Sign-in methods
GitHub, Google, Apple and emailed links. Each is optional; configure any one.
How it works
Sign-in is handled by Better Auth. Four methods are supported and each one is optional and independent. The login page asks the API which are configured and shows only those, so running with GitHub alone is an ordinary setup.
Every provider’s callback is at /api/auth/callback/<provider> on your API’s origin. Register exactly that URL with the provider.
| Method | What you need | Variables |
|---|---|---|
| GitHub | An OAuth app | GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET |
| An OAuth client of type Web application | GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET | |
| Apple | A paid Apple Developer membership, a Services ID, Team ID, Key ID and a .p8 key | APPLE_CLIENT_ID, APPLE_TEAM_ID, APPLE_KEY_ID, APPLE_PRIVATE_KEY |
| Email link | A Resend API key and a sending address on a verified domain | RESEND_API_KEY, EMAIL_FROM |
GitHub
Create an OAuth app at github.com/settings/developers. For local use, the callback URL is http://localhost:8787/api/auth/callback/github; for a deployment, use your API’s origin.
In the Google Cloud console, create an OAuth client ID of type Web application, with the authorised redirect URI https://<your-api>/api/auth/callback/google (or the localhost:8787 one for local use).
Apple
- It needs a paid Apple Developer Program membership. There is no free tier for Sign in with Apple. Leaving the four
APPLE_*variables unset is an ordinary way to run jlog. - It cannot be tested on
http://localhost. Apple refuses localhost redirect URIs and answers with a cross-site form POST, which needs a secure cookie and so HTTPS. Set it up on your deployed origin. APPLE_CLIENT_IDis the Services ID, not an app’s bundle id.APPLE_PRIVATE_KEYis the whole.p8file, newlines included. Apple issues no client secret; jlog signs a short-lived one from this key for each request.
Email links
You type your address, jlog emails a link, and following it signs you in. The link works once and expires after 15 minutes. Only a hash of it is stored, so the copy in your inbox is the only working one.
EMAIL_FROM must be on a domain you have verified in Resend, for example jlog <[email protected]>. Leave either variable unset and the login page does not offer email.
More than one method
Methods attach to accounts. Someone who signed up with GitHub and later uses Google lands in the same account, provided Google reports the address as verified. An unverified address never links, because trusting one would let anyone claim someone else’s account.