---
title: "Create Project Auth Method"
method: POST
path: "/v2/projects/{id}/auth/methods"
tags: ["Project Auth V2"]
---

# Create Project Auth Method

`POST /v2/projects/{id}/auth/methods`

## Request

- Base URL: `https://api.superwall.com`
- URL: `https://api.superwall.com/v2/projects/{id}/auth/methods`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `accounts_superwall_token`
  - HTTP bearer

Adds a sign-in method. `apple`, `google` and `firebase` derive their issuer (`firebase` from `firebase_project_id`). An `oidc` issuer must be https and serve an OpenID Connect discovery document that declares the same issuer and a `jwks_uri`; a provider that fails that check is a 400. A project accepts one method per issuer, and one `email` method: a second is a 409. An `email` method's `link_domain` must be a web paywall domain of one of the project's applications, or it is a 400. A 403 means Superwall Auth is not available to the project yet. Requires projects:write scope.

## Path parameters

- `id` string, required

## Request body

- union
  - object
    - `type` 'oidc' | 'apple' | 'google' | 'firebase', required: `apple` (Sign in with Apple), `google` (Google Sign-In), `firebase` (Firebase Authentication) or `oidc` (any OpenID Connect issuer, e.g. Supabase or Auth0).
    - `issuer` string: Required for `oidc`: an https issuer that serves `/.well-known/openid-configuration`. It is checked against that document, and the issuer the document declares is what is stored. Derived for `apple`, `google` and `firebase`, so omit it there.
    - `audiences` string[]: Accepted `aud` values: bundle ids for `apple`, OAuth client ids for `google`, the Firebase project id for `firebase`, the client id or API audience for `oidc`. A token must name at least one.
    - `app_user_id_claim` string: The ID token claim whose value becomes the app user id. Defaults to `sub`.
    - `enabled` boolean: Defaults to `true`.
    - `firebase_project_id` string: The Firebase project id (`firebase` only).
    - `link_domain` string, nullable: `email` only: any value is a 400 for an identity provider.
  - object
    - `type` 'email', required
    - `link_domain` string, nullable: A web paywall domain of one of the project's applications (see `GET /v2/projects/{id}/auth/link-domains`). The app must open links on its `link_host`. Omit or `null` to send the code alone.
    - `enabled` boolean: Defaults to `true`.

## Response `200`

Success

- union
  - object: An identity provider whose ID tokens the project accepts.
    - `object` 'project_auth_method', required
    - `id` string, required
    - `project_id` string, required
    - `type` 'oidc' | 'apple' | 'google' | 'firebase', required: `apple` (Sign in with Apple), `google` (Google Sign-In), `firebase` (Firebase Authentication) or `oidc` (any OpenID Connect issuer, e.g. Supabase or Auth0).
    - `issuer` string, required: The `iss` an ID token must carry, exactly as the provider issues it.
    - `audiences` string[], required: Accepted `aud` values. A token must name at least one.
    - `app_user_id_claim` string, required: The ID token claim whose value becomes the app user id.
    - `enabled` boolean, required: Disabled methods are kept but no longer accept tokens.
    - `created_at` string, required: ISO 8601 creation timestamp
    - `updated_at` string, required: ISO 8601 last-update timestamp
  - object: Superwall's built-in email sign-in: users get a 6-digit code by email and, with a link domain, a link that opens the app. A project has at most one.
    - `object` 'project_auth_method', required
    - `id` string, required
    - `project_id` string, required
    - `type` 'email', required
    - `link_domain` string, nullable, required: The web paywall domain whose links open the app from the sign-in email. `null` sends the code alone, as does a domain that has since been deleted.
    - `link_host` string, nullable, required: The host the sign-in link opens, which the app must claim (iOS universal links, Android App Links). `null` when there is no `link_domain`, or this environment has no app-link domain.
    - `enabled` boolean, required: Disabled methods are kept but no longer send codes or accept them.
    - `created_at` string, required: ISO 8601 creation timestamp
    - `updated_at` string, required: ISO 8601 last-update timestamp

## Other responses

- `400`: The request did not match the expected schema | The request was invalid or malformed
- `401`: No API key was provided in the request | The API key does not have a valid format | The API key is invalid or has been revoked | An error occurred while validating the API key | The session cookie is invalid or expired
- `403`: The API key does not have permission to perform this action
- `404`: The requested resource was not found
- `409`: The resource already exists or conflicts with an existing resource
- `429`: Too many requests have been made in a short period
- `500`: An unexpected error occurred on the server

## Changes

- **2026-11-02** `6d77be7f87b5`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/superwall/apis/superwall-api-v2/changes/v2/projects/:id/auth/methods/post.md)

---

[API](https://skmtc.dev/superwall/apis/superwall-api-v2.md) - [All operations](https://skmtc.dev/superwall/apis/superwall-api-v2/llms.txt) - [OpenAPI document](https://skmtc.dev/superwall/apis/superwall-api-v2/revisions/523b4734dfab?raw)