Connect GitHub and Supabase

How-to

You connect three services to MaShop: GitHub, Supabase, and Netlify. Each one hands MaShop a scoped access token so it can build your shop on infrastructure you own. GitHub holds your code. Supabase holds your database. Netlify runs your live site. MaShop never stores your customers or orders; it provisions these accounts on your behalf and writes the results to your own projects.

This page shows you how to connect each service, what consent you grant, and what MaShop does with each token. Netlify is the only deployment target. There is no Vercel option.

Why three connections

When you publish a project, MaShop runs a provisioning sequence that touches all three services in order. Each connection unlocks one part of that sequence.

Service	What MaShop does with it	OAuth scope requested
GitHub	Creates a private repository named mashop-{slug} in your account (or reuses one you already linked), then pushes the generated code into it.	repo user:email
Supabase	Creates a new Supabase project in your organization, applies the backend database migrations, and reads back the project keys.	all
Netlify	Creates a site, wires it to your GitHub repo, and triggers the first build and deploy.	(default account scope)

Until all three are connected, the publish button stays disabled. The deploy modal lists the three connectors and requires every one before it lets you provision.

How a connection works

Connecting a service is a standard OAuth flow. From the deploy modal MaShop opens a small popup window (600 by 700 pixels); from the GitHub panel it sends you to the provider in the same tab instead. Either way you approve access at the provider, and MaShop stores the resulting token encrypted in your account. You never paste an API key by hand.

1. You click Connect for a service in the deploy modal, the GitHub panel, or the onboarding step.
2. MaShop calls GET /api/oauth/initiate?provider=github and builds a signed authorization URL for that provider.
3. The provider screen (GitHub, Supabase, or Netlify) asks you to approve the requested scope.
4. The provider returns you to GET /api/oauth/callback, which exchanges the one-time code for an access token, encrypts it, and stores it in the oauth_tokens table keyed to your user and the provider.
5. The connection turns green (the popup closes if one was opened).

MaShop reads which providers you have connected from GET /api/oauth/check-connections, which returns three booleans:

{
 "success": true,
 "connections": {
 "github": true,
 "supabase": false,
 "netlify": false
 }
}

Connect GitHub

GitHub gives MaShop a place to put your code. The requested scope is repo user:email: repo lets MaShop create and push to repositories in your account, and user:email lets it read your primary email and username so it can label the connection.

Open a project, open the GitHub panel, and click Se connecter à GitHub (Connect to GitHub). Approve the GitHub authorization screen. When the callback succeeds, MaShop also reads your GitHub login and avatar and marks github_connected on your profile.

During provisioning, MaShop creates a private repository whose name is derived from your project slug as mashop-{slug}. If a repo of that name already exists on your account from an earlier attempt, MaShop reuses it instead of failing, so retries are safe. You can also link an existing repository instead of creating a new one through POST /api/github/connect-repo with mode link.

Connect Supabase

Supabase gives MaShop a database to provision. The requested scope is all, which covers reading your organizations and creating projects through the Supabase Management API.

Click Connect for Supabase in the deploy modal and approve the Supabase authorization screen. Once connected, MaShop can list the projects you own through GET /api/integrations/supabase/projects/list and link a MaShop project to one of them with POST /api/integrations/supabase/link.

When you publish, MaShop does the following with your Supabase token:

• Picks your default organization (the first one the Management API returns).
• Creates a new free-plan project named mashop-{slug} in the eu-central-1 region.
• Polls the project status every 4 seconds until it reports ACTIVE_HEALTHY.
• Applies the backend database migrations one by one.
• Reads back the anon and service_role API keys and writes them to your project row. The anon key is public by design; the service_role key is encrypted at rest.

Connect Netlify

Netlify gives MaShop somewhere to deploy. The initiate route requests Netlify's default account scope, so you grant access to create sites and trigger builds on your Netlify account.

Click Connect for Netlify in the deploy modal and approve the Netlify authorization screen. When you publish, MaShop uses your Netlify token to create a site, connect it to your GitHub repository, push the database environment variables your site needs, and start the first build. Subsequent deploys reuse the same site rather than creating a new one.

Your first onboarding deploy is a courtesy and does not count against your monthly Free-tier deploy quota. Later deploys you trigger yourself do count. See Deploy on Netlify for the deploy flow and quota details.

What "publish" runs after you connect

With all three services connected, publishing runs a single resumable sequence. Each stage is idempotent, so if a step is interrupted MaShop continues from the last recorded stage instead of repeating work:

1. supabase_creating then supabase_waiting_ready then supabase_applying_migrations on your Supabase account.
2. github_creating_repo then github_pushing_template on your GitHub account.
3. netlify_triggering_build on your Netlify account, ending at ready.

The work is reachable two ways: the first-run onboarding step, and the workspace Publier (Publish) button in the deploy modal. Both call the same provisioning runner, which verifies you own the project, fetches and decrypts your tokens, and advances the sequence one bounded step at a time.

Manage or remove a connection

To disconnect a provider, MaShop calls POST /api/oauth/disconnect with a body of { "provider": "github" } (or supabase or netlify). This deletes the stored token for that provider from your account. Your repositories, Supabase projects, and Netlify sites stay exactly as they are; only MaShop's access to them is revoked. Reconnect any time to publish again.

Common failures and what they mean

Message	Cause	Fix
OAuth state could not be verified. Please retry the connection.	The signed state token failed verification, usually because you reopened an old authorization link.	Close the popup and click Connect again to start a fresh flow.
La session OAuth a expiré. Veuillez recommencer.	You took longer than 10 minutes between starting and finishing the consent. The state is valid for 10 minutes only.	Start the connection again and approve promptly.
Échec de l'échange du code d'autorisation.	The provider rejected the one-time code during the token exchange.	Retry. If it persists, confirm you approved the requested scope on the provider screen.
Supabase not connected. / Supabase token expired or lacks permission for this project.	No stored Supabase token, or the stored one is expired or under-scoped.	Reconnect Supabase from the deploy modal.