Day 1 of Building HYNA-Stage: Slaying OAuth Loops & Adding GitHub Auth on a $150 Phone

Welcome to Day 1 of the public build log for HYNA-Stage.

For those catching up: We are HYNAWEB. I’m Harun (12-year-old Founder & CEO) and my co-founder is Akhouri (CTO). We are building enterprise-grade developer infrastructure entirely on a $150 Android phone using Termux.

Our mission with HYNA-Stage? Spin up isolated Firecracker microVMs in <5 seconds so AI agents have a safe, instant place to test code.

Today’s mission wasn’t about adding flashy features. It was about fixing the foundation: Authentication.

If users can’t log in smoothly, the product is dead. Here are the 3 "Boss Fights" we faced and conquered today to make HYNAWEB's auth flow bulletproof.

🐛 Boss Fight 1: The OAuth Hash Loop

• The Symptom: Users clicked "Login with GitHub," authenticated successfully, but got dumped at the root URL (/#access_token=...) instead of the dashboard.
• The Root Cause: Supabase rejected our redirectTo URL due to a hyphen mismatch (hynastage vs hyna-stage) in the configuration, falling back to the default Site URL and leaving the token stranded in the hash.
• The Fix: I wrote a vanilla JS hash interceptor in index.html to instantly catch the token, forward it to dashboard.html, and parse it before the session timed out.

🐛 Boss Fight 2: The 401 JWT Gateway Block

• The Symptom: Our custom CLI API keys were getting hit with 401 Unauthorized before even reaching the function logic.
• The Root Cause: Supabase Edge Functions enforce JWT verification by default. It saw our custom CLI request, didn't recognize the JWT, and slammed the door.
• The Fix: Disabled "Verify JWT with legacy secret" in the Supabase Edge Function settings, allowing our custom API key validation logic to run unimpeded.

🐛 Boss Fight 3: The RLS Permission Denied

• The Symptom: Database queries returned 0 rows, even though the API key was valid.
• The Root Cause: New Supabase projects require explicit Postgres GRANT permissions for the service_role, even when using the sb_secret_ bypass key. Row-Level Security was blocking the backend from reading its own table.
• The Fix: Executed GRANT ALL PRIVILEGES ON TABLE public.api_keys TO service_role; in the SQL editor.

🏆 The Result

GitHub Auth is now live and buttery smooth. The redirect works perfectly. The CLI can talk to the database without getting blocked by the gatekeeper.

Today's HYNAWEB Stats:

• Bugs squashed: 3
• Auth flows perfected: 1
• Laptops used: 0

Building cloud infrastructure on a mobile terminal means you don't have the luxury of bloat or easy debugging tools. Every fix has to be precise.

Tomorrow, we tackle the deployment pipeline and the Termux text-truncation nightmare.

Follow the series to see how we build the infrastructure for the AI era, one bash script at a time.

We are HYNAWEB. We don't just build apps; we build the future. 🐯☁️🚀

Live Dashboard: hyna-stage