Authentication Providers Reference

Provide quick reference for Better Auth authentication providers.

Usage

1. Specific provider (e.g., /better-auth:providers google):

   • Show detailed configuration for that provider
   • Display code example with Cloudflare D1 integration
   • List required environment variables
   • OAuth callback URL format
   • Common issues and solutions

2. No argument (e.g., /better-auth:providers):

   • Show overview of all available providers by category
   • Display setup instructions
   • Link to full documentation

Provider Categories

OAuth Providers (45+)

Popular:

• Google (openid, email, profile scopes)
• GitHub (user, email scopes)
• Microsoft (openid, email, profile)
• Apple (name, email)
• Discord (identify, email, guilds)

Social Media:

• Twitter/X (tweet.read, users.read)
• Facebook (email, public_profile)
• LinkedIn (openid, profile, email)
• TikTok (user.info.basic)
• Instagram (user_profile, user_media)
• Reddit (identity, read)

Developer Platforms:

• GitLab (read_user, email)
• Bitbucket (account, email)
• Vercel (user, email) - v1.4.3+
• Atlassian (read:me, read:account)

Gaming & Streaming:

• Twitch (user:read:email)
• Kick (user:read) - v1.4.6+
• Steam (identity, email)
• Patreon (identity, campaigns) - v1.4.8+

Communication:

• Slack (users:read, users:read.email)
• Spotify (user-read-email, user-read-private)
• Dropbox (account_info.read)
• Box (manage_app_users)

Enterprise:

• Okta (openid, profile, email)
• Azure AD / Entra ID
• Keycloak (openid)
• Auth0 (openid, profile, email)

Other Providers:

• Strava, Lichess, Workos, Roblox, Coinbase, Line, Vk, Yandex, and 15+ more

Email/Password Authentication

emailAndPassword: {
  enabled: true,
  requireEmailVerification: true,
  sendResetPassword: async ({ user, url, ctx }) => {
    // Send password reset email
  }
}

Magic Link Authentication

import { magicLink } from "better-auth/plugins/magic-link"

plugins: [
  magicLink({
    sendMagicLink: async ({ email, url, ctx }) => {
      // Send magic link email
    }
  })
]

Passkey/WebAuthn

import { passkey } from "@better-auth/passkey"

plugins: [passkey()]

Configuration Template

For a specific provider (e.g., Google):

// Server config (auth.ts)
import { betterAuth } from "better-auth"
import { drizzleAdapter } from "better-auth/adapters/drizzle"

export const auth = betterAuth({
  database: drizzleAdapter(db, { provider: "sqlite" }),
  socialProviders: {
    google: {
      clientId: env.GOOGLE_CLIENT_ID,
      clientSecret: env.GOOGLE_CLIENT_SECRET,
      scope: ["openid", "email", "profile"]  // Optional
    }
  }
})

// Client code
import { authClient } from "./auth-client"

await authClient.signIn.social({
  provider: "google",
  callbackURL: "/dashboard"
})

Environment Variables

# For each OAuth provider
GOOGLE_CLIENT_ID=your_client_id
GOOGLE_CLIENT_SECRET=your_client_secret

GITHUB_CLIENT_ID=your_client_id
GITHUB_CLIENT_SECRET=your_client_secret

# ... repeat for each provider

OAuth Callback URL Format

https://yourdomain.com/api/auth/callback/{provider}

Examples:

• https://yourdomain.com/api/auth/callback/google
• https://yourdomain.com/api/auth/callback/github
• http://localhost:8787/api/auth/callback/google (development)

Critical: No trailing slash, exact match required in provider dashboard

Common Provider Setup Steps

1. Create OAuth app in provider dashboard
2. Set redirect URI to callback URL (exact match)
3. Copy client ID and secret to environment variables
4. Configure scopes (optional, use defaults)
5. Add to socialProviders config
6. Test authentication flow

Provider-Specific Notes

Google:

• Requires verified domain for production
• Consent screen must be configured
• Refresh tokens require offline_access scope

GitHub:

• No refresh tokens by default
• Private email requires user:email scope
• Organizations need read:org scope

Microsoft:

• Use common endpoint for multi-tenant
• Requires app registration in Azure AD
• Graph API requires additional scopes

Apple:

• Requires developer account ($99/year)
• Returns user info only on first login
• Refresh tokens valid for 6 months

Discord:

• Bot vs OAuth app distinction
• Refresh tokens valid for 30 days
• Guild info requires special scope

New Providers (v1.4+)

Vercel (v1.4.3)

vercel: {
  clientId: env.VERCEL_CLIENT_ID,
  clientSecret: env.VERCEL_CLIENT_SECRET
}

Kick (v1.4.6) - with refresh tokens

kick: {
  clientId: env.KICK_CLIENT_ID,
  clientSecret: env.KICK_CLIENT_SECRET
}

Patreon (v1.4.8)

patreon: {
  clientId: env.PATREON_CLIENT_ID,
  clientSecret: env.PATREON_CLIENT_SECRET,
  scope: ["identity", "identity[email]", "campaigns"]
}

Documentation Links

• Full provider list: https://better-auth.com/docs/authentication/social
• OAuth setup: https://better-auth.com/docs/concepts/authentication
• Provider-specific guides: https://better-auth.com/docs

Offer to Generate Code

If user is currently working on authentication code, offer to:

1. Generate complete integration code for selected provider
2. Create environment variable template
3. Set up OAuth callback route
4. Implement client-side sign-in component