Jerbix

Sign-in and Sign-up

Enable the auth module, add Google sign-in and email verification

Last updated November 3, 2026

The auth module covers sign-up, sign-in, password reset, and email verification. Pages live at /{locale}/auth/*, the API at /api/auth/*, and the account area behind sign-in is in Account settings.

Sign-in page
Sign-in: email and password; third-party buttons appear once Google credentials are configured

Steps

  1. Turn on the auth module.

``ts // src/config/website.ts auth: { enabled: true, requireEmailVerification: true }, ``

auth.enabled gates pages and API together: with it off, both /{locale}/auth/* and /api/auth/* return 404.

  1. Set the two variables production requires.
VariableRequirementPurpose
BETTER_AUTH_SECRETAt least 32 charactersSigns sessions and email tokens; production deployment fails without it
BETTER_AUTH_URLFull originAbsolute URL for callbacