Sign-in and access

Use local passwords, Auth0 or an OpenID Connect provider. Open Inventory manages organizations, roles and permissions.

Auth0 or OIDC requires an existing active user with the same email address, and the provider must return email_verified: true. Test external sign-in before disabling local passwords. The current iOS password sign-in does not work with an external-only deployment.

Configure Auth0 and OIDCCopy Anchor Link

Auth0 requires AUTH0_CLIENT_ID, AUTH0_CLIENT_SECRET and AUTH0_DOMAIN. Register https://inventory.example.com/api/auth/callback/auth0 as the callback.

AUTH_OIDC_PROVIDER_ID=supabase
AUTH_OIDC_PROVIDER_NAME=Supabase
AUTH_OIDC_ISSUER=https://your-project.supabase.co/auth/v1
AUTH_OIDC_CLIENT_ID=your-client-id
AUTH_OIDC_CLIENT_SECRET=your-client-secret
AUTH_OIDC_SCOPES=openid email profile

For OIDC, the final callback segment is the provider ID: https://inventory.example.com/api/auth/callback/supabase in this example. Replace the example domain with your application address.

Configure sign-in providers →