redirect_urls allow-list. Both are already wired by floot create.

→ Check them against Deep Links.

In production

Your deployed backend needs its own GitHub provider, with the Client ID and secret from Get Credentials and its own callback (the Authorization callback URL above). A GitHub OAuth app holds a single callback URL, so give production an OAuth app of its own rather than repointing the one you develop with.

Supabase Cloud: turn GitHub on under Authentication → Sign In / Providers → GitHub in the dashboard, and enter the Client ID and secret. See Providers.
Self-hosted: set GOTRUE_EXTERNAL_GITHUB_ENABLED: "true", GOTRUE_EXTERNAL_GITHUB_CLIENT_ID, GOTRUE_EXTERNAL_GITHUB_SECRET and GOTRUE_EXTERNAL_GITHUB_REDIRECT_URI (https://api.myapp.com/auth/v1/callback) on the auth service in your own compose file; the stock file carries them commented out. Then recreate the auth container. See Auth defaults that differ.

The functions' SB_AUTH_EXTERNAL_REDIRECT_URI holds the same callback on the deployed backend; it is in the function secrets on Supabase Cloud and self-hosted.

supabase config push could send [auth.external.github] from config.toml to a linked Cloud project instead, but it fills each env() from your local supabase/.env.local, so it would push your development credentials and the 127.0.0.1 callback. Set the provider in the dashboard, or read Alternative: settings from config.toml first.