Authentication

Auth is powered by Better Auth with a Prisma adapter. Configuration lives in lib/auth.ts; routes and provider metadata are centralized in config/auth.ts.

What's included

• Email + password sign up / sign in
• OAuth (Google, GitHub) — buttons appear only when credentials are configured
• Password reset and email verification (dev emails print to the server console)
• Session-based protected routes

Required setup

Set BETTER_AUTH_SECRET in .env:

openssl rand -base64 32

That's all you need for email/password auth.

OAuth (optional)

A provider turns on automatically when both its id and secret are present.

Google

1. Create OAuth credentials in the Google Cloud Console.
2. Authorized redirect URI: http://localhost:3000/api/auth/callback/google.
3. Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET.

GitHub

1. Create an OAuth App in GitHub Developer Settings.
2. Authorization callback URL: http://localhost:3000/api/auth/callback/github.
3. Set GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET.

In production, swap localhost:3000 for your domain.

Protecting routes

Use the server helpers in server/auth/session.ts:

import { requireAuth, getCurrentUser } from "@/server/auth/session";
const session = await requireAuth();   // redirects to /login when signed outconst user = await getCurrentUser();   // returns the user or null

Middleware does a fast optimistic cookie check; requireAuth() is the authoritative guard.

New-user provisioning

When a user is created, server/auth/provisioning.ts puts them on the Free plan and grants their starter credits. Customize the welcome experience there.

Emails

Transactional emails are stubbed in lib/mailer.ts and print to the console in development. Swap the implementation for a real provider (Resend, Postmark, Nodemailer…) — the call sites don't change.