Authentication
Built-in authentication system powered by better-auth, supporting email/password login, OAuth providers, email verification, and captcha protection
VibeAny uses better-auth as its authentication framework, with session data stored in PostgreSQL. Authentication is optional — if DATABASE_URL and BETTER_AUTH_SECRET are not configured, the app runs in static mode without user login.
Prerequisites
Before setting up authentication, make sure you have:
- A PostgreSQL database — see Database for setup instructions
- An email service — required for email verification (Resend recommended, see Environment Variables)
Quick Start
Set Auth Secret
Add to .env:
BETTER_AUTH_SECRET=your-secret-keyYou can generate one on the better-auth website, or use the button below:
Configure Database
Make sure DATABASE_URL is set in .env:
DATABASE_URL="postgresql://user:password@host:port/database"Configure Email Service
Email verification is disabled by default. Configure an email provider so users can verify their accounts:
EMAIL_VERIFICATION_ENABLED=false
EMAIL_PROVIDER=resend
EMAIL_FROM="YourApp <[email protected]>"
RESEND_API_KEY=re_xxxOr configure a custom SMTP server:
EMAIL_PROVIDER=custom
EMAIL_FROM="YourApp <[email protected]>"
EMAIL_HOST=smtp.example.com
EMAIL_ADDRESS=[email protected]
EMAIL_USER=your-username
EMAIL_PASSWORD=your-passwordVerify
Start the dev server and visit the login page. You should see the email/password sign-up form.
Email/Password Authentication
Email/password login is enabled by default. The flow works as follows:
- User signs up with email and password
- A verification email is sent automatically
- User clicks the verification link
- Account is verified and the user is signed in automatically
Note
Email verification is required — users cannot sign in until they verify their email address.
OAuth Providers
VibeAny supports GitHub and Google as OAuth providers. They are automatically enabled when the corresponding environment variables are set.
GitHub
Create OAuth App
Go to GitHub Developer Settings → OAuth Apps → New OAuth App.
Set the callback URL to:
https://your-domain.com/api/auth/callback/githubFor local development:
http://localhost:3377/api/auth/callback/githubConfigure Environment Variables
Copy the Client ID and Client Secret to .env:
GITHUB_CLIENT_ID=your-client-id
GITHUB_CLIENT_SECRET=your-client-secretCreate OAuth Credentials
Go to Google Cloud Console → Create Credentials → OAuth client ID.
Select Web application as the application type. Add the authorized redirect URI:
https://your-domain.com/api/auth/callback/googleFor local development:
http://localhost:3377/api/auth/callback/googleConfigure Environment Variables
Copy the Client ID and Client Secret to .env:
GOOGLE_CLIENT_ID=your-client-id
GOOGLE_CLIENT_SECRET=your-client-secretNote
OAuth providers are optional. The login page automatically shows the corresponding OAuth buttons only when the environment variables are configured.
Captcha Protection
VibeAny supports Cloudflare Turnstile to protect sign-in, sign-up, and OAuth flows from bots.
Create Turnstile Widget
Go to the Cloudflare Dashboard → Turnstile → Add Widget. Add your domain and get the Site Key and Secret Key.
Configure Environment Variables
VITE_TURNSTILE_CAPTCHA_ENABLED=true
VITE_TURNSTILE_SITE_KEY=0x4xxx
TURNSTILE_SECRET_KEY=0x4xxxAdmin Access
Admin users have access to the admin panel for managing users, payments, credits, and configuration.
To grant admin access, add the user's email to the ADMIN_EMAILS environment variable:
ADMIN_EMAILS=[email protected],[email protected]Multiple emails are separated by commas.
Configuration Reference
| Environment Variable | Required | Description |
|---|---|---|
BETTER_AUTH_SECRET | Yes | Auth secret key for encryption |
DATABASE_URL | Yes | PostgreSQL connection URL |
ADMIN_EMAILS | No | Comma-separated admin email addresses |
GITHUB_CLIENT_ID | No | GitHub OAuth Client ID |
GITHUB_CLIENT_SECRET | No | GitHub OAuth Client Secret |
GOOGLE_CLIENT_ID | No | Google OAuth Client ID |
GOOGLE_CLIENT_SECRET | No | Google OAuth Client Secret |
VITE_TURNSTILE_CAPTCHA_ENABLED | No | Enable Turnstile captcha (true/false) |
VITE_TURNSTILE_SITE_KEY | No | Turnstile Site Key |
TURNSTILE_SECRET_KEY | No | Turnstile Secret Key |
Database Tables
Authentication creates the following tables automatically:
| Table | Description |
|---|---|
user | User profiles (name, email, avatar, etc.) |
session | Active sessions with tokens and expiration |
account | Linked auth providers (credentials, GitHub, Google) |
verification | Email verification tokens |