Third-party identity with Supabase, Auth0 and Clerk

If your users already sign in with Supabase Auth, Auth0 or Clerk, your client can trade their token for an environment session at POST /v1/token/exchange. The environment then issues its own access and refresh tokens, with roles and permissions from its own roles and permissions. The external system keeps the passwords. See Managed and external authentication for the exchange rules that apply to every trusted issuer.

A preset fills in the expected settings for one provider and adds checks that stop its known pitfalls. It never relaxes a core rule, and you can see and edit every field before you save. A row that drops a preset's checks must be saved as custom.

Presets

Only an Owner can add trusted issuers.

axiom auth trusted-issuers add --environment production \
  --preset supabase \
  --issuer https://abcdefghijklmnopqrst.supabase.co/auth/v1 \
  --audience authenticated

axiom auth trusted-issuers add --environment production \
  --preset clerk \
  --issuer https://example-app.clerk.accounts.dev \
  --audience "https://auth.axiomcore.dev/PROJECT_ID/ENVIRONMENT_ID/api" \
  --authorized-party https://app.example.com

The issuer is saved disabled unless you pass --enable. Test it with a real token first.

Test a token

The diagnostic test runs the full validation on a token you paste and creates nothing: no user, no session.

axiom auth trusted-issuers test ISSUER_ID --token-file ./upstream-token.txt

It reports a decision for each step: issuer selected, key found, signature, audience, required claims, forbidden claims, authorized party, subject and assurance. It never prints the token or any claim value, only claim names. The token is read from the file and never logged. The test is rate limited.

Hosted sign-in through Auth0 or Clerk

To send users to Auth0 or Clerk from the issuer's hosted sign-in page instead of exchanging tokens, add an OpenID Connect provider for the tenant:

axiom auth providers set oidc-auth0 --environment production \
  --issuer https://example.us.auth0.com/ \
  --client-id YOUR_AUTH0_CLIENT_ID --scopes openid,email,profile \
  --client-secret-stdin --enable < auth0-client-secret.txt

Clerk works the same way when your Clerk instance exposes OpenID Connect discovery (Clerk OAuth applications). Hosted sign-in through Supabase is not offered.

Upstream MFA

By default an exchanged session is aal1 (amr ["ext"]), even if the user completed MFA upstream. To let assurance guards trust the upstream MFA, an Owner saves an assurance mapping on the trusted issuer or OIDC provider: at most 2 rules, each {"claim":"<name>","equals":<json value>} or {"claim":"<name>","contains":"<string>"}. When every rule matches, the session gets amr ["ext","mfa"] and acr aal2. It never reaches phr.

The mapping is off until an Owner saves it. Changing it ends that issuer's exchanged sessions at their next refresh.

Who owns what

Upstream revocation is not observed: an exchanged session ends at its lifetime, at a local ban, or when the upstream token can no longer be exchanged. If the upstream JWKS cannot be fetched, cached keys are used for up to 24 hours, then exchanges are refused. Users created by exchange are shown in the dashboard's Users table with the preset's name.

Next steps

• Sign in with Microsoft and Apple
• Multi-factor authentication and passkeys
• Sessions and tokens