> ## Documentation Index
> Fetch the complete documentation index at: https://exegia.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> Supabase authentication for Tauri v2 desktop apps: a Rust plugin, typed webview bindings, and React hooks shipped from one lockstep version.

<img src="https://mintcdn.com/exegia/5sAAObCMQm2d32e4/images/banner.png?fit=max&auto=format&n=5sAAObCMQm2d32e4&q=85&s=cf8dd05fd1a1014a6ca61d1100faa64b" alt="Introduction banner" width="100%" data-path="images/banner.png" />

Desktop authentication has a few problems the web does not: token storage that is not a plain-text JSON file, OAuth redirects with no web server to redirect to, sessions that survive a restart, and background refreshes that must never race a sign-out. This plugin solves them once and exposes the result to both sides of a Tauri app.

## What ships

| Artifact                       | What it is                                                                                 |
| ------------------------------ | ------------------------------------------------------------------------------------------ |
| `tauri-plugin-supabase-auth`   | The Rust plugin. Owns the session, the keychain, the OAuth loopback, and the refresh task  |
| `@exegia/plugin-supabase-auth` | Typed webview bindings over `invoke`, plus push auth-state events                          |
| `@exegia/use-auth`             | React hooks built on the bindings: session, auth actions, onboarding, identities, passkeys |

All three are versioned in lockstep from one repository.

## Guarantees worth knowing

<Columns cols={2}>
  <Card title="Refresh tokens never reach the webview" icon="shield">
    Sessions crossing the IPC boundary are sanitized. Only Rust sees the full
    session.
  </Card>

  <Card title="No zombie sessions" icon="lock">
    Every mutation serializes through one lock held across the network await, so
    a sign-out racing a background refresh always ends fully signed out.
  </Card>

  <Card title="Offline-friendly" icon="plane">
    Launching offline with an unexpired stored session keeps you signed in;
    refresh retries in the background. Corrupt or revoked stored sessions
    degrade to signed-out, never a crash.
  </Card>

  <Card title="Nothing hangs" icon="timer">
    Every call resolves or rejects within a 15 second network budget. A stalled
    request surfaces as a `network` error, not a pending promise.
  </Card>
</Columns>

## Where to go next

<Columns cols={2}>
  <Card title="Quickstart" icon="rocket" href="/quickstart">
    Install, configure, and sign someone in.
  </Card>

  <Card title="React hooks" icon="anchor" href="/components/overview">
    Session state and never-throwing auth actions, with no UI of their own.
  </Card>

  <Card title="JavaScript API" icon="code" href="/plugin/javascript-api">
    Every binding, and the structured error type behind each rejection.
  </Card>

  <Card title="Permissions" icon="key" href="/plugin/permissions">
    The default command set, and the account mutations you opt into.
  </Card>
</Columns>