# Kotlin Android + Supabase: the deep-link handler agents skip
The Supabase Android quickstart works up to the moment the user taps "sign in with GitHub". Then the browser opens, auth succeeds, and nothing brings the user back, because the manifest has no intent filter for your scheme.
## Checkable procedure
1. Pick a scheme and host for auth callbacks and add the full redirect URL to the dashboard Redirect URLs.
2. Add an intent filter to `AndroidManifest.xml` (on your auth handler activity) with `action.VIEW`, `category.BROWSABLE`, and a `data` element matching your scheme and host.
3. Create the handler activity the docs describe: it receives the deep link intent, hands the URL to the Supabase client to create the session, then navigates into the app.
4. Add the internet permission to the manifest. It sounds obvious, but release builds without it fail with network errors that look like Supabase outages.
5. Keep the publishable key in the app and the service role key out of it. The APK can be decompiled; anything in it is public.
## Quick test
On a real device, start OAuth, complete it in the browser, and confirm the app reopens signed in. If the browser shows a "page not found" or stays open, the intent filter or dashboard redirect URL is mismatched.