<!-- claude-slack-attribution -->
_Requested by **Stojan Dimitrovski** · [Slack
thread](https://supabase.slack.com/archives/C022071RB2L/p1791475016175969?thread_ts=1791475016.175969&cid=C022071RB2L)_
## Problem
The Management API accepts any OIDC issuer for third-party auth (`POST
/v1/projects/{ref}/config/auth/third-party-auth` with
`oidc_issuer_url`), but the Dashboard only offers Firebase, Clerk,
WorkOS, Auth0 and Amazon Cognito. Users with another OIDC provider have
no way to register it from the Dashboard.
Studio also hides any issuer it does not recognize: `IntegrationCard`
returns `null` for the `custom` type, so an issuer added through the API
never shows up in the list and cannot be deleted from the Dashboard.
## Solution
- Add a "Custom OIDC" item to the Add provider menu on the Third-Party
Auth page.
- New `CreateCustomOidcDialog` with a single required Issuer URL field.
It reuses `useCreateThirdPartyAuthIntegrationMutation`, so query
invalidation and the error toast behave like the other providers. The
URL is sent as typed after trimming whitespace.
- New `isValidOidcIssuerUrl` helper in `ThirdPartyAuthForm.utils.ts`:
the value must be an `https://` URL with a host, no query string, no
fragment, and no embedded credentials.
- The dialog copy is kept short: a one-line description and a single
helper line noting that signing keys are found at the issuer's
`/.well-known/openid-configuration`.
- `IntegrationCard` now renders custom issuers (badge-check icon,
"Custom OIDC" label, Issuer URL, Delete integration) instead of hiding
them. Delete uses the existing flow and permission check.
- The `custom` label changes from "Custom" to "Custom OIDC".
- New docs page
`apps/docs/content/guides/auth/third-party/custom-oidc.mdx` (served at
`/docs/guides/auth/third-party/custom-oidc`). It covers the Dashboard
flow, the Management API alternative, the `role` claim, client setup,
and RLS. It is linked from the third-party auth overview and added to
the docs sidebar. This supersedes the draft docs PR #51611.
Not included: UI for `jwks_url` and `custom_jwks`. The page and menu
keep the same feature gate (`authentication:third_party_auth`) and the
same permission checks as the other providers.
Before: the Add provider menu lists five providers. An issuer that is
not one of them is registered only through the API and does not appear
in the Dashboard.
After: the menu has a sixth item, Custom OIDC. It opens a dialog that
takes an issuer URL, rejects non-HTTPS values with an inline message,
and registers the issuer. The new provider appears in the list and can
be deleted from there.
## Review instructions
1. Open a project's Authentication > Third-Party Auth page and open Add
provider. Check for the new Custom OIDC item.
2. Enter `http://example.com` and submit. The field shows an inline
error and no request is sent.
3. Enter a valid HTTPS issuer URL that serves an OIDC discovery document
and submit. A success toast appears and the provider shows in the list
as Custom OIDC with its Issuer URL.
4. Enter an issuer the API rejects. The API error shows in the existing
error toast and the dialog stays open.
5. Delete the provider with Delete integration and confirm it disappears
from the list.
6. Read the new docs page and check that its Dashboard steps match the
UI.
Local checks:
- `vitest --run components/interfaces/Auth/ThirdPartyAuthForm`: 20 tests
pass (validation helper unit tests plus dialog component tests with
MSW).
- `tsc --noEmit` in `apps/studio`: no new errors.
- ESLint on the directory: no warnings in the new or changed code.
- Prettier is clean on the changed files, including the docs page. The
typos check is clean on the docs page and overview.
I did not run the dialog in a browser against a real project, so there
are no screenshots. The docs app was not built or rendered locally.
## Checklist
- [x] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
- [x] If I wrote a new docs topic or edited an existing topic, I used
the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs
[style
guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide)
🤖 Generated with [Claude
Code](https://claude.ai/code/session_011HY2zckzPLcvXd28JPSqBe)
https://claude.ai/code/session_011HY2zckzPLcvXd28JPSqBe
---
_Generated by [Claude
Code](https://claude.ai/code/session_011HY2zckzPLcvXd28JPSqBe)_
---------
Co-authored-by: Claude <noreply@anthropic.com>
## Context
This is largely just a mechanical change here:
Opting to use lucide icons with the `Icon` suffix across all icon
imports within `studio`
- so that it’s clearer which components are icons + reduces the
possibility of name collision with our own components
- e.g <User /> vs <UserIcon />
Also added a eslint rule for this:
<img width="1069" height="167" alt="image"
src="https://github.com/user-attachments/assets/7f36f443-5ca2-4bf6-8d22-86e774513bfc"
/>
And updated `AGENTS.md` as such:
```
Icons come from `lucide-react`, always imported with the `Icon` suffix (`import { CheckIcon, Trash2Icon } from 'lucide-react'`) — never the bare names (`Check`) or `Check as CheckIcon` aliases (lint-enforced).
```
## Problem
Our `<Button>` component breaks the default `button` contract by
redefining the `type` prop to set its variant (`primary`, `default`,
etc) instead of the button type (`submit`, `button`, etc).
This is confusing and forces to write more code when using it with
shadcn components that expect/inject the standard button props.
## Solution
- rename the `type` prop to `variant`
- rename the `htmlType` prop to `type`
- propagate the changes where necessary
- format code
## How to test
As this is just prop renaming, if it builds it's ok
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
## Context
Just cleaning up feature flags that have been toggled on for all users
and unchanged for the past 2 months
- advisorRules
- newJwtSecrets
- isWorkOSTPAEnabled
- EnableOAuth21
- gitlessBranching
- showRefreshToast
- awsPrivateLinkIntegration
- useBedrockAssistant (Already not used)
- enableStripeSyncEngineIntegration
- ShowExplainWithAiInQueryPerformance
Doing it in 2 parts so its easier for review
* Downgrade and fix radix dialog version to 1.0.5, and remove unnecessary modal props from all usages of DropdownMenu
* Downgrade and fix radix dialog version to 1.0.5, and remove unnecessary modal props from all usages of DropdownMenu
* Fix PopoverPOrtal
* Fix
- Adds Clerk as third-party auth provider, behind feature flags for future release
- Adjust pricing according to new pricing RFC
- Remove paid plan feature gatekeeping
* Don't set fixed height on the generateSecret button in hooks sheet.
* Block two of the TPA providers on free plan orgs.
* Fix some copy. Add more explanation about the pricing.
* Update copy
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
* Add queries and mutations for third party auth.
* Show the ThirdPartyAuth form in the auth settings.
* Minor fixes to the mutations.
* Add a comment for TODO.
* Add all components for third party auth.
* Minor fixes.
* Update the firebase icons.
* Update the api-types.
* Fix the barrel file imports.
* Make the sheets more intuitive.
* Add a dialog for adding RLS policies for the firebase integration.
* Hide the 3rd party auth section behind a form.
* Fix a type error.
* Update the wording on the Add RLS policy dialog.
* Replace the sheets with dialogs.
* Add fixes for the comments on github.
* Minor fixes.
* Fix a type error.
* Make the delete integration awaitable.
