Facebook native integration error

[manojtr]

Describe the bug
https://supabase.com/docs/reference/dart/auth-signinwithidtoken
In case of facebook native login getting below error: Even after using the latest package of
supabase_flutter: ^2.10.3

AuthApiException(message: Bad ID token, statusCode: 400, code: null)

Others reported the same issue here - #1259

UPDATE:

I tried with latest version 2.12.0 as well. Still the same error.

[manojtr]

@grdsdev any help on this is really appreciated. Thank you

[grdsdev]

Hi @manojtr, could you please confirm which version of facebook_flutter_auth you’re using?

To ensure proper integration, please make sure to include flutter_facebook_auth: ^7.0.0 as a dependency.

I’ve added an example in #1297 to simplify the integration process. Please refer to the example provided in the pull request.

Additionally, please follow all the steps outlined in https://supabase.com/docs/guides/auth/social-login/auth-facebook?queryGroups=language&language=flutter.

Let me know if this information is helpful.

Thanks.

[manojtr]

@grdsdev thank you very much for looking into this and also the extra information.

I was doing exactly the way you described in the example and I am still getting the same error unfortunately. Also I use flutter_facebook_auth: ^7.0.0 and supabase_flutter: ^2.12.0.

I am also reviewing the setup doc https://supabase.com/docs/guides/auth/social-login/auth-facebook?queryGroups=language&language=flutter again incase I missed something. I couldn't find anythings specific. I followed every steps in the doc although the facebook developer UI largely changed recently and many field names mentioned in the doc are no longer relevant.

In my case, I am able to retrieve the token and also the user name from facebook but the below call throws the error

        await Supabase.instance.client.auth.signInWithIdToken(
          provider: OAuthProvider.facebook,
          idToken: tokenString,
        );

Facebook developer setup is the one I am not 100% confident. Do I need to complete the business review and verification for my app in facebook to make this work?

This is how my usecase window looks like. When I hover the Requirements section I see "Business Verification", not sure is this something I need for testing the app. This is how my callback url settings in facebook. I masked the url for this post.

Any pointers, where should I look further? Or any logs I should be looking for more detailed error?

Thanks
Manoj

[manojtr]

@grdsdev Any help or any pointers for me to look? Thank you very much
By the way, is this supabase/auth#1522 related?

[jeremiahseun]

This is a docs issue @manojtr @grdsdev

I have tested it. Check it out here in #1322

[manojtr]

@jeremiahseun Thank you very much for your update on this. I tried this today and this is my observation.

    // Note: Android requires LoginBehavior.webOnly to return an OIDC ID Token.
    loginBehavior: LoginBehavior.webOnly,

These lines still opens a browser, is that right? I thought the native login just opens facebook app and logs in. Any other way without involving a browser?

Also when I tested it, I dont see any error. It opened a browser session with my login and then I click continue. When I clock continue, I get this error No ID Token found. Make sure you use LoginBehavior.webOnly on Android.. I double checked the facebook developer console settings and it looks correct to me. I have Client OAuth login is ON, Web OAuth login is ON and Valid OAuth Redirect URIs as https://<my supabase project id>.supabase.co/auth/v1/callback

When I print what facebook returns I get this

ClassicToken details – authenticationToken: null, userId: 122xxxx922992808, applicationId: xxxxxxx70692645, grantedPermissions: [openid, public_profile, email], declinedPermissions: [], expires: 2026-05-28 21:24:06.098, type: AccessTokenType.classic

ClassicToken toJson: {type: classic, userId: 122xxxx922992808, tokenString: EAAUfC6XSiCUBRPI9qZB2kN7vaRic6jJigVaZC9ajQHsrDt9MXN5CuZCYgJ7JKJTlk6gxnGmJrTKOaUFtdsfsdfsdfsfssfsfasasfaVyJZCU35E2O01ExlK7iWUFZA9QXZCSDOeSrXRWjarJW4XblHJNiajk4F1EEcdi8LLsN5pHH3dOKvy0UECD91BxjY3pSzF3guSXocTsIZAhL9OK1YKAMGqRZAe3IwKZA24ZD, expires: 1779967446098, applicationId: xxxxxxx70692645, grantedPermissions: [openid, public_profile, email], declinedPermissions: [], authenticationToken: null}

Please note I changed the token string for sharing

FYI @grdsdev