Authentication

Authentication

This template uses Better Auth for email/password, Google and GitHub sign-in. Configure enabled methods and OAuth credentials in Admin → Settings → Auth. Credentials can also be supplied through matching server environment variables. Signing and encryption keys belong in deployment environment variables.

Sessions and authorization

useSession from @/core/auth/client supplies browser session state. Use the existing AppLayout for signed-in page layouts. Every protected server request must independently check its session; a browser check alone does not authorize an operation.

Admin operations use the official executor and explicit permissions. Run bun run rbac:init to seed roles and permissions, then assign an admin role to an existing user.

Passwords

The security page at /settings/security requires the current password and a matching new password. A successful change revokes other sessions. Password reset by email is enabled only when email sending is configured.

Optional popup sign-in

Set VITE_AUTH_SOCIAL_POPUP=true and rebuild to use popup Google/GitHub sign-in. A blocked popup falls back to the normal redirect flow. OAuth completion checks a real session; existing internal redirect and desktop handoff rules remain in effect.