Auth with PKCE

[nzoschke]

Great project, I got the first version of an supabase auth provider working in 5 minutes. However its using implicit flow, so the access_token is in a URL fragment and not available on the server side.

From the auth server side rendering docs, I need to configure the auth client to use PKCE flow by setting the flowType: 'pkce' some how.

I'm thinking this will either be a new option on ProviderSignInOptions or to CreateClient.

I plan to work on this an open a PR, but starting with an issue here in case anyone else has the problem or knows the solution.

[nzoschke]

I found the JS bits around here: https://github.com/supabase/gotrue-js/blob/master/src/GoTrueClient.ts#L1509

Looks like supabase-go will need to construct the /authorize URL with pkce params.

Some breadcrumbs for doing this with the Go oauth package are here: golang/oauth2#603