Summary

• Extends detectSessionInUrl option to accept a custom predicate function
• Allows users to exclude specific URLs from Supabase's implicit grant detection
• Fixes issue where non-Supabase OAuth flows (e.g., Facebook Login) were incorrectly intercepted

Problem

When users have other OAuth providers that return access_token in the URL fragment (like Facebook Login for connecting Instagram accounts), Supabase Auth intercepts these tokens and attempts to process them, causing unintended session logouts.

Solution

The detectSessionInUrl option now accepts either:

• boolean - existing behavior (default: true)
• function(url: URL, params: object) => boolean - custom predicate

Example usage:

  const supabase = createClient(url, key, {
    auth: {
      detectSessionInUrl: (url, params) => {
        // Ignore Facebook OAuth redirects
        if (url.pathname === '/facebook/redirect') return false
        // Default behavior for Supabase callbacks
        return Boolean(params.access_token || params.error_description)
      }
    }
  })

Related:

• GoTrueClient intercepts non-Supabase initiated OAuth preventing manual login flows #1697
• feat: add Supabase Auth identifier to OAuth redirect URLs auth#2299