Unable to authenticate with Supabase JWT in SpacetimeDB – OIDC public key fetch fails

Hi team,

I'm trying to authenticate a Supabase user with SpacetimeDB using their JWT (access_token) via the /v1/identity endpoint.

However, I'm encountering this error:

2025-04-13T13:43:47.145222Z DEBUG crates/core/src/auth/token_validation.rs:231: Getting validator for issuer https://{projectId}.supabase.co/auth/v1
2025-04-13T13:43:47.145787Z  INFO crates/core/src/auth/token_validation.rs:209: Fetching key for issuer https://{projectId}.supabase.co/auth/v1
2025-04-13T13:43:47.767179Z  WARN crates/core/src/auth/token_validation.rs:216: Error fetching public key for issuer https://{projectId}.supabase.co/auth/v1: FetchError(reqwest::Error { kind: Decode, source: Error("invalid type: integer `404`, expected struct OIDCConfig", line: 1, column: 3) })

It seems like SpacetimeDB is attempting to fetch .well-known/openid-configuration from Supabase to obtain the JWKS endpoint, but Supabase does not provide a standard OIDC config, resulting in a 404.

I do have the JWT secret (jwt_secret) from Supabase, and I was hoping to use that for verification instead. However, since I'm using Docker:

docker run --rm -p 3000:3000 clockworklabs/spacetime start

There doesn't seem to be a way to pass --jwt-secret or --jwt-public-key-url in this setup.

My original goal was to:

Authenticate via Supabase (access_token)

Pass the token to SpacetimeDB

Get back a valid { identity, token } pair

But I’m stuck due to this verification issue.
Am I missing something fundamental here?

Questions:
Does SpacetimeDB require a public JWKS URL (OIDC-compliant) for RS256 verification?

Can I provide the Supabase JWT secret instead for HS256 validation? If so, how can I configure it when using the start command or via Docker?

Is there a workaround for integrating Supabase JWT with SpacetimeDB?

Thanks in advance!