OAuth

Better Auth supports almost 15 (!) different OAuth providers. They can be easily configured and enabled in the kit without any additional configuration needed.

Everything configured!

TurboStarter provides you with all the configuration required to handle OAuth providers responses from your app:

redirects
middleware
confirmation API routes

You just need to configure one of the below providers on their side and set correct credentials as environment variables in your TurboStarter app.

OAuth providers

Third Party providers need to be configured, managed and enabled fully on the provider's side. TurboStarter just needs the correct credentials to be set as environment variables in your app and passed to the authentication API configuration.

To enable OAuth providers in your TurboStarter app, you need to:

Set up an OAuth application in the provider's developer console (like Google Cloud Console, Github Developer Settings or any other provider you want to use)
Configure the provider's credentials as environment variables in your app. For example, for Google OAuth:

packages/db/.env.local

GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=

Then, pass it to the authentication configuration in packages/auth/src/server.ts:

server.ts

export const auth = betterAuth({
  ...
 
  socialProviders: {
    [SOCIAL_PROVIDER.GOOGLE]: {
      clientId: env.GOOGLE_CLIENT_ID,
      clientSecret: env.GOOGLE_CLIENT_SECRET,
    },
  },
 
  ...
});

Remember to add your app scheme as trusted origin

For mobile apps, we need to define a trusted origin using an app scheme instead of a classic URL. App schemes (like turbostarter://) are used for deep linking users to specific screens in your app after authentication.

To find your app scheme, take a look at apps/mobile/app.config.ts file and then add it to your auth server configuration:

server.ts

export const auth = betterAuth({
  ...
 
  trustedOrigins: ["turbostarter://**"],
 
  ...
});

Adding your app scheme to the trusted origins list is crucial for security - it prevents CSRF attacks and blocks malicious open redirects by ensuring only requests from approved origins (your app) are allowed through.

Also, we included some native integrations (Apple for iOS and Google for Android) to make the sign-in process smoother and faster for the user.

Apple

Configure native Apple OAuth for your application.

Google

Configure native Google OAuth for your application.

Apple

Google

On this page