[{"data":1,"prerenderedAt":502},["ShallowReactive",2],{"docs:navigation":3,"docs:page:\u002Fdocs\u002Fauthentication":115},[4],{"title":5,"path":6,"stem":7,"children":8,"icon":10},"Introduction","\u002Fdocs","docs\u002F1.index",[9,11,16,21,38,95,110],{"title":5,"path":6,"stem":7,"icon":10},"i-lucide-house",{"title":12,"path":13,"stem":14,"icon":15},"Quickstart","\u002Fdocs\u002Fquickstart","docs\u002F2.quickstart","i-lucide-rocket",{"title":17,"path":18,"stem":19,"icon":20},"Essentials","\u002Fdocs\u002Fconfiguration","docs\u002F3.configuration","i-lucide-book-open",{"title":22,"path":23,"stem":24,"children":25,"icon":27},"Authentication","\u002Fdocs\u002Fauthentication","docs\u002F4.authentication\u002Findex",[26,28,33],{"title":22,"path":23,"stem":24,"icon":27},"i-lucide-shield-check",{"title":29,"path":30,"stem":31,"icon":32},"Protect User Data","\u002Fdocs\u002Fauthentication\u002Fuser-data","docs\u002F4.authentication\u002F1.user-data","i-lucide-user-lock",{"title":34,"path":35,"stem":36,"icon":37},"Two-Factor Verification","\u002Fdocs\u002Fauthentication\u002Ftwo-factor","docs\u002F4.authentication\u002F2.two-factor","i-lucide-key-round",{"title":39,"path":40,"stem":41,"children":42,"icon":44},"Deployment","\u002Fdocs\u002Fdeployment","docs\u002F5.deployment\u002Findex",[43,45,50,55,60,65,70,75,80,85,90],{"title":39,"path":40,"stem":41,"icon":44},"i-lucide-cloud-upload",{"title":46,"path":47,"stem":48,"icon":49},"Deploy to Cloudflare","\u002Fdocs\u002Fdeployment\u002Fcloudflare","docs\u002F5.deployment\u002F1.cloudflare","i-simple-icons-cloudflare",{"title":51,"path":52,"stem":53,"icon":54},"Platform Support","\u002Fdocs\u002Fdeployment\u002Fsupport","docs\u002F5.deployment\u002F10.support","i-lucide-list-checks",{"title":56,"path":57,"stem":58,"icon":59},"Deploy to Vercel","\u002Fdocs\u002Fdeployment\u002Fvercel","docs\u002F5.deployment\u002F2.vercel","i-simple-icons-vercel",{"title":61,"path":62,"stem":63,"icon":64},"Deploy to Azure","\u002Fdocs\u002Fdeployment\u002Fazure","docs\u002F5.deployment\u002F3.azure","i-simple-icons-microsoftazure",{"title":66,"path":67,"stem":68,"icon":69},"Switch Hosts","\u002Fdocs\u002Fdeployment\u002Fswitch-hosts","docs\u002F5.deployment\u002F4.switch-hosts","i-lucide-arrow-right-left",{"title":71,"path":72,"stem":73,"icon":74},"Database and File Storage","\u002Fdocs\u002Fdeployment\u002Fdata-services","docs\u002F5.deployment\u002F5.data-services","i-lucide-database",{"title":76,"path":77,"stem":78,"icon":79},"Domains and Secrets","\u002Fdocs\u002Fdeployment\u002Fsettings","docs\u002F5.deployment\u002F6.settings","i-lucide-settings",{"title":81,"path":82,"stem":83,"icon":84},"Troubleshoot Deployment","\u002Fdocs\u002Fdeployment\u002Ftroubleshooting","docs\u002F5.deployment\u002F7.troubleshooting","i-lucide-wrench",{"title":86,"path":87,"stem":88,"icon":89},"Deploy Agents","\u002Fdocs\u002Fdeployment\u002Fagents","docs\u002F5.deployment\u002F8.agents","i-lucide-bot",{"title":91,"path":92,"stem":93,"icon":94},"Deploy Automations","\u002Fdocs\u002Fdeployment\u002Fautomations","docs\u002F5.deployment\u002F9.automations","i-lucide-workflow",{"title":96,"path":97,"stem":98,"children":99,"icon":101},"Connect Accounts","\u002Fdocs\u002Fconnect","docs\u002F6.connect\u002Findex",[100,102,106],{"title":96,"path":97,"stem":98,"icon":101},"i-lucide-plug",{"title":103,"path":104,"stem":105,"icon":37},"Connection Credentials","\u002Fdocs\u002Fconnect\u002Fcredentials","docs\u002F6.connect\u002F1.credentials",{"title":107,"path":108,"stem":109,"icon":84},"Connect MCP Servers","\u002Fdocs\u002Fconnect\u002Fmcp","docs\u002F6.connect\u002F2.mcp",{"title":111,"path":112,"stem":113,"icon":114},"Project Reference","\u002Fdocs\u002Freference","docs\u002F7.reference","i-lucide-terminal",{"page":116,"surround":497},{"id":117,"title":22,"body":118,"description":490,"extension":491,"links":492,"meta":493,"navigation":494,"path":23,"seo":495,"stem":24,"__hash__":496},"docs\u002Fdocs\u002F4.authentication\u002Findex.md",{"type":119,"value":120,"toc":483},"minimark",[121,130,141,146,149,183,190,198,208,236,247,254,258,261,281,288,291,309,313,316,319,416,419,423,446,452,459,463,472,479],[122,123,124,125,129],"p",{},"When people save private data, your application needs to