Social login

Native provider integrations (PKCE, token exchange, and profile mapping owned by Better Auth — see OAuth concepts) via one-line recipes:

import { createShelfAuth, githubPreset, googlePreset } from "@storyshelf/auth";

const shelf = createShelfAuth({
  db: database,
  secret: process.env.SECRET!,
  baseURL: process.env.PUBLIC_BASE_URL!,
  social: [
    githubPreset({ clientId: "...", clientSecret: "{env:GITHUB_CLIENT_SECRET}" }),
    googlePreset({ clientId: "...", clientSecret: "{env:GOOGLE_CLIENT_SECRET}" }),
  ],
});

Available:

• githubPreset
• gitlabPreset (+ issuer for self-managed instances)
• googlePreset
• entraPreset (+ tenantId for Entra)
• cognitoPreset (domain / region / userPoolId)

Secrets stay out of code with {env:NAME} refs — see Configuration. Each preset adds one oauth widget on /auth/login (sole method auto-redirects to the IdP).

Users link by email on first sign-in and keep existing shelf roles. For OIDC discovery and SAML, see OIDC and SAML.