Sharing One Google Sign-In Across Multiple Apps (Supabase + Flutter)

TL;DR

If several apps use the same Supabase project, the same Google account becomes the same user no matter which app it signs in from. For Android, add an Android client in Google Cloud Console and use the Web Client ID as serverClientId in your Flutter code; the Web Client ID goes in Supabase's Google Provider. For iOS, per the Supabase docs, also add the iOS Client ID to Supabase's Client IDs, comma-separated.

The Problem

I'm building a platform called "Just Apps" — multiple apps (Just QR, Just Notes, etc.) sharing a single account system. Backend is Supabase, frontend is Flutter.

The question that tripped me up:

Supabase's Google Provider only accepts one Client ID. How do I support multiple apps?

That led me to try signInWithOAuth (the browser-based flow), but I ended up back at the approach I started with: google_sign_in + signInWithIdToken.

Correction (2026-10): The Client IDs field in Supabase's Google Provider accepts several client IDs separated by commas. Put the Web Client ID first.

Google OAuth Client Types

When you create OAuth clients in Google Cloud Console, there are distinct types:

Architecture

Google Cloud Project (Just Apps)
│
├── Web Client (1)
│   └── Registered in Supabase Google Provider
│   └── Used as serverClientId in all Flutter apps
│
├── Android Client - Just QR debug
│   └── Package: com.justkihyun.justqr + debug SHA-1
├── Android Client - Just QR release
│   └── Package: com.justkihyun.justqr + release SHA-1
├── Android Client - Just Notes debug
│   └── Package: com.justkihyun.justnotes + debug SHA-1
├── Android Client - Just Notes release
│   └── Package: com.justkihyun.justnotes + release SHA-1
│
├── iOS Client - Just QR
│   └── Bundle ID: com.justkihyun.justqr
└── iOS Client - Just Notes
    └── Bundle ID: com.justkihyun.justnotes

The Flow

[Flutter App]
    │
    ├── google_sign_in package → native Google login UI
    │   (Google SDK matches Android Client by package name + SHA-1)
    │
    ├── Receives idToken + accessToken
    │
    └── Calls Supabase signInWithIdToken()
        (Supabase verifies the token against the registered Client IDs)
        │
        └── Same Supabase project → same auth.users → same account

Different apps + same Google account = same Supabase user, because every app uses the same Supabase project and the Google account is the same.

Adding a New App

1. Google Cloud Console: Add an Android/iOS client (package name + SHA-1 / Bundle ID)
2. Flutter code: Use the same Web Client ID as serverClientId
3. Supabase: Connect to the same project URL + anon key
4. For an iOS app: Add the new iOS Client ID to Supabase's Client IDs, comma-separated

If you're only adding an Android app, nothing changes in Supabase.

Why I Didn't Use signInWithOAuth

I tried the browser-based OAuth approach (signInWithOAuth). At the time I concluded it didn't fit a multi-app setup because of these limits:

• Supabase Site URL only accepts one value
• Redirect URLs don't accept custom schemes (myapp://)

Correction (2026-10): Neither matches the Supabase docs. Site URL is the default used when no redirectTo is given; the Additional Redirect URLs allow list takes multiple URLs (wildcards included), and custom schemes are allowed — Supabase's Flutter deep-linking example registers io.supabase.flutterquickstart://login-callback. So a multi-app setup can also work with signInWithOAuth by registering a deep link per app. This post uses google_sign_in + signInWithIdToken, which keeps the native sign-in screen.

Common Questions

"Do I need to register a Client ID per app in Supabase?"

For Android, if your Flutter code uses the Web Client ID as serverClientId, Supabase only needs the Web Client ID. The Android client is used by Google Cloud Console to check the app's package name and signature. For iOS, follow the Supabase docs and add the iOS Client ID to Client IDs as well.

"I'm getting ApiException: 10"

Most often the SHA-1 of the key that signed this build isn't registered in an Android client in Google Cloud Console. For a debug build, get the debug SHA-1 with keytool and add an Android client:

keytool -list -v -keystore ~/.android/debug.keystore -alias androiddebugkey -storepass android

Summary