Third-party auth (Firebase, Auth0, Clerk, Cognito)

Moving the backend doesn't have to mean moving sign-in. Trust your current auth system's issuer, and the app swaps that system's token for a Sovaria session of the same person. Row-level security, Guard policies, storage and realtime then work as with any Sovaria user.

1. 1

   Connect the issuer

   Authentication › Third-party auth: Firebase (its project ID), Auth0 / Clerk / WorkOS (the tenant domain), Cognito (region + user pool) or any OIDC issuer (issuer + JWKS URL). Sovaria reads the signing keys right away to check the address.

   CLI

   sov auth-third-party add firebase --firebase-project-id my-app
   sov auth-third-party add auth0 --domain acme.us.auth0.com --audience https://api.acme.com

2. 2

   Exchange the token in the app

   JavaScriptSwiftKotlin

   const idToken = await firebase.auth().currentUser.getIdToken()
   await sovaria.auth.signInWithThirdPartyToken(idToken)   // a normal Sovaria session from here on

• Sovaria checks the signature against the issuer's keys (cached, rotation-aware), iss, aud (when you list audiences), exp and nbf.
• The person becomes an app user linked to tp:<issuer>:<sub> on first use, even with public sign-ups off (the issuer decides who exists). A verified email links to an existing user with that address.
• The token's role claim (role by default) is kept as the custom claim third_party_role, so policies can use it: auth.jwt() -> 'ctx' ->> 'third_party_role'.
• Exchanges use the sign-in rate limit; MFA, MAU limits and your before-sign-in hook apply.

#Plans