Supabase OAuth Server + Shredly MCP

This guide walks through connecting a Shredly MCP server to Supabase's OAuth Server feature, allowing users to authenticate with their Supabase credentials before calling MCP tools.

This approach is for public-facing apps where you generate an MCP server and hand it to your end customers. Each user authenticates with their own Supabase credentials — no shared secret key is required.

For private or internal tools where you control access, see the API Key guide.

How it works

Supabase's OAuth Server turns your Supabase project into an identity provider. Shredly acts as the OAuth relay — it handles the authorization dance with Supabase on behalf of MCP clients (e.g. Claude), exchanges the authorization code for a Supabase JWT, and forwards that JWT as a Bearer token on every upstream tool call.

---

Step 1: Enable Supabase OAuth Server

In your Supabase dashboard, go to Authentication → OAuth Server and enable the feature. Set an authorization path — this is a route in your frontend that will render the consent screen, e.g. /oauth/consent.

---

Step 2: Build a consent page

Supabase will redirect users to your authorization_url_path with an authorization_id query parameter. Your page must read this param, display the requesting app and scopes, and call the appropriate Supabase method based on user action.

const authorizationId = searchParams.get('authorization_id');

// Fetch details to display (app name, scopes)
const { data } = await supabase.auth.oauth.getAuthorization(authorizationId);

// On approve
await supabase.auth.oauth.approveAuthorization(authorizationId);

// On deny
await supabase.auth.oauth.denyAuthorization(authorizationId);

note

The state parameter from the OAuth flow is handled internally by Supabase and is not passed to your consent page. Only authorization_id will be present.

---

Step 3: Register Shredly as an OAuth client in Supabase

In your Supabase dashboard, go to Authentication → OAuth Apps and create a new client:

Field	Value
Token endpoint auth method	client_secret_post
Redirect URI	https://mcp.shredly.io/mcp/{your-slug}/callback

caution

Set the token endpoint auth method to client_secret_post. Supabase defaults to client_secret_basic, but Shredly sends credentials as POST body parameters.

Save the generated Client ID and Client Secret.

---

Step 4: Configure OAuth on your Shredly MCP server

When creating or updating your MCP server via the Shredly API, set the oauth block and authentication type:

{
  "authentication": {
    "type": "Bearer"
  },
  "oauth": {
    "authorization_url": "https://<ref>.supabase.co/auth/v1/oauth/authorize",
    "token_url": "https://<ref>.supabase.co/auth/v1/oauth/token",
    "client_id": "<supabase-client-id>",
    "client_secret": "<supabase-client-secret>",
    "scopes": ["openid", "profile", "email"]
  }
}

Replace <ref> with your Supabase project reference (found in your project URL). Use the client_id and client_secret generated in Step 3.

---

Step 5: Add the Supabase API key to each tool

Supabase's REST API requires an apikey header on every request in addition to the Bearer token. Add your Supabase anon key (publishable key) to the headers field of each tool:

{
  "tools": [
    {
      "name": "your_tool",
      "headers": {
        "apikey": "<your-supabase-anon-key>"
      }
    }
  ]
}

The apikey (anon key) and the Authorization: Bearer <jwt> (OAuth token) are sent together on every tool call — Supabase requires both.

---

Next steps

• MCP Server Schema — full reference for tool definitions, auth options, and URL templates.
• OAuth Setup — general OAuth configuration reference for Shredly.