My goal:
I want to secure my Supabase REST API in Retool using Google OAuth2, so that only authorized users can access data. Supabase RLS policies should return a 401 error if a user is not authorized.
Issue:
I connected Retool to Google OAuth2 and it shows "Connected".
In my REST API resource I set:
URL parameter: apikey = sb_publishable_key
Header: Authorization: OAUTH2_TOKEN
The connection works (no errors in Retool), but Supabase does not apply RLS correctly.
Even unauthorized users can still query data.
Steps I've taken to troubleshoot:
Verified OAuth2 connection in Retool (works, tokens are generated).
Tried Authorization: OAUTH2_TOKEN
Enabled RLS and added policies in Supabase.
Verified policies using Supabase directly (they work outside Retool).
Additional info:
Retool Cloud (not self-hosted).
Supabase project URL:
Added Google Cloud credentials for both Supabase and Retool OAuth. (so both sides are connected with Google)
Sorry for the delay in getting to this, @Gabii! I'm not particularly familiar with the Supabase API but will hopefully have a chance to look into this soon. Alternatively, this might be an interesting use case to discuss during Office Hours, as well, if the timing works.
Thanks for reaching out, @Rodrigo! Assuming you have a setup similar to the above, I think there's potentially a few different issues.
The first and most obvious is the fact that the value associated with the Authorization header should be Bearer OAUTH2_TOKEN.
More importantly, though, I'm pretty sure Supabase expects the OAUTH2_TOKEN to be signed with their own secret, meaning you can't directly use a Google OAuth client. In order to get this working, you'll probably need to switch to a custom auth setup and define one additional step that exchanges the Google ID token for a Supabase token.
Is there a reason you're using the Google client instead of a native Supabase client?
