Supabase throws this error when you attempt OAuth signup with a provider that hasn't been enabled in your project settings. Enable the provider in the Supabase dashboard and verify credentials are correct.
When you call `signInWithOAuth()` or `signUp()` with a social provider (Google, GitHub, Discord, etc.) that is disabled in your Supabase project, the authentication system rejects the request with this error. The error means the OAuth provider—whether Google, GitHub, Apple, or another service—is not configured and activated in your Supabase project's Auth settings. This is a security measure to prevent unauthorized authentication flows. Before users can sign in via social login, you must explicitly enable and configure each provider in the Supabase dashboard.
Navigate to https://app.supabase.com and authenticate with your credentials. Select the project where users are experiencing the OAuth error.
In the left sidebar, click on "Authentication" to expand the menu. Then click on "Providers" or navigate directly to the Auth settings section where you see the list of available OAuth providers.
Look for the OAuth provider you're trying to use (Google, GitHub, Discord, etc.). You should see a toggle switch next to each provider name. If the toggle is OFF (grayed out), the provider is disabled and users cannot sign up with it.
Click the toggle to enable the provider. A configuration form will appear asking for:
- Client ID: Obtained from the OAuth provider's developer console
- Client Secret: Obtained from the OAuth provider's developer console
- Redirect URI: Usually auto-filled as https://yourproject.supabase.co/auth/v1/callback
If you don't have a Client ID and Secret, you'll need to create an OAuth app in the provider's developer console first (e.g., Google Cloud Console, GitHub Developer Settings, Discord Developer Portal).
In the OAuth provider's developer console, ensure your app's "Authorized Redirect URIs" or "Callback URLs" includes the exact redirect URI shown in Supabase. A mismatch here is a common cause of OAuth failures.
For example, in Google Cloud Console, add:
https://yourproject.supabase.co/auth/v1/callbackIn Discord Developer Portal, set the redirect under OAuth2 settings to the same URL.
After enabling and configuring the provider, test it in your application. Call:
const { data, error } = await supabase.auth.signInWithOAuth({
provider: 'google', // or 'github', 'discord', etc.
options: {
redirectTo: 'https://yourapp.com/auth/callback',
}
});
if (error) {
console.error('OAuth error:', error);
}The user should be redirected to the OAuth provider's login screen without seeing the "provider_disabled" error.
If you're running a self-hosted Supabase instance, the error may indicate the provider is not configured in your config.toml file. Add the provider configuration:
[auth.external.google]
enabled = true
client_id = "your-client-id"
secret = "env(GOOGLE_CLIENT_SECRET)"
skip_nonce_check = falseReplace google with the provider name (github, discord, etc.). Then run:
supabase stop
supabase startThis restarts the Auth service with the new provider configuration.
Multi-Environment Gotcha: Pay careful attention if your app uses multiple Supabase projects (local, staging, production). Each project has its own provider settings. A provider enabled in your local Supabase (via supabase start) may be disabled in your production project, or vice versa.
OAuth Provider Requirements: Each OAuth provider (Google, GitHub, Discord, etc.) has different setup requirements. You must create an OAuth app in each provider's developer console and obtain credentials. This is a one-time setup but varies by provider.
Localhost Development: When developing locally with Supabase, your site_url in supabase/config.toml should be http://localhost:3000 (not http://127.0.0.1:3000), and your OAuth provider's redirect URI should match accordingly.
Session Not Persisted: If OAuth succeeds but the session doesn't persist (user signs in but immediately logs out), verify that your app's redirect callback properly stores the session token. The OAuth callback URL should handle the #access_token=... fragment returned by Supabase.
email_address_not_authorized: Email sending to this address is not authorized
Email address not authorized for sending in Supabase Auth
reauthentication_needed: Reauthentication required for security-sensitive actions
Reauthentication required for security-sensitive actions
no_authorization: No authorization header was provided
How to fix "no authorization header was provided" in Supabase
otp_expired: OTP has expired
How to fix 'otp_expired: OTP has expired' in Supabase
bad_oauth_state: OAuth state parameter is missing or invalid
How to fix 'bad_oauth_state: OAuth state parameter missing' in Supabase