Better Auth · Authentication · all subjects

social sign-on/generic-oauth

9 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Generic OAuth plugin installation in auth config

To use the Generic OAuth plugin, import genericOAuth from 'better-auth/plugins' and add it to the plugins array in the betterAuth config. Pass a config array with provider objects, each containing providerId, clientId, clientSecret, discoveryUrl, and other configuration options.

Generic OAuth client plugin installation

Include the Generic OAuth client plugin in your authentication client instance by importing genericOAuthClient from 'better-auth/client/plugins' and adding it to the plugins array in createAuthClient.

Generic OAuth basic configuration example

A generic OAuth provider requires providerId, clientId, clientSecret, and discoveryUrl. Example: ```ts import { betterAuth } from "better-auth" import { genericOAuth } from "better-auth/plugins" export const auth = betterAuth({ plugins: [ genericOAuth({ config: [ { providerId: "provider-id", clientId: process.env.CLIENT_ID, clientSecret: process.env.CLIENT_SECRET, discoveryUrl: "https://auth.example.com/.well-known/openid-configuration", }, ], }), ], }) ```

Pre-configured OAuth providers available

Better Auth provides pre-configured helper functions for popular OAuth providers including Auth0, Keycloak, Okta, Microsoft Entra ID, and Slack. These helpers simplify configuration by requiring only clientId and clientSecret.

Generic OAuth supports OAuth2 and OIDC protocols

Better Auth's Generic OAuth plugin supports any social provider that implements the OAuth2 protocol or OpenID Connect (OIDC) flows.

OAuth2 sign-in call with callbackURL parameter

The authClient.signIn.oauth2 method accepts providerId and callbackURL parameters. The callbackURL is the path to redirect to after the user is authenticated.

Yandex provider pre-configured for generic OAuth

A pre-configured Yandex provider helper is now available for the generic OAuth plugin.

Generic OAuth requires provider account ID

Generic OAuth sign-in now requires a provider account id. Sign-in is rejected when no account id can be resolved from the provider response. The default userinfo handler returns no profile when neither sub nor id is present, and the built-in OAuth callback rejects an empty account id.

Generic OAuth requires sub or id for profile mapping

Generic OAuth sign-in works again for providers whose userinfo response has no sub or id field when mapProfileToUser derives the account id. An empty id field now falls back to sub.

Give your agent this brain