Auth flows that return through a deep link

OAuth sign-in, magic links, email confirmation and password reset all end in the browser, which has to hand a link back to the app. supabase_flutter listens for that link through app_links, exchanges it for a session, and emits the result on onAuthStateChange. The app has to own a URL scheme, and the Supabase project has to allow it.

Native sign-in with signInWithIdToken (Google, Apple and Facebook SDKs) and email or phone codes verified with verifyOTP do not leave the app and need none of this.

Rules