OIDC ID tokens require a signing change that must not interrupt existing sessions.
Developers need a clear path to asymmetric signing while active applications need their current sessions preserved.
Who you’d be doing this for
“The partner asked for an ID token, and now I’m staring at keys I can’t rotate during the week.”
Krit Rahman · Staff Application Engineer
Maintains an application that needs to issue OIDC tokens to a partner integration.
What is at stake
Projects with symmetric signing keys cannot issue the ID tokens their integrations require. You must weigh a simple migration path against the safety of sessions already in use.
Why it isn’t already fixed
Every obvious fix costs something else. That’s the part you’d have to decide.
- OIDC adoption vs session continuity
- self-service migration vs key-handling safety
- small public API vs clear developer guidance
- fast first release vs reversible project state
Why Supabase
Supabase Auth already serves as an OAuth 2.1 provider, so signing-key migration determines whether existing projects can use its OIDC behavior.
Written with these in mind
Not your kind of problem? 23 more at Supabase, or browse every organization.
This is the setup. The work is inside.
Running it puts you in the room: the full situation and its constraints, stakeholders who push back in their own words, and the decisions that are yours to make. What you produce becomes a Day One Plan — work you can show someone instead of describing.