# Redirect Doctor — Expo + Supabase OAuth

> Free, client-side checker that diagnoses Expo + Supabase OAuth redirect mismatches: paste your Expo scheme/path/runtime, Supabase project URL, Site URL and redirect allow-list, provider redirect URIs, and code flags, and get the exact redirect URL each Expo runtime will produce, the mismatches with severity, copy-paste fixes, and a checklist.

## What it does

Redirect Doctor takes the Expo + Supabase OAuth configuration that is normally scattered across `app.json`, the Supabase dashboard, and an OAuth provider console (Google, Apple, GitHub), and cross-checks it against the redirect URL each Expo runtime actually produces. It reports concrete mismatches — not generic advice — plus copy-paste fixes and a checklist. The whole check runs as one pure function, `diagnose(config)`, in `doctor.js`.

## Who it is for

Developers building a React Native app with Expo and Supabase Auth whose OAuth flow is stuck: redirecting to `localhost` in production, opening a blank browser tab, silently doing nothing, or throwing `invalid_request` / `redirect_uri_mismatch`. Useful whether you're setting up OAuth for the first time or debugging a flow that broke after a Supabase or provider console change.

## How to use

Inputs (via a form or raw JSON, and shareable as a permalink):
- Expo: `scheme`, redirect `path`, `runtime` (Expo Go / dev build / standalone / web), Expo Go LAN IP and port.
- Supabase: `projectUrl` (`https://<ref>.supabase.co`), `siteUrl`, `allowedRedirectUrls` (glob patterns).
- OAuth provider: `name` (google/apple/github/other), `authorizedRedirectUris`.
- Your code: `redirectTo` value, `flowType` (pkce/implicit), `skipBrowserRedirect`, `detectSessionInUrl`, whether you call `exchangeCodeForSession()`.

Outputs: `status` (pass/warn/fail), a plain-language `summary`, `expectedRedirects` for every runtime (Expo Go, dev build, standalone, web, Supabase provider callback), a sorted `problems` list (severity + message + where), copy-paste `fixes`, a `checklist`, and a disclaimer. Everything computes client-side, in milliseconds, with zero network requests.

## What it checks

- **Expo scheme validity** — empty, reserved (`http`/`https`), or malformed custom URL schemes for native runtimes.
- **Redirect path normalization** — leading/repeated slashes that would produce a double slash in the final URL.
- **Supabase Site URL fallback** — Site URL still pointing at `localhost`, which Supabase silently falls back to whenever `redirectTo` is missing or rejected; also flags non-`https` Site URLs on web.
- **Supabase project URL shape** — malformed or missing `https://<ref>.supabase.co` project URL.
- **redirectTo vs. actual runtime output** — whether your `code.redirectTo` matches what `makeRedirectUri()` actually produces for Expo Go / dev build / standalone / web.
- **Supabase redirect allow-list coverage** — whether the redirect value is matched by any glob pattern in `supabase.allowedRedirectUrls` (matched the same way Supabase matches it: `*`, `**`, `?`, character classes).
- **OAuth provider console callback** — whether the exact `https://<ref>.supabase.co/auth/v1/callback` URL is present in the provider's authorized redirect URIs (Google Cloud Console, Apple Services ID Return URLs, GitHub OAuth App).
- **flowType** — recommends PKCE over implicit flow for native apps.
- **skipBrowserRedirect** — should be `true` on native so the app opens the redirect URL itself.
- **detectSessionInUrl** — recommended `false` on native (no browser URL to parse there).
- **exchangeCodeForSession** — required when `flowType` is `pkce`, since the callback carries a code, not a session, until exchanged.

## Privacy

100% client-side. Nothing you paste or type is uploaded, stored on a server, or sent to the tool's author — the check runs entirely in your browser's JavaScript engine against the values you entered, not against your live Supabase project. The only network activity is loading the page's own static assets and anonymous, content-free usage-count analytics (self-hosted Umami: event names and counts only). No account, no login, no cookies for the tool itself. The "Copy link" feature encodes your config into the URL fragment — nothing is stored server-side.

## Links

- Tool: https://arling.sk/expo-supabase-auth-doctor/ (also at https://arling.sk/expo-supabase-auth-doctor/)
- GitHub repo: https://github.com/AndryRoby/expo-supabase-auth-doctor
- Full reference (worked example + FAQ): https://arling.sk/expo-supabase-auth-doctor/llms-full.txt
- Hub (more free tools by the same author): https://arling.sk/

## Contact

ARLing s. r. o., Bratislava, Slovakia — andrej@arling.sk