Sign in with Google and GitHub

Email and password and magic links work with no setup. Google and GitHub appear once you give the API their credentials.

Try both on your own deployment before you announce: each provider only accepts the callback addresses you register with it.

Turn one on

1. Create an OAuth app with Google or GitHub.

2. Set its callback URL to your WEB_URL followed by the provider’s path:

   Provider	Callback URL on your machine
   Google	http://localhost:5173/api/auth/callback/google
   GitHub	http://localhost:5173/api/auth/callback/github

3. Put the client id and secret in .env:

   GOOGLE_CLIENT_ID=...
   GOOGLE_CLIENT_SECRET=...
   GITHUB_CLIENT_ID=...
   GITHUB_CLIENT_SECRET=...

4. Restart the API.

Set both values of a provider, or neither: the API refuses to start with only one. With both, the button shows on the sign-in and sign-up screens and under Settings → Profile → Sign-in methods.

In production

Register a second callback URL with each provider, built from your production WEB_URL: https://app.example.com/api/auth/callback/google. Then set the same variables on the API. Many providers let one app hold both URLs; otherwise make a separate app for production.

Accounts that already exist

Someone who signs in with Google using the email of an existing account gets Google added to that account, not a second account. People who arrive through Google or GitHub start with a verified address.