Enable the Supabase OAuth server and confirm the connector can discover it #223

Problem

docs.plus has no way for a person to connect it to Claude or ChatGPT. The blocker looked like a missing credential system. It is not.

Supabase already ships an OAuth 2.1 authorization server. The switch is in this repository at packages/supabase/config.toml:357-363, and it is off:

[auth.oauth_server]
enabled = false
authorization_url_path = "/oauth/consent"
allow_dynamic_registration = false

Even with the server disabled, GET /auth/v1/.well-known/openid-configuration already returns 200 and advertises /auth/v1/oauth/authorize, /auth/v1/oauth/token, authorization_code, refresh_token, and PKCE (code_challenge_methods_supported: ["S256","plain"]).

Two fields are missing, and both are configuration. registration_endpoint is absent, because allow_dynamic_registration = false. client_id_metadata_document_supported is absent. Claude needs one of those two.

What to do

In the production Supabase dashboard:

1. Enable the OAuth server.
2. Enable dynamic client registration.
3. Set site_url to the docs.plus origin.

Then re-probe. This is a configuration change and a measurement. Write no code.

Acceptance

• GET /.well-known/oauth-authorization-server/auth/v1 returns 200, not {"code":404,"error_code":"feature_disabled"}.
• GET /auth/v1/.well-known/openid-configuration now includes registration_endpoint.
• The result is recorded on this issue, pass or fail.
• The issue records which of the two Claude accepts: registration_endpoint, or client_id_metadata_document_supported.

Notes

This is the cheapest go or no-go decision in the connector work. It takes hours, not days. If either probe fails, every task below it changes shape, so nothing else starts until this is answered.

Supabase supports five fixed scopes: openid, profile, email, phone, offline_access. Custom scopes do not exist, and OAuth scopes do not control access to database tables. Scoping belongs to Row Level Security and to which tools the connector chooses to expose.

Do not build a credential table. A pasted API key is org-shared, and it is immutable after a connector is added. Claude's own documentation says to use OAuth when each person signs in as themselves.