supabase_flutter
Short Intro: Flutter integration for Supabase. This package makes it simple for developers to build secure and scalable products.
Flutter package for Supabase .
Supabase is an open source Firebase alternative. We are a service to:
listen to database changes query your tables, including filtering, pagination, and deeply nested relationships (like GraphQL) create, update, and delete rows manage your users and their permissions interact with your database using a simple UI
Status
Alpha: Under heavy development Public Alpha: Ready for testing. But go easy on us, there will be bugs and missing functionality. Public Beta: Stable. No breaking changes expected in this version but possible bugs. Public: Production-ready
Getting Started
Import the package:
import 'package:supabase_flutter/supabase_flutter.dart';
Intialize Supabase before using it:
import 'package:supabase_flutter/supabase_flutter.dart';
void main() {
WidgetsFlutterBinding.ensureInitialized();
Supabase.initialize(
url: SUPABASE_URL,
anonKey: SUPABASE_ANNON_KEY,
authCallbackUrlHostname: 'login-callback', // optional
debug: true // optional
);
runApp(MyApp());
}
authCallbackUrlHostname is optional. It will be used to filter Supabase authentication redirect deeplink. You need to provide this param if you use deeplink for other features on the app.
debug is optional. It’s enabled by default if you’re running the app in debug mode (flutter run --debug).
Authentication
Using authentication can be done easily.
Email authentication
import 'package:supabase_flutter/supabase_flutter.dart';
void signIn(String email, String password) async {
final response = await Supabase.instance.client.auth.signIn(email: _email, password: _password);
if (reponse.error != null) {
/// Handle error
} else {
/// Sign in with success
}
}
SupabaseAuthState
It helps you handle authentication with deeplink from 3rd party service like Google, Github, Twitter…
For more details, take a look at the example here
When using with a nested authentication flow, remember to call startAuthObserver() and stopAuthObserver() before/after navigation to new screen to prevent multiple observers running at the same time. Take a look at the example here
SupabaseAuthRequiredState
It helps you protect route that requires an authenticated user.
For more details, take a look at the example here
signInWithProvider
This method will automatically launch the auth url and open a browser for user to sign in with 3rd party login.
Supabase.instance.client.auth.signInWithProvider(
Provider.github,
options: supabase.AuthOptions(redirectTo: ''),
);
Custom LocalStorage
As default supabase_flutter uses hive plugin to persist user session. However you can use any other plugins by creating a LocalStorage impl.
For example, we can use flutter_secure_storage plugin to store the user session in a secure storage.
// Define the custom LocalStorage implementation
class SecureLocalStorage extends LocalStorage {
SecureLocalStorage() : super(
initialize: () async {},
hasAccessToken: () {
const storage = FlutterSecureStorage();
return storage.containsKey(key: supabasePersistSessionKey);
}, accessToken: () {
const storage = FlutterSecureStorage();
return storage.read(key: supabasePersistSessionKey);
}, removePersistedSession: () {
const storage = FlutterSecureStorage();
return storage.delete(key: supabasePersistSessionKey);
}, persistSession: (String value) {
const storage = FlutterSecureStorage();
return storage.write(key: supabasePersistSessionKey, value: value);
},
);
}
// use it when initializing
Supabase.initialize(
...
localStorage: SecureLocalStorage(),
);
You can use EmptyLocalStorage to disable session persistance:
Supabase.initialize(
...
localStorage: const EmptyLocalStorage(),
);
Deeplink config
Supabase redirect URLs config
Go to your Supabase project Authentication Settings page. You need to enter your app redirect callback on Additional Redirect URLs field.
The redirect callback url should have this format [YOUR_SCHEME]://[YOUR_AUTH_HOSTNAME]
Supabase 3rd party logins config
Follow the guide https://supabase.io/docs/guides/auth#third-party-logins
For Android
Deep Links can have any custom scheme. The downside is that any app can claim a scheme, so make sure yours are as unique as possible, eg. HST0000001://host.com.
<manifest ...>
<!-- ... other tags -->
<application ...>
<activity ...>
<!-- ... other tags -->
<!-- Deep Links -->
<intent-filter>
<action android:name="android.intent.action.VIEW" />
<category android:name="android.intent.category.DEFAULT" />
<category android:name="android.intent.category.BROWSABLE" />
<!-- Accepts URIs that begin with YOUR_SCHEME://YOUR_HOST -->
<data
android:scheme="[YOUR_SCHEME]"
android:host="[YOUR_HOST]" />
</intent-filter>
</activity>
</application>
</manifest>
The android:host attribute is optional for Deep Links.
For more info: https://developer.android.com/training/app-links/deep-linking
For iOS
Custom URL schemes can have… any custom scheme and there is no host specificity, nor entitlements or a hosted file. The downside is that any app can claim any scheme, so make sure yours is as unique as possible, eg. hst0000001 or myIncrediblyAwesomeScheme.