know who is making each\nrequest. CloudConfig manages users and sessions, then passes the signed-in\n",[126,127,128],"code",{},"user"," to your access rules.",[122,131,132,133,136,137,140],{},"This guide adds GitHub sign-in to a project from the\n",[134,135,12],"a",{"href":13},". You need a GitHub account and a running local app\nat ",[126,138,139],{},"http:\u002F\u002Flocalhost:3000",".",[142,143,145],"h2",{"id":144},"_1-register-your-github-app","1. Register Your GitHub App",[122,147,148],{},"From the project directory, run:",[150,151,156],"pre",{"className":152,"code":153,"language":154,"meta":155,"style":155},"language-bash shiki shiki-themes github-light github-light github-dark","pnpm exec cloudconfig auth add github\n","bash","",[126,157,158],{"__ignoreMap":155},[159,160,163,167,171,174,177,180],"span",{"class":161,"line":162},"line",1,[159,164,166],{"class":165},"snPdu","pnpm",[159,168,170],{"class":169},"sIIMD"," exec",[159,172,173],{"class":169}," cloudconfig",[159,175,176],{"class":169}," auth",[159,178,179],{"class":169}," add",[159,181,182],{"class":169}," github\n",[122,184,185,186,189],{},"The command enables GitHub in ",[126,187,188],{},"cloud.config.ts"," and prints its callback URL:",[150,191,196],{"className":192,"code":194,"language":195,"meta":155},[193],"language-text","http:\u002F\u002Flocalhost:3000\u002Fapi\u002Fauth\u002Fcallback\u002Fgithub\n","text",[126,197,194],{"__ignoreMap":155},[122,199,200,201,207],{},"Keep the command open. Create a ",[134,202,206],{"href":203,"rel":204},"https:\u002F\u002Fgithub.com\u002Fsettings\u002Fapplications\u002Fnew",[205],"nofollow","GitHub OAuth app","\nwith these values:",[209,210,211,222,230],"ul",{},[212,213,214,218,219,140],"li",{},[215,216,217],"strong",{},"Application name:"," a recognizable name, such as ",[126,220,221],{},"Blog Dashboard",[212,223,224,227,228,140],{},[215,225,226],{},"Homepage URL:"," ",[126,229,139],{},[212,231,232,235],{},[215,233,234],{},"Authorization callback URL:"," the URL printed by the command.",[122,237,238,239,242,243,246],{},"Copy the ",[215,240,241],{},"Client ID",", then select ",[215,244,245],{},"Generate a new client secret",". Return to\nthe terminal and paste both values when prompted.",[122,248,249,250,253],{},"If your server uses another port, start setup with\n",[126,251,252],{},"cloudconfig auth add github --url http:\u002F\u002Flocalhost:4000"," instead. The callback\nmust match the origin your browser uses.",[142,255,257],{"id":256},"_2-create-the-sign-in-tables","2. Create the Sign-In Tables",[122,259,260],{},"Generate and apply the migration:",[150,262,264],{"className":152,"code":263,"language":154,"meta":155,"style":155},"pnpm db:generate\npnpm db:migrate\n",[126,265,266,273],{"__ignoreMap":155},[159,267,268,270],{"class":161,"line":162},[159,269,166],{"class":165},[159,271,272],{"class":169}," db:generate\n",[159,274,276,278],{"class":161,"line":275},2,[159,277,166],{"class":165},[159,279,280],{"class":169}," db:migrate\n",[122,282,283,284,287],{},"This creates the users, sessions, accounts, and verification tables. CloudConfig\nmounts sign-in routes at ",[126,285,286],{},"\u002Fapi\u002Fauth"," by default. Restart the development server\nto load the new environment settings.",[122,289,290],{},"Check for missing settings:",[150,292,294],{"className":152,"code":293,"language":154,"meta":155,"style":155},"pnpm exec cloudconfig auth status\n",[126,295,296],{"__ignoreMap":155},[159,297,298,300,302,304,306],{"class":161,"line":162},[159,299,166],{"class":165},[159,301,170],{"class":169},[159,303,173],{"class":169},[159,305,176],{"class":169},[159,307,308],{"class":169}," status\n",[142,310,312],{"id":311},"_3-sign-in-from-your-app","3. Sign In from Your App",[122,314,315],{},"The Nuxt dashboard template includes a GitHub sign-in button. If you used that\ntemplate, open the app, sign in, and return to it from GitHub. Your access rules\nnow receive the authenticated user.",[122,317,318],{},"For a custom sign-in page, create an auth client and start the redirect:",[150,320,324],{"className":321,"code":322,"language":323,"meta":155,"style":155},"language-ts shiki shiki-themes github-light github-light github-dark","import { createAuthClient } from 'better-auth\u002Fclient'\n\nconst