Authentication

Implementation

Google Sign-In

On kasy new, the CLI includes Google in the scaffold (Firebase and Supabase). With a Firebase companion (push on Supabase/API, or Firebase backend), it also mints OAuth and registers credentials. Without a companion, the provider is already Enabled on Supabase Auth (like Apple); you still paste Client ID/Secret (kasy google / configure_google_login).

Firebase

kasy new runs firebase deploy --only auth, which creates the OAuth Web Client and enables Google (plus Anonymous and Email/Password) in Firebase Auth. The app authenticates directly through Firebase Auth.

On web, the CLI also:

• registers both firebaseapp.com and web.app OAuth redirect URIs in Google Cloud
• sets authDomain in firebase_options to YOUR_PROJECT.web.app (same-origin on default Hosting; important in IDE embedded browsers)

Then verify with:

kasy doctor

kasy doctor warns if the debug keystore SHA-1 is not registered on Android.

Supabase

Google login is 100% Supabase Auth. The app does not use firebase_auth. A Firebase companion is not required for Google alone.

In Quick mode the CLI asks whether you want push and whether you want Google (interactive terminal). On MCP / kasy new --yes, Google is ON by default (independent of push; use --no-google / noGoogle only for email-only):

• Push yes + Google yes: Firebase companion (free FCM) + OAuth mint + SHA-1 on the Firebase Android app + Supabase provider. You do not create an Android OAuth client by hand: Firebase + SHA-1 already wire native Sign-In.
• Push no + Google yes: scaffold includes Google. Interactive terminal asks for the Client ID/Secret paste and registers credentials on Supabase Auth. MCP / --yes: provider Enabled at create (like Apple) + placeholders; kasy google / configure_google_login later for Client ID/Secret.

No companion (Console checklist): separate GCP project (org quota / billing required inside an org is a GCP rule, OAuth in Testing is free) → OAuth branding (External, press Enter on contact email) → Web client at OAuth overview → redirect https://YOUR_REF.supabase.co/auth/v1/callback → test users → copy Client ID + Secret as plain text (kasy google or MCP configure_google_login writes to Supabase automatically).

A Firebase companion also appears in Advanced with push or via kasy add notifications.

Web (production)

Add your production domain in Supabase → Authentication → URL Configuration (Redirect URLs). For dev, kasy new already allows http://localhost:5555.

For Firebase, also add origins on the OAuth Client (Google Cloud Console → Credentials → Web client):

Apple Sign-In

Requires an Apple Developer account (paid, USD $99/year).

1. Enable the capability on your Bundle ID

1. Open Identifiers
2. Select your Bundle ID
3. Enable Sign In with Apple → Enable as a primary App ID → Save

2. Create the key

1. Open Keys
2. Click + → give it a name (e.g., Firebase Sign In with Apple)
3. Enable Sign In with Apple → Configure → select your Bundle ID → Save
4. Register → download the .p8 (you can only download it once, keep it somewhere safe)
5. Note the Key ID (e.g., 6RR89XG535)

3. Create or edit the Services ID (web)

Apple Sign-In on the web uses a Services ID (com.company.app.signin), not the iOS App ID (com.company.app).

1. Open Identifiers or Services IDs
2. Filter: the page defaults to App IDs. Switch the top-right dropdown to Services IDs
3. If missing: + → Services IDs → Continue
4. Description: Firebase Sign In with Apple · Identifier: YOUR_BUNDLE_ID.signin
5. Register → open the Services ID → Sign In with Apple → Configure → Primary App ID: your Bundle ID

Domains and Return URLs (comma on one line):

6. Next → Done → Continue → Save

4. Configure it in Firebase

1. Open Firebase Console → Authentication → Apple
2. Enable the Apple provider
3. Fill in under OAuth code flow configuration:
   • Services ID: the identifier from step 3 (e.g., com.company.app.signin)
   • Team ID: found in Membership Details
   • Key ID: the Key ID from step 2
   • Private key: the full content of the .p8 (including the -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- lines)
4. Save

5. Enable the capability in Xcode

1. Open ios/Runner.xcworkspace in Xcode
2. Target Runner → Signing & Capabilities → + Capability → add Sign In with Apple

Facebook Sign-In

Requires an account on Meta for Developers.

1. Create the app on Meta

1. Open Meta for Developers → My Apps
2. Click Create App → select Consumer → Next
3. Fill in the app name → Create App
4. In the app dashboard, note the App ID and the Client Token (Settings → Advanced → Client Token)

2. Enable Facebook Login

1. In the Meta app dashboard → Add Product → Facebook Login → Set Up → iOS and/or Android
2. iOS: provide your app's Bundle ID

3. iOS: update Info.plist

Edit ios/Runner/Info.plist and replace the placeholders:

<key>FacebookAppID</key>
<string>YOUR_APP_ID</string>
<key>FacebookClientToken</key>
<string>YOUR_CLIENT_TOKEN</string>
<key>FacebookDisplayName</key>
<string>Your app's name</string>

And the URL scheme (inside CFBundleURLTypes):

<string>fbYOUR_APP_ID</string>

4. Android: update strings.xml

Edit android/app/src/main/res/values/strings.xml and replace the placeholders:

<string name="facebook_app_id">YOUR_APP_ID</string>
<string name="facebook_client_token">YOUR_CLIENT_TOKEN</string>

5. Web: add the domain in Meta

1. In the Meta app dashboard → Facebook Login → Settings
2. Under Valid OAuth Redirect URIs, add:
   • Firebase backend (both):
     • https://YOUR_PROJECT.firebaseapp.com/__/auth/handler
     • https://YOUR_PROJECT.web.app/__/auth/handler
   • Supabase backend: https://YOUR_PROJECT.supabase.co/auth/v1/callback
3. Under Allowed Domains for the JavaScript SDK, add your app domains (firebaseapp.com and web.app on Firebase; your web host on Supabase)

Then run kasy facebook to apply it automatically, or run kasy doctor to verify.

Information

How login works in the app

Mobile (default): anonymous account

When the app opens on native, an anonymous account is created automatically. The user lands straight on Home. Later they can link an email or social account in Settings, without losing data.

App opens → anonymous account → onboarding → Home
User wants a real account → /signin → links to the existing anonymous account

Web

No anonymous login. The flow goes straight to /signin:

App opens → /signin → login or sign up → Home

Changing the mode

In lib/environments.dart:

authenticationMode: AuthenticationMode.anonymous,  // default
// or
authenticationMode: AuthenticationMode.authRequired,

What a user without an account can do

This applies to both the anonymous user (anonymous) and the guest (authRequired): no screen slams the door on them, and anything that needs an account is ignored silently, with no crash.

The "Continue without account" button on the sign-in screen goes back Home on native; on the web it marks locally that the auth step is done and enters Home.

Protecting a screen

final user = ref.watch(userStateNotifierProvider).user;
if (user.idOrNull == null) {
  context.push('/signin');
  return;
}

Supabase: where to register the credentials

For projects with a Supabase backend, the steps on Apple and Meta are identical. What changes is where you register the credentials:

With Apple on Supabase, the Services ID's Return URL must be:

https://YOUR_PROJECT.supabase.co/auth/v1/callback

Social login: links to the anonymous account

On mobile, social login links to the existing anonymous account: the UID and all the user's data are preserved. Same interface across all three backends.

Email/password sign-up: also links

It's not just social login. Signing up with email and password from the anonymous state also links to the existing account (doesn't create a separate one), same UID, same data preserved. Firebase and Supabase already do this automatically.

Last updated on 08/23/2026