new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

Better Auth · Plugins · all subjects

generic-oauth/configuration

31 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

userInfoUrl configuration field

userInfoUrl is an optional string representing the endpoint to fetch user profile information. Not required if using discoveryUrl.

clientId configuration field

clientId is a required string representing the OAuth client ID issued by the provider.

clientSecret configuration field

clientSecret is a required string representing the OAuth client secret issued by the provider.

scopes configuration field

scopes is an optional array of strings representing scopes to request from the provider (e.g., ['openid', 'email', 'profile']).

authorizationUrl configuration field

authorizationUrl is an optional string representing the OAuth provider's authorization endpoint. Not required if using discoveryUrl.

Generic OAuth callback route

The plugin automatically mounts the route /oauth2/callback/:providerId to handle OAuth callbacks. By default this becomes ${baseURL}/api/auth/oauth2/callback/:providerId. The :providerId parameter is required and must match the configured provider ID. This URL must be registered with the OAuth provider as the redirect URI.

GenericOAuthConfig interface

The GenericOAuthConfig interface has the following fields: providerId (string), discoveryUrl (string, optional), issuer (string, optional), requireIssuerValidation (boolean, optional), authorizationUrl (string, optional), tokenUrl (string, optional), userInfoUrl (string, optional), clientId (string), clientSecret (string), scopes (string array, optional), redirectURI (string, optional), responseType (string, optional), prompt (string, optional), pkce (boolean, optional), accessType (string, optional), accessTokenExpiresIn (number, optional), getUserInfo (optional function), mapProfileToUser (optional function), authorizationUrlParams (optional), tokenUrlParams (optional), disableImplicitSignUp (boolean, optional), disableSignUp (boolean, optional), authentication (string, optional, 'basic' or 'post'), discoveryHeaders (object, optional), authorizationHeaders (object, optional), overrideUserInfo (boolean, optional), getToken (optional function), responseMode (string, optional).

providerId configuration field

providerId is a required unique string to identify the OAuth provider configuration.

discoveryUrl configuration field

discoveryUrl is an optional URL to fetch the provider's OAuth 2.0/OIDC configuration. If provided, endpoints like authorizationUrl, tokenUrl, and userInfoUrl can be auto-discovered.

issuer configuration field

issuer is an optional field representing the expected issuer identifier for validation. If not provided but discoveryUrl is set, it will be fetched from the discovery document. When set, the callback validates that the iss parameter matches this value.

requireIssuerValidation configuration field

requireIssuerValidation is an optional boolean. When true, it requires the iss parameter in callbacks if an issuer is configured. This provides stricter security but may break with older OAuth servers. Defaults to false.

tokenUrl configuration field

tokenUrl is an optional string representing the OAuth provider's token endpoint. Not required if using discoveryUrl.

redirectURI configuration field

redirectURI is an optional string representing the redirect URI to use for the OAuth flow. If not set, a default is constructed based on the app's base URL. Must include :providerId placeholder (e.g., 'https://example.com/api/auth/oauth2/callback/my-provider').

responseType configuration field

responseType is an optional string representing the OAuth response type. Defaults to 'code' for authorization code flow.

responseMode configuration field

responseMode is an optional string representing the response mode for the authorization code request, such as 'query' or 'form_post'.

prompt configuration field

prompt is an optional string that controls the authentication experience (e.g., force login, consent, etc.).

pkce configuration field

pkce is an optional boolean. If true, enables PKCE (Proof Key for Code Exchange) for enhanced security. Defaults to false.

accessType configuration field

accessType is an optional string representing the access type for the authorization request. Use 'offline' to request a refresh token.

accessTokenExpiresIn configuration field

accessTokenExpiresIn is an optional number representing the fallback access-token lifetime in seconds, used only when the provider's token response omits expires_in. Without a known expiry, getAccessToken cannot tell the token has expired and never refreshes it. Set this to the token's lifetime so the expiry is tracked and the token is refreshed when needed. Leave unset if the provider returns expires_in.

getToken configuration field

getToken is an optional function to exchange authorization code for tokens. If provided, this function will be used instead of the default token exchange logic. Useful for providers with non-standard token endpoints that use GET requests or custom parameters.

getUserInfo configuration field

getUserInfo is an optional function to fetch user info from the provider, given the OAuth tokens. If not provided, a default fetch is used.

mapProfileToUser configuration field

mapProfileToUser is an optional function to map the provider's user profile to the app's user object. Useful for custom field mapping or transformations.

authorizationUrlParams configuration field

authorizationUrlParams is an optional field for additional query parameters to add to the authorization URL. These can override default parameters. Can be an object or a function that returns parameters.

tokenUrlParams configuration field

tokenUrlParams is an optional field for additional query parameters to add to the token URL. These can override default parameters. Can be an object or a function that returns parameters.

disableImplicitSignUp configuration field

disableImplicitSignUp is an optional boolean. If true, disables automatic sign-up for new users. Sign-in must be explicitly requested with sign-up intent.

disableSignUp configuration field

disableSignUp is an optional boolean. If true, disables sign-up for new users entirely. Only existing users can sign in.

authentication configuration field

authentication is an optional field representing the authentication method for token requests. Can be 'basic' or 'post'. Defaults to 'post'.

discoveryHeaders configuration field

discoveryHeaders is an optional object for custom headers to include in the discovery request. Useful for providers that require special headers.

authorizationHeaders configuration field

authorizationHeaders is an optional object for custom headers to include in the authorization request. Useful for providers that require special headers.

overrideUserInfo configuration field

overrideUserInfo is an optional boolean. If true, the user's info in the database will be updated with the provider's info every time they sign in. Defaults to false.

Generic OAuth error handling

The plugin includes built-in error handling for common OAuth issues. Errors are typically redirected to the application's error page with an appropriate error message in the URL parameters. If the callback URL is not provided, the user will be redirected to Better Auth's default error page.

Give your agent this brain