Why We Moved Off a Third-Party Identity Provider to Supabase Auth

For most of PLLAY's early build-out, authentication and the rest of the platform's data lived in two different places: a third-party identity provider handled sign-in, and Supabase held everything else — creator profiles, pools, entries, payouts. That split worked, but it meant every feature that touched both — role checks, session state, anything that needed to know who a user was and what they were allowed to do — had to reconcile two systems instead of trusting one.

This month we moved fan-app, creator-leagues, and platform-core off that third-party provider and onto Supabase Auth, using Google, Twitch, and email/password as sign-in methods. The rollout went app by app rather than all at once, so any issues in one app's migration wouldn't put the others at risk.

The immediate win is simpler: one less system to reason about when debugging a session or role issue. The longer-term one is what it opens up — row-level security policies, role checks, and anything else that depends on "who is this user" can now be expressed directly against the same database that holds everything else about that user, instead of joining across a boundary between two separate systems.

It's the kind of change that, done right, a user never notices — sign-in still works the same way it did before. The difference shows up behind it, in how much simpler the next feature that touches identity gets to be.