Accept Credentials from an External Identity Provider

The Trusted Auth Tokens feature allows developers to attest end-user identities by exchanging signed JWTs for Stytch sessions. Many existing identity infrastructure tools will provide a JWT that can be used for this purpose such as an access_token or id_token. Stytch will use the JWKS endpoint hosted by your existing infrastructure to validate these JWTs.

This may be useful if you need to deal with many applications with different sources of identity. For example, an internal tool built with Supabase Auth may need to call out to another project built with Stytch. We'll show how Trusted Auth Tokens allow you to accept Supabase credentials within your Stytch project.

The concepts shown here are not Supabase specific - they can be applicable to any identity provider with a public JWKs.

Create a new Trusted Auth Token profile in the Stytch dashboard here. In order to validate JWTs from Supabase, we need to set three values:

We also need to map the Supabase user information to Stytch via an attribute mapping:

With these values set, we are ready to exchange Supabase Access Tokens for Stytch sessions

Obtain After you have minted your JWT, use the Supabase SDK to retrieve an access token JWT.

// On the frontend
// Retrieve the session to be sent to the backend for authentication
const { data } = await supabase.auth.getSession()
fetch('/api/exchange-supabase-session', {
  method: 'POST',
  data: JSON.stringify({access_token: data.session.access_token})
})

Call the Attest Session API endpoint to exchange the JWT for a Stytch Session.

// On the backend, exchange the Supabase access token for a Stytch session
const client = new stytch.B2BClient({
  project_id: 'PROJECT_ID',
  secret: 'SECRET',
});

const params = {
  profile_id: "trusted-auth-token-profile-test-41920359-8bbb-4fe8-8fa3-aaa83f35f02c",
  organization_id: "organization-test-07971b06-ac8b-4cdb-9c15-63b17e653931",
  token: "eyJhb...", // the accessToken from Supabase
};

client.sessions.attest(params)
  .then(resp => {
    console.log(resp)
  })
  .catch(err => {
    console.log(err)
  });

You should now have an authenticated Stytch session linked to the external Supabase user.