Supabase•4w ago•

2 replies

X/Twitter OAuth 2.0 fails with 400 - Supabase sending invalid users.email scope

auth

X/Twitter OAuth 2.0 authentication fails with "Something went wrong" error from Twitter. Similar to help-and-questionsX OAuth 2.0 - "Something Went Wrong" - Shown after following Supabase authorize url issue, I am able to sign in on local host and authorize but then get rejected with 400.

Supabase is sending

users.email

users.email

as a scope parameter, which is not a valid Twitter OAuth 2.0 scope.

The OAuth URL Supabase generates:

https://x.com/i/api/2/oauth2/authorize?client_id=...&scope=users.email+tweet.read+users.read+offline.access&redirect_uri=https://tilhvppsclhjqperqsvp.supabase.co/auth/v1/callback

https://x.com/i/api/2/oauth2/authorize?client_id=...&scope=users.email+tweet.read+users.read+offline.access&redirect_uri=https://tilhvppsclhjqperqsvp.supabase.co/auth/v1/callback

Browser console shows:
GET /i/api/2/oauth2/authorize?...&scope=users.email%20tweet.read...
[HTTP/2 400 82ms]

X returns: "Something went wrong. You weren't able to give access to the App."

According to Twitter's OAuth 2.0 documentation, valid scopes are:
-

tweet.read

tweet.read

tweet.write

tweet.write

users.read

users.read

follows.read

follows.read

follows.write

follows.write

offline.access

offline.access

like.read

like.read

like.write

like.write

I don't think the

users.email

users.email

scope exists and this is breaking the oauth.

Code:

  const { data, error } = await supabase.auth.signInWithOAuth({
    provider: 'x',
    options: {
      redirectTo: 'http://localhost:5173',
    },
  });

  const { data, error } = await supabase.auth.signInWithOAuth({
    provider: 'x',
    options: {
      redirectTo: 'http://localhost:5173',
    },
  });

None of these prevent Supabase from sending the users.email scope:

1. Toggled "Allow users without an email" OFF and back ON
2. Explicitly set custom scopes in code - Supabase appends them to defaults
3. Removed custom scopes entirely
4. Disabled and re-enabled the X provider
5. Created new Twitter OAuth app with fresh credentials

Supabase successfully redirects (302), but Twitter rejects the request (400):

{
"msg": "Redirecting to external provider",
"provider": "x",
"status": "302"
}

GitHub issue #41705 describes a separate redirectTo bug with X OAuth.

Is there a way to configure the X provider to not send the users.email scope?

Screenshot_2026-01-10_at_10.24.09_AM.png

Screenshot_2026-01-10_at_10.23.31_AM.png

GitHub

`redirectTo` option when signing in with X causes "Redirect is requ...

Bug report I confirm this is a bug with Supabase, not with my own application. I confirm I have searched the Docs, GitHub Discussions, and Discord. Describe the bug In Next.js when using signInWith...

X/Twitter OAuth 2.0 fails with 400 - Supabase sending invalid users.email scope

auth

users.email

users.email

as a scope parameter, which is not a valid Twitter OAuth 2.0 scope.

The OAuth URL Supabase generates:

https://x.com/i/api/2/oauth2/authorize?client_id=...&scope=users.email+tweet.read+users.read+offline.access&redirect_uri=https://tilhvppsclhjqperqsvp.supabase.co/auth/v1/callback

https://x.com/i/api/2/oauth2/authorize?client_id=...&scope=users.email+tweet.read+users.read+offline.access&redirect_uri=https://tilhvppsclhjqperqsvp.supabase.co/auth/v1/callback

tweet.read

tweet.read

tweet.write

tweet.write

users.read

users.read

follows.read

follows.read

follows.write

follows.write

offline.access

offline.access

like.read

like.read

like.write

like.write

I don't think the

users.email

users.email

scope exists and this is breaking the oauth.

Code:

  const { data, error } = await supabase.auth.signInWithOAuth({
    provider: 'x',
    options: {
      redirectTo: 'http://localhost:5173',
    },
  });

  const { data, error } = await supabase.auth.signInWithOAuth({
    provider: 'x',
    options: {
      redirectTo: 'http://localhost:5173',
    },
  });

GitHub

`redirectTo` option when signing in with X causes "Redirect is requ...

X/Twitter OAuth 2.0 fails with 400 - Supabase sending invalid users.email scope

X/Twitter OAuth 2.0 fails with 400 - Supabase sending invalid users.email scope

Similar Threads

Similar Threads

Similar Threads