Auth Setup

You get two tools: manage_oauth for provider config and manage_auth_config for everything else. The role model is clean: anonymous, end-user JWT, or service key, each with different RLS behavior. Auth hooks are fire-and-forget functions that run after login, useful for creating profile rows or sending welcome emails but not for returning data to users. Service keys bypass RLS entirely, so the usual warnings apply. The redirect URI format is strict and provider quirks are documented, which saves time when Apple only returns names once or X refuses to give you emails.