# Sign-in inside your app: Google, Apple, Supabase

Source: https://saastostore.com/docs/sign-in

Most sign-in works in your app with nothing to do. Email and password, magic links and one-time codes all behave as on your website. Google and Apple are the exceptions, as they have their own rules about apps.

## What works by itself

| Sign-in method | In the app |
| --- | --- |
| Email and password | Works, nothing to do |
| Magic link or code by email | Works. Set up [deep links](https://saastostore.com/docs/deep-links) so the link opens the app |
| Sign in with Google | Needs one setting, below |
| Sign in with Apple | See [Apple on iPhone](#apple) |

## Why Google needs a setting

Google refuses sign-in from an embedded web view, with the error `disallowed_useragent`. So your app sends Google sign-in to a secure window instead: the system browser on Android, a secure sheet on iPhone. When sign-in ends, the person comes back to your app.

For the return to work, your site must send people to your app's address, and your sign-in provider must allow that address. Your app's address looks like this, with your package name:

```
com.example.app://auth
```

### Set it up

1. **Allow the address in your sign-in provider** In Supabase, go to **Authentication → URL Configuration → Redirect URLs**. In Auth0, use **Allowed Callback URLs**. Add `<your package name>://auth`.
2. **Use it when the app is detected** When the `SaasToStoreApp` marker is in the user agent, pass that address as the redirect URL. In a browser, keep your usual address.
3. **Launch a new build** Android apps pick up the return address when they're built. iOS apps built since 20 October 2026 handle it too.

```js
const inApp = navigator.userAgent.includes("SaasToStoreApp");
await supabase.auth.signInWithOAuth({
  provider: "google",
  options: {
    redirectTo: inApp ? "com.example.app://auth" : window.location.origin,
  },
});
```

> **Warning:** Don't add `accounts.google.com` to your app's extra domains. Google must never open inside your app's web view.

**Prompt for Lovable, Bolt or Base44**

```text
My website also runs inside a mobile app. When navigator.userAgent includes "SaasToStoreApp", Google sign-in must return to the app.

In my Google sign-in call, set the redirect URL to "com.example.app://auth" when that marker is present, and keep the current redirect URL otherwise.

Do not change anything for normal web browsers.
```

Replace com.example.app with the package name shown on your project page.

## Sites with server-side sessions

This return works when your site can finish sign-in from the URL it receives, which is how Supabase and most token-based providers behave. Sites that keep the sign-in state in server cookies, such as Auth.js and NextAuth, can't: the cookies set at the start of sign-in are not in the secure window where it ends.

For those sites, hide the Google button inside the app and keep email sign-in there. Use the `SaasToStoreApp` marker to do that.

## Apple on iPhone

On iPhone, Apple sign-in stays inside the app, in Apple's own window. It generally behaves well. Still, test it on a real iPhone before you submit, above all if your site uses server cookies.

Apple has a rule of its own: if your iOS app offers Google sign-in, it must also offer Sign in with Apple or an equivalent option (guideline 4.8). If you don't want to add it, hide Google in the iOS app and keep email sign-in.

## Links that leave your domain

Your app keeps your domain and its subdomains. Anything else opens in the system browser. If your sign-in or checkout must stay in the app, add its domain to **Extra domains** in your project, then rebuild. The same rule applies on iOS for builds since 20 October 2026.

## Frequently asked questions

### What does disallowed_useragent mean?

Google refused to show its sign-in page inside an embedded web view. Pass your app's return address as described on this page, so that sign-in opens in the secure window instead.

### Google sign-in works but I end up signed out in the app. Why?

Your site probably didn't finish sign-in from the address it received. Check that your site reads the code or token in the URL after the return. If it relies on server cookies, hide Google in the app.

### Do I have to offer Sign in with Apple?

On iOS, if you offer Google or another third-party sign-in, Apple asks for an equivalent private option. Email and password alone don't trigger that rule.

### Does the session stay after closing the app?

Yes, as in a browser. Your site's cookies and local storage stay on the phone until the person signs out or uninstalls the app.