Pre-configured OAuth provider helpers
Better Auth provides helper functions for Auth0, HubSpot, Keycloak, LINE, Microsoft Entra ID (Azure AD), Okta, Slack, Patreon, and Yandex. Each helper is a function that accepts configuration options. Auth0 requires domain, Keycloak requires issuer, Microsoft Entra ID requires tenantId, and Okta requires issuer. LINE supports multiple channels via different providerIds and can be called multiple times for different countries. HubSpot, Slack, Patreon, and Yandex have no additional required fields.
Common OAuth provider options
All provider helpers support optional fields: scopes (string array of OAuth scopes to request), redirectURI (string for custom redirect URI), pkce (boolean, defaults to false), disableImplicitSignUp (boolean), disableSignUp (boolean), overrideUserInfo (boolean).
Auth0 provider helper configuration
Auth0 provider helper is called with auth0(options) and requires domain (e.g., 'dev-xxx.eu.auth0.com'), clientId, and clientSecret. Supports optional fields: scopes, redirectURI, pkce, disableImplicitSignUp, disableSignUp, overrideUserInfo.
HubSpot provider helper configuration
HubSpot provider helper is called with hubspot(options) and requires clientId and clientSecret. Has no additional required fields. Supports optional scopes field (defaults to ['oauth']), plus common optional fields: redirectURI, pkce, disableImplicitSignUp, disableSignUp, overrideUserInfo.
Keycloak provider helper configuration
Keycloak provider helper is called with keycloak(options) and requires issuer (e.g., 'https://my-domain/realms/MyRealm'), clientId, and clientSecret. Supports optional fields: scopes, redirectURI, pkce, disableImplicitSignUp, disableSignUp, overrideUserInfo.
LINE provider helper configuration
LINE provider helper is called with line(options) and requires clientId and clientSecret. Optional providerId field defaults to 'line'. LINE supports multiple channels for different countries (Japan, Thailand, Taiwan, etc.), so line() can be called multiple times with different providerId and credentials to support multiple countries. Supports optional fields: scopes, redirectURI, pkce, disableImplicitSignUp, disableSignUp, overrideUserInfo.
Microsoft Entra ID provider helper configuration
Microsoft Entra ID (Azure AD) provider helper is called with microsoftEntraId(options) and requires tenantId (can be a GUID, 'common', 'organizations', or 'consumers'), clientId, and clientSecret. Supports optional fields: scopes, redirectURI, pkce, disableImplicitSignUp, disableSignUp, overrideUserInfo.
Okta provider helper configuration
Okta provider helper is called with okta(options) and requires issuer (e.g., 'https://dev-xxxxx.okta.com/oauth2/default'), clientId, and clientSecret. Supports optional fields: scopes, redirectURI, pkce, disableImplicitSignUp, disableSignUp, overrideUserInfo.
Slack provider helper configuration
Slack provider helper is called with slack(options) and requires clientId and clientSecret. Has no additional required fields. Supports optional fields: scopes, redirectURI, pkce, disableImplicitSignUp, disableSignUp, overrideUserInfo.
Patreon provider helper configuration
Patreon provider helper is called with patreon(options) and requires clientId and clientSecret. Has no additional required fields. Supports optional fields: scopes, redirectURI, pkce, disableImplicitSignUp, disableSignUp, overrideUserInfo.
Yandex provider helper configuration
Yandex provider helper is called with yandex(options) and requires clientId and clientSecret. Has no additional required fields. Supports optional fields: scopes, redirectURI, pkce, disableImplicitSignUp, disableSignUp, overrideUserInfo.
Gumroad provider in example
The example configuration includes gumroad() as a pre-configured provider helper that accepts clientId and clientSecret.