new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

Better Auth · Reference · all subjects

oauth-popup

9 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

oauth-popup experimental status

The oauth-popup plugin is experimental. The API may change while this plugin is experimental.

oauth-popup plugin purpose and use case

The oauth-popup plugin enables popup-based OAuth sign-in where the OAuth flow runs in a popup and the completion page posts the session token back to the opener. This allows an app to sign in inside a cross-site iframe where its auth cookie is partitioned. It pairs with the bearer plugin. For a normal top-level app, the redirect flow (signIn.social) is preferred. The popup should be used when a top-level redirect is not possible, such as in embedded or iframe scenarios.

oauth-popup server setup with bearer plugin

To set up oauth-popup on the server, import betterAuth and the bearer and oauthPopup plugins from better-auth/plugins. Create the auth instance with betterAuth() and include both plugins in the plugins array. The bearer plugin is required. Configure trustedOrigins to include the opener app origin(s) so the popup only posts the token to trusted origins.

oauth-popup client setup

To set up oauth-popup on the client, import createAuthClient from better-auth/client and oauthPopupClient from better-auth/client/plugins. Create the auth client with createAuthClient(), specifying the baseURL for the auth origin and include oauthPopupClient() in the plugins array.

oauth-popup signIn method usage

To sign in with oauth-popup, use authClient.signIn.popup() with an object containing the provider name (such as 'github') or providerId for a genericOAuth provider, and a callbackURL to redirect to after authentication.

oauth-popup bearer plugin requirement

The bearer plugin is required on the server for oauth-popup. An embedded app authenticates with the handed-back token via Authorization: Bearer header, since its cookie is partitioned.

oauth-popup trustedOrigins requirement

trustedOrigins must include the app (opener) origin for oauth-popup to function. The popup only posts the token to a trusted origin.

oauth-popup COOP header requirements

For oauth-popup, COOP (Cross-Origin-Opener-Policy) headers are required at the top level only. The page that opens the popup must allow it by setting Cross-Origin-Opener-Policy: same-origin-allow-popups if it sets COOP at all. The auth API must not send a swap-triggering COOP on the callback, for example by disabling it in security-headers middleware. COOP does not apply inside an iframe.

oauth-popup security considerations

The session token is posted to the opener via postMessage pinned to a trusted origin and stored in localStorage only when embedded. It should be treated like any bearer token: an XSS on the app origin can read it. Keep session lifetimes short and the app free of XSS vulnerabilities.

Give your agent this brain