Social login

runlot auth provider set github --client-id <id> --client-secret <secret>
runlot auth provider set google --client-id <id> --client-secret <secret>
runlot auth provider set kakao  --client-id <id> --client-secret <secret>

If you omit --client-secret, the terminal prompts you for the value. This command requires the admin role.

Providers you register appear as buttons on the default login screens.

Callback URL

Register the following URL in each provider's OAuth app settings.

https://<your-domain>/__runlot/auth/callback/<provider>

To see the exact URL, run:

runlot auth status

Using it from your own login screen

import { signInUrl } from "@runlot/auth/client";

<a href={signInUrl("github", { next: "/app" })}>Continue with GitHub</a>

The code above links to /__runlot/auth/sign-in/github?next=%2Fapp. If next is an external URL or starts with //, it is ignored for security.

One OAuth app per project

We do not provide a shared OAuth app. Every project has to register its own client ID and secret. That way the consent screen shows your app's name, and API quotas and provider policies follow your own project settings.

Linking accounts with the same email

If password login and social login use the same email address, they are linked to a single user account. You can see which providers a user has with user.providers.

const user = await env.auth.user(request);
user.providers; // ["password", "github"]

Disconnecting a provider

runlot auth provider rm github

Users who only signed in with the provider you removed can regain access by resetting their password.