Authentication

Implementation

Google Sign-In

On kasy new, the CLI configures Google automatically for both Firebase and Supabase backends. You do not need to enable the provider manually in the console.

Firebase

kasy new runs firebase deploy --only auth, which creates the OAuth Web Client and enables Google (plus Anonymous and Email/Password) in Firebase Auth. The app authenticates directly through Firebase Auth.

Then verify with:

kasy doctor

kasy doctor warns if the debug keystore SHA-1 is not registered on Android.

Supabase

Google login is 100% Supabase Auth. The app does not use firebase_auth.

The companion Firebase project (FCM + Remote Config) was already required. The CLI also runs firebase deploy --only auth once to create the OAuth client in Google Cloud and register the callback https://YOUR_REF.supabase.co/auth/v1/callback. It then configures the Google provider on Supabase via API. The Firebase console may show Authentication enabled; users do not sign in through it.

Android SHA-1, google_auth_options.dart, and the iOS URL scheme remain automatic on kasy new.

Web (production)

Add your production domain in Supabase → Authentication → URL Configuration (Redirect URLs). For dev, kasy new already allows http://localhost:5555.

For Firebase, also add origins on the OAuth Client (Google Cloud Console → Credentials → Web client):

Apple Sign-In

Requires an Apple Developer account (paid, USD $99/year).

1. Enable the capability on your Bundle ID

1. Open Identifiers
2. Select your Bundle ID
3. Enable Sign In with Apple → Enable as a primary App ID → Save

2. Create the key

1. Open Keys
2. Click + → give it a name (e.g., Firebase Sign In with Apple)
3. Enable Sign In with Apple → Configure → select your Bundle ID → Save
4. Register → download the .p8 (you can only download it once, keep it somewhere safe)
5. Note the Key ID (e.g., 6RR89XG535)

3. Create the Services ID

1. Open Services IDs
2. Click + → select Services IDs → Continue
3. Fill in:
   • Description: Firebase Sign In with Apple
   • Identifier: YOUR_BUNDLE_ID.signin (e.g., com.company.app.signin)
4. Register → click the newly created Services ID → enable Sign In with Apple → Configure
5. Fill in:
   • Primary App ID: your Bundle ID
   • Domains: YOUR_PROJECT.firebaseapp.com
   • Return URLs: https://YOUR_PROJECT.firebaseapp.com/__/auth/handler
6. Next → Done → Continue → Save

4. Configure it in Firebase

1. Open Firebase Console → Authentication → Apple
2. Enable the Apple provider
3. Fill in under OAuth code flow configuration:
   • Services ID: the identifier from step 3 (e.g., com.company.app.signin)
   • Team ID: found in Membership Details
   • Key ID: the Key ID from step 2
   • Private key: the full content of the .p8 (including the -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- lines)
4. Save

5. Enable the capability in Xcode

1. Open ios/Runner.xcworkspace in Xcode
2. Target Runner → Signing & Capabilities → + Capability → add Sign In with Apple

Facebook Sign-In

Requires an account on Meta for Developers.

1. Create the app on Meta

1. Open Meta for Developers → My Apps
2. Click Create App → select Consumer → Next
3. Fill in the app name → Create App
4. In the app dashboard, note the App ID and the Client Token (Settings → Advanced → Client Token)

2. Enable Facebook Login

1. In the Meta app dashboard → Add Product → Facebook Login → Set Up → iOS and/or Android
2. iOS: provide your app's Bundle ID

3. iOS: update Info.plist

Edit ios/Runner/Info.plist and replace the placeholders:

<key>FacebookAppID</key>
<string>YOUR_APP_ID</string>
<key>FacebookClientToken</key>
<string>YOUR_CLIENT_TOKEN</string>
<key>FacebookDisplayName</key>
<string>Your app's name</string>

And the URL scheme (inside CFBundleURLTypes):

<string>fbYOUR_APP_ID</string>

4. Android: update strings.xml

Edit android/app/src/main/res/values/strings.xml and replace the placeholders:

<string name="facebook_app_id">YOUR_APP_ID</string>
<string name="facebook_client_token">YOUR_CLIENT_TOKEN</string>

5. Web: add the domain in Meta

1. In the Meta app dashboard → Facebook Login → Settings
2. Under Valid OAuth Redirect URIs, add:
   • https://YOUR_PROJECT.firebaseapp.com/__/auth/handler
3. Under Allowed Domains for the JavaScript SDK, add:
   • YOUR_PROJECT.firebaseapp.com

Then run kasy facebook to apply it automatically, or run kasy doctor to verify.

Information

How login works in the app

Mobile (default): anonymous account

When the app opens on native, an anonymous account is created automatically. The user lands straight on Home. Later they can link an email or social account in Settings, without losing data.

App opens → anonymous account → onboarding → Home
User wants a real account → /signin → links to the existing anonymous account

Web

No anonymous login. The flow goes straight to /signin:

App opens → /signin → login or sign up → Home

Changing the mode

In lib/environments.dart:

authenticationMode: AuthenticationMode.anonymous,  // default
// or
authenticationMode: AuthenticationMode.authRequired,

Protecting a screen

final user = ref.watch(userStateNotifierProvider).user;
if (user.idOrNull == null) {
  context.push('/signin');
  return;
}

Supabase: where to register the credentials

For projects with a Supabase backend, the steps on Apple and Meta are identical. What changes is where you register the credentials:

With Apple on Supabase, the Services ID's Return URL must be:

https://YOUR_PROJECT.supabase.co/auth/v1/callback

Social login: links to the anonymous account

On mobile, social login links to the existing anonymous account: the UID and all the user's data are preserved. Same interface across all three backends.

Email/password sign-up: also links

It's not just social login. Signing up with email and password from the anonymous state also links to the existing account (doesn't create a separate one) — same UID, same data preserved. Firebase and Supabase already do this automatically.

Last updated on 08/02/2026