authClient = createAuthClient()\n\nawait authClient.signIn.social({\n  provider: 'github',\n  callbackURL: '\u002F',\n})\n","ts",[126,325,326,342,348,367,372,387,399,410],{"__ignoreMap":155},[159,327,328,332,336,339],{"class":161,"line":162},[159,329,331],{"class":330},"s8jYJ","import",[159,333,335],{"class":334},"sxrX7"," { createAuthClient } ",[159,337,338],{"class":330},"from",[159,340,341],{"class":169}," 'better-auth\u002Fclient'\n",[159,343,344],{"class":161,"line":275},[159,345,347],{"emptyLinePlaceholder":346},true,"\n",[159,349,351,354,358,361,364],{"class":161,"line":350},3,[159,352,353],{"class":330},"const",[159,355,357],{"class":356},"sBjJW"," authClient",[159,359,360],{"class":330}," =",[159,362,363],{"class":165}," createAuthClient",[159,365,366],{"class":334},"()\n",[159,368,370],{"class":161,"line":369},4,[159,371,347],{"emptyLinePlaceholder":346},[159,373,375,378,381,384],{"class":161,"line":374},5,[159,376,377],{"class":330},"await",[159,379,380],{"class":334}," authClient.signIn.",[159,382,383],{"class":165},"social",[159,385,386],{"class":334},"({\n",[159,388,390,393,396],{"class":161,"line":389},6,[159,391,392],{"class":334},"  provider: ",[159,394,395],{"class":169},"'github'",[159,397,398],{"class":334},",\n",[159,400,402,405,408],{"class":161,"line":401},7,[159,403,404],{"class":334},"  callbackURL: ",[159,406,407],{"class":169},"'\u002F'",[159,409,398],{"class":334},[159,411,413],{"class":161,"line":412},8,[159,414,415],{"class":334},"})\n",[122,417,418],{},"The example assumes your page and API share an origin. GitHub redirects back to\nCloudConfig, which creates a user and a session.",[142,420,422],{"id":421},"keep-credentials-out-of-git","Keep Credentials Out of Git",[122,424,425,426,429,430,433,434,437,438,441,442,445],{},"Setup writes ",[126,427,428],{},"GITHUB_CLIENT_ID",", ",[126,431,432],{},"GITHUB_CLIENT_SECRET",", and ",[126,435,436],{},"BETTER_AUTH_SECRET","\nto the ignored ",[126,439,440],{},".env"," file. It refuses to write secrets to a tracked file. Use\n",[126,443,444],{},".env.example"," for variable names with placeholders.",[122,447,448,449,140],{},"If you supply credentials manually, use those same names. Generate a session\nsigning secret with ",[126,450,451],{},"pnpm exec cloudconfig auth secret",[122,453,454,455,458],{},"Deployment synchronizes the required auth secrets to your selected host. You do\nnot need to repeat their names in ",[126,456,457],{},"deploy.secrets",". In CI, supply them through\nthe process environment.",[142,460,462],{"id":461},"choose-your-next-step","Choose Your Next Step",[122,464,465,466,468,469,140],{},"Follow ",[134,467,29],{"href":30}," to use the signed-in\nuser in model rules. Dashboard starters also support\n",[134,470,471],{"href":35},"two-factor verification",[122,473,474,475,140],{},"Before deploying, set the ",[134,476,478],{"href":477},"\u002Fdocs\u002Fdeployment\u002Fsettings#set-the-sign-in-origin","production origin and callback",[480,481,482],"style",{},"html pre.shiki code .snPdu, html code.shiki .snPdu{--shiki-light:#6F42C1;--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sIIMD, html code.shiki .sIIMD{--shiki-light:#032F62;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s8jYJ, html code.shiki .s8jYJ{--shiki-light:#D73A49;--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sxrX7, html code.shiki .sxrX7{--shiki-light:#24292E;--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .sBjJW, html code.shiki .sBjJW{--shiki-light:#005CC5;--shiki-default:#005CC5;--shiki-dark:#79B8FF}",{"title":155,"searchDepth":275,"depth":275,"links":484},[485,486,487,488,489],{"id":144,"depth":275,"text":145},{"id":256,"depth":275,"text":257},{"id":311,"depth":275,"text":312},{"id":421,"depth":275,"text":422},{"id":461,"depth":275,"text":462},"Let users sign in with GitHub and identify them in your access rules.","md",null,{},{"icon":27},{"title":22,"description":490},"t-3yhu4ohUvwJMFkVwPf2ILeSTv1SiUaMC-rujUemiA",[498,500],{"title":17,"path":18,"stem":19,"description":499,"icon":20},"Describe your data, control access, and call the API with types.",{"title":29,"path":30,"stem":31,"description":501,"icon":32},"Limit private rows to their owner and add application-specific user fields.",1792122403453]