Sign-in inside your app: Google, Apple, Supabase

What works by itself

Why Google needs a setting

Google refuses sign-in from an embedded web view, with the error disallowed_useragent. So your app sends Google sign-in to a secure window instead: the system browser on Android, a secure sheet on iPhone. When sign-in ends, the person comes back to your app.

For the return to work, your site must send people to your app's address, and your sign-in provider must allow that address. Your app's address looks like this, with your package name:

com.example.app://auth

Set it up

1. 1

   Allow the address in your sign-in provider

   In Supabase, go to Authentication → URL Configuration → Redirect URLs. In Auth0, use Allowed Callback URLs. Add <your package name>://auth.

2. 2

   Use it when the app is detected

   When the SaasToStoreApp marker is in the user agent, pass that address as the redirect URL. In a browser, keep your usual address.

3. 3

   Launch a new build

   Android apps pick up the return address when they're built. iOS apps built since 20 October 2026 handle it too.

const inApp = navigator.userAgent.includes("SaasToStoreApp");
await supabase.auth.signInWithOAuth({
  provider: "google",
  options: {
    redirectTo: inApp ? "com.example.app://auth" : window.location.origin,
  },
});

Don't add accounts.google.com to your app's extra domains. Google must never open inside your app's web view.

My website also runs inside a mobile app. When navigator.userAgent includes "SaasToStoreApp", Google sign-in must return to the app.

In my Google sign-in call, set the redirect URL to "com.example.app://auth" when that marker is present, and keep the current redirect URL otherwise.

Do not change anything for normal web browsers.

Sites with server-side sessions

This return works when your site can finish sign-in from the URL it receives, which is how Supabase and most token-based providers behave. Sites that keep the sign-in state in server cookies, such as Auth.js and NextAuth, can't: the cookies set at the start of sign-in are not in the secure window where it ends.

For those sites, hide the Google button inside the app and keep email sign-in there. Use the SaasToStoreApp marker to do that.

Apple on iPhone

On iPhone, Apple sign-in stays inside the app, in Apple's own window. It generally behaves well. Still, test it on a real iPhone before you submit, above all if your site uses server cookies.

Apple has a rule of its own: if your iOS app offers Google sign-in, it must also offer Sign in with Apple or an equivalent option (guideline 4.8). If you don't want to add it, hide Google in the iOS app and keep email sign-in.

Links that leave your domain

Your app keeps your domain and its subdomains. Anything else opens in the system browser. If your sign-in or checkout must stay in the app, add its domain to Extra domains in your project, then rebuild. The same rule applies on iOS for builds since 20 October 2026.