For Custom URL schemes you need to declare the scheme in ios/Runner/Info.plist (or through Xcode’s Target Info editor, under URL Types):
<!-- ... other tags -->
<plist>
<dict>
<!-- ... other tags -->
<key>CFBundleURLTypes</key>
<array>
<dict>
<key>CFBundleTypeRole</key>
<string>Editor</string>
<key>CFBundleURLSchemes</key>
<array>
<string>[YOUR_SCHEME]</string>
</array>
</dict>
</array>
<!-- ... other tags -->
</dict>
</plist>
This allows for your app to be started from YOUR_SCHEME://ANYTHING links.
For more info: https://developer.apple.com/documentation/xcode/defining-a-custom-url-scheme-for-your-app
Contributing
Fork the repo on GitHub Clone the project to your own machine Commit changes to your own branch Push your work back up to your fork Submit a Pull request so that we can review your changes and merge
Contribute on GitHub
Flutter integration for Supabase. These packages makes it simple for developers to build secure and scalable products. https://github.com/supabase/supabase-flutter 307 forks. 1,024 stars. 27 open issues. Recent commits: feat(auth): add MFA recovery codes API (#1800)## SummaryAdds the MFA recovery codes API to `supabase_auth`, exposed as`supabase.auth.mfa.recoveryCodes`:- `getStatus()` returns the factor id, total number of codes and howmany remain unused.- `generate({friendlyName})` creates the user's set of single-use codes.The codes are returned once.- `verify(code)` upgrades the session to `aal2`, replaces the storedsession and emits `AuthChangeEvent.mfaChallengeVerified`, matching`AuthMFAApi.verify`.- `regenerate()` replaces the set and `unenroll()` removes the factor.Supporting changes:- `FactorType.recoveryCode`. The wire name (`recovery_code`) is derivedwith the shared `snakeCase` getter in `Factor`, `AuthMFAEnrollResponse`and `enroll()` instead of the enum `name`.- `AuthMFAListFactorsResponse.recoveryCode` bucket in `listFactors()`.- `AuthenticationMethodReference.mfaRecoveryCode` for the`mfa/recovery_code` AMR claim.- New `ErrorCode` values: `mfaRecoveryCodesEnrollDisabled`,`mfaRecoveryCodesVerifyDisabled`, `mfaRecoveryCodesLocked`,`mfaRecoveryCodesSoleFactor` and `mfaVerifiedFactorExists`.The namespace is annotated `@experimental`, following the existingpasskey API. supabase-js gates the feature behind a runtime`experimental.recoveryCodes` flag instead, which is a JavaScript idiomthe Dart SDK does not use.## Compliance matrix- `auth.mfa_recovery_codes.get_status` → implemented- `auth.mfa_recovery_codes.generate` → implemented- `auth.mfa_recovery_codes.verify` → implemented- `auth.mfa_recovery_codes.regenerate` → implemented- `auth.mfa_recovery_codes.unenroll` → implementedThese IDs were introduced in `supabase/sdk` capability-matrix v1.9.0, sothe compliance workflow pins are bumped from v1.6.0 to v1.9.0. The Dartvalidation workflow is unchanged between those tags.## Reference- supabase-js: https://github.com/supabase/supabase-js/pull/2676- No Linear parity ticket exists for this change yet.## Testing- New `test/mfa_recovery_codes_test.dart` with a mock server coveringeach endpoint, request shape, session replacement, event emission, errorpropagation and `listFactors` bucketing.- Full `supabase_auth` suite passes against the local stack (549 tests).- `check-api-symbols`, `check-drift` and `validate-compliance` passlocally against v1.9.0.<!– This is an auto-generated comment: release notes by coderabbit.ai–>## Summary by CodeRabbit- **New Features**- Added MFA recovery-code management through the Auth API, includingstatus checks, generation, verification, regeneration, and unenrollment.- Added support for recovery-code factors in MFA factor listings andauthentication method references. – Added new MFA recovery-code error handling and response types. – Updated MFA factor serialization to use standardized wire values.- **Tests**- Added coverage for recovery-code workflows, request handling, errormapping, and factor serialization.- **Chores** – Updated SDK compliance workflow references and capability coverage.<!– end of auto-generated comment: release notes by coderabbit.ai –> , GitHub docs: document capability-matrix flow for adding a new public API (#1801)## Summary- Adds an "Adding a new public API" section to `AGENTS.md`'sContributing Guidelines, explaining that new public Dart symbols must beregistered in `sdk-compliance.yaml`, and how to add a new canonicalcapability upstream in `supabase/sdk` first when one doesn't alreadyexist.- Mirrors[supabase-js#2677](https://github.com/supabase/supabase-js/pull/2677),which added the equivalent section to its `CONTRIBUTING.md`. This repohas no `CONTRIBUTING.md`, so the section was added to `AGENTS.md`instead, adapted to this repo's actual mechanism(`symbols`/`supporting_symbols` keys, pinned SHA in`.github/workflows/validate-capabilities.yml`).Documentation only, no behavioral or API change.SDK-1742<!