supabase/supabase-swift v2.53.0 on GitHub

Highlights

OAuth 2.1 authorization server support (Auth)

New AuthClient.oauthServer namespace so a signed-in user can manage third-party app authorization requests directly from your app — approve/deny a pending consent request, and list or revoke grants already given:

try await supabase.auth.oauthServer.approveAuthorization(authorizationId: id)
try await supabase.auth.oauthServer.denyAuthorization(authorizationId: id)
let grants = try await supabase.auth.oauthServer.listGrants()
try await supabase.auth.oauthServer.revokeGrant(clientId: clientId)

Mirrors supabase-js's auth.oauth.*, adapted for Swift (e.g. getAuthorizationDetails returns an enum since the backend can silently auto-approve). Distinct from AuthAdmin.oauth (OAuth client CRUD) and signInWithOAuth (external provider sign-in).

PostgREST query builder gaps closed

notIn(_:values:) — dedicated not.in.(...) filter, mirroring in(_:values:).
dryRun() — sends Prefer: tx=rollback so a mutation executes and returns a response without persisting, useful for validating writes before committing to them.
maybeSingle() — like single(), but returns nil instead of throwing when a query matches zero rows.

Realtime WebSocket certificate pinning

RealtimeClientOptions gains a session: URLSession property, reusing the same injection idiom already used by StorageHTTPSession and SupabaseClientOptions.global.session. Apps that already pin global.session for Auth/PostgREST/Storage now get Realtime pinning for free — no extra config needed. Left at the default .shared, behavior is unchanged.

New API key format (`sb_publishable_…` / `sb_secret_…`) safety

Parity with supabase-js: SupabaseClient now warns once (never throws) on an unrecognized sb_-prefixed key subtype, and the Functions client never sends a new-format key as an Authorization: Bearer token (these keys aren't JWTs). Legacy JWT keys, and every other client, are unaffected.

Other fixes

Retry backoff now awaits the full delay instead of truncating to whole seconds (#1125).
Realtime no longer leaks a disconnected heartbeat status to consumers (#1129) and correctly invalidates a dedicated session when connect fails before opening (#1134).

2.53.0 (2026-07-21)

Features

auth: add OAuth 2.1 authorization server support (#1115) (4132009)
postgrest: add notIn filter, dryRun and maybeSingle modifiers (#1114) (0bbdbec)
realtime: support certificate pinning on the WebSocket connection (#1123) (b74a8fa)

Bug Fixes

client,functions: warn instead of throw on unrecognized sb_ key subtype; never send new-format key as Bearer (#1130) (286ce5f)
helpers: await full retry backoff delay instead of truncating to whole seconds (#1125) (f6d39cb)
realtime: don't leak disconnected heartbeat status to consumers (#1129) (dc37cd6)
realtime: invalidate dedicated session when connect fails before opening (#1134) (bbf3533)