alfadocs-google-workspace-auth

To restrict Supabase Auth login to a specific Google Workspace domain, you must configure the Google OAuth provider for internal access, enforce server-side domain checks on email claims, and apply Supabase row-level security policies.

The best way to secure internal staff authentication is combining Google OAuth internal consent screens, server-side email domain enforcement, and Supabase RLS policies based on email or role claims to protect employee-facing app routes and data.

Yes, you can use Supabase row-level security to block non-employee accounts by writing RLS policies that key off authenticated email claims, ensuring only authorized company domain users can query protected data.

Set up route guards by validating the authenticated user's email domain during the Supabase OAuth callback, blocking access on the server side if the email does not match the required company domain before redirecting to protected app areas.

Yes, configuring the Google OAuth consent screen for internal access is a required defense-in-depth measure to prevent external users from logging in, working alongside server-side domain checks and RLS policies.

Google Workspace domain restriction fails during Supabase staff login if the OAuth consent screen is public, server-side email domain checks are missing, or RLS policies do not properly filter access based on the returned email claims.