– This is an auto-generated comment: release notes by coderabbit.ai–>## Summary by CodeRabbit- **Documentation**- Added contributor guidance for registering new public API symbols inthe SDK capability configuration.- Documented how to handle existing and new SDK capabilities, includingrequired validation updates.- Added guidance and an example for categorizing entry points andsupporting symbols in YAML.<!– end of auto-generated comment: release notes by coderabbit.ai –> , GitHub chore(deps): bump bluefireteam/melos-action from 3.8.0 to 3.10.0 in the actions-minor-patch group (#1792)Bumps the actions-minor-patch group with 1 update:[bluefireteam/melos-action](https://github.com/bluefireteam/melos-action).Updates `bluefireteam/melos-action` from 3.8.0 to 3.10.0<details><summary>Release notes</summary><p><em>Sourced from <ahref="https://github.com/bluefireteam/melos-action/releases">bluefireteam/melos-action'sreleases</a>.</em></p><blockquote><h2>v3.10.0</h2><h2>What's Changed</h2><ul><li>feat: close previous release PRs when a new release PR is created by<a href="https://github.com/spydon"><code>@spydon</code></a> in <ahref="https://redirect.github.com/bluefireteam/melos-action/pull/48">bluefireteam/melos-action#48</a></li><li>fix: Disable the setup-dart problem matcher when publishing by <ahref="https://github.com/spydon"><code>@spydon</code></a> in <ahref="https://redirect.github.com/bluefireteam/melos-action/pull/49">bluefireteam/melos-action#49</a></li></ul><p><strong>Full Changelog</strong>: <ahref="https://github.com/bluefireteam/melos-action/compare/v3.9.0…v3.10.0">https://github.com/bluefireteam/melos-action/compare/v3.9.0…v3.10.0</a></p><h2>v3.9.0</h2><h2>What's Changed</h2><ul><li>deps(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 inthe github-actions group by <ahref="https://github.com/dependabot"><code>@dependabot</code></a>[bot]in <ahref="https://redirect.github.com/bluefireteam/melos-action/pull/44">bluefireteam/melos-action#44</a></li><li>deps(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 inthe github-actions group by <ahref="https://github.com/dependabot"><code>@dependabot</code></a>[bot]in <ahref="https://redirect.github.com/bluefireteam/melos-action/pull/45">bluefireteam/melos-action#45</a></li><li>deps(deps): bump dart-lang/setup-dart from 1.7.2 to 1.8.0 in thegithub-actions group by <ahref="https://github.com/dependabot"><code>@dependabot</code></a>[bot]in <ahref="https://redirect.github.com/bluefireteam/melos-action/pull/46">bluefireteam/melos-action#46</a></li><li>feat: support plain vX.Y.Z tags for root packages and lockstepworkspaces by <ahref="https://github.com/spydon"><code>@spydon</code></a> in <ahref="https://redirect.github.com/bluefireteam/melos-action/pull/47">bluefireteam/melos-action#47</a></li></ul><p><strong>Full Changelog</strong>: <ahref="https://github.com/bluefireteam/melos-action/compare/v3.8.0…v3.9.0">https://github.com/bluefireteam/melos-action/compare/v3.8.0…v3.9.0</a></p></blockquote></details><details><summary>Commits</summary><ul><li><ahref="https://github.com/bluefireteam/melos-action/commit/b79b63bcd183f823740a7976cbdb4b0fc95a0eb8"><code>b79b63b</code></a>fix: Disable the setup-dart problem matcher when publishing (<ahref="https://redirect.github.com/bluefireteam/melos-action/issues/49">#49</a>)</li><li><ahref="https://github.com/bluefireteam/melos-action/commit/22709d725aa0103f0fed73bf78b0899fc768388b"><code>22709d7</code></a>feat: close previous release PRs when a new release PR is created (<ahref="https://redirect.github.com/bluefireteam/melos-action/issues/48">#48</a>)</li><li><ahref="https://github.com/bluefireteam/melos-action/commit/70965d09a7f2bf831b220c19a006cccf1dafbda1"><code>70965d0</code></a>feat: support plain vX.Y.Z tags for root packages and lockstepworkspaces (<ahref="https://redirect.github.com/bluefireteam/melos-action/issues/47">#47</a>)</li><li><ahref="https://github.com/bluefireteam/melos-action/commit/2f17dbeb4ac0b99b3a3fa39d359927fd92f3602d"><code>2f17dbe</code></a>deps(deps): bump dart-lang/setup-dart from 1.7.2 to 1.8.0 in thegithub-actio…</li><li><ahref="https://github.com/bluefireteam/melos-action/commit/9e4dd82038b1a30b461dac1641d299ef2501696b"><code>9e4dd82</code></a>deps(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 in thegithu…</li><li><ahref="https://github.com/bluefireteam/melos-action/commit/32cdd07de9761c0ab24b07a1c9913d2a56f51433"><code>32cdd07</code></a>deps(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 in thegithu…</li><li>See full diff in <ahref="https://github.com/bluefireteam/melos-action/compare/2982f8e4fc92440a219490009d6d05195cb1a6a5…b79b63bcd183f823740a7976cbdb4b0fc95a0eb8">compareview</a></li></ul></details><br />[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)Dependabot will resolve any conflicts with this PR as long as you don'talter it yourself. You can also trigger a rebase manually by commenting`@dependabot rebase`.[//]: # (dependabot-automerge-start)[//]: # (dependabot-automerge-end)—<details><summary>Dependabot commands and options</summary><br />You can trigger Dependabot actions by commenting on this PR:- `@dependabot rebase` will rebase this PR- `@dependabot recreate` will recreate this PR, overwriting any editsthat have been made to it- `@dependabot show <dependency name> ignore conditions` will show allof the ignore conditions of the specified dependency- `@dependabot ignore <dependency name> major version` will close thisgroup update PR and stop Dependabot creating any more for the specificdependency's major version (unless you unignore this specificdependency's major version or upgrade to it yourself)- `@dependabot ignore <dependency name> minor version` will close thisgroup update PR and stop Dependabot creating any more for the specificdependency's minor version (unless you unignore this specificdependency's minor version or upgrade to it yourself)- `@dependabot ignore <dependency name>` will close this group update PRand stop Dependabot creating any more for the specific dependency(unless you unignore this specific dependency or upgrade to it yourself)- `@dependabot unignore <dependency name>` will remove all of the ignoreconditions of the specified dependency- `@dependabot unignore <dependency name> <ignore condition>` willremove the ignore condition of the specified dependency and ignoreconditions</details>Signed-off-by: dependabot[bot] <support@github.com>Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> , GitHub ci: drop –order-dependents from the release publish trigger (#1790)## What kind of change does this PR introduce?CI fix. The `Create Release Tags` workflow failed on the v3.0.0-dev.2release ([run33512894194](https://github.com/supabase/supabase-flutter/actions/runs/33512894194/job/99872665110)):the tags were created and pushed, but the `Trigger publish workflows`step exited before dispatching anything, so nothing reached pub.dev.## What is the current behavior?“`🚨 1 cycles in dependencies found:[ postgrest -> supabase_testing -> supabase ]““melos exec –order-dependents` builds its ordering graph from`dev_dependencies` as well as `dependencies`. Since #1747,`supabase_testing` depends on `supabase`, and nine packages dev-dependon `supabase_testing`, which closes a cycle through `postgrest`. Meloschecks for cycles across the whole workspace before running anything andexits 1 when it finds one, so the flag cannot be combined with thisdependency graph. Filtering the cycle away with `–ignore` does not helpeither, because the check runs over all packages rather than thefiltered set.This is the first run of the workflow since `supabase_testing` landed.The previous release commit was titled `chore: publish packages as3.0.0-dev.1`, which does not match the workflow's `chore(release):`condition, so the job was skipped; the last run before that was on2026-08-05, before the package existed.## What is the new behavior?The flag is dropped, with a comment recording why it cannot come back.Dispatch order does not affect the outcome: every tag points at the samerelease commit, each dispatched `Publish Packages` run publisheswhatever is unpublished at that commit, and `melos publish` itself runsunordered at concurrency 1 and resolves each package against theworkspace rather than against pub.dev.Verified locally against `main`: the command as it stands reproduces thecycle error, and without the flag it enumerates all 12 unpublishednon-private packages with the expected tag refs.## Additional contextThis does not retrigger the stuck release. `Create Release Tags` runs onpush to `main`, and the tags for `3.0.0-dev.2` already exist, sopublishing that release still needs a manual `Publish Packages` dispatchon one of those tags.<!– This is an auto-generated comment: release notes by coderabbit.ai–>## Summary by CodeRabbit- **Chores**- Updated the release process to reliably trigger package publishingwhen the project contains cyclic dependencies.- Publishing now proceeds without requiring dependency-based executionorder.<!– end of auto-generated comment: release notes by coderabbit.ai –> , GitHub chore(release): publish packages (#1789)Prepared all packages to be released to pub.dev———Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>Co-authored-by: Lukas Klingsbo <lukas.klingsbo@gmail.com> , GitHub
Provides the list of the opensource Flutter apps collection with GitHub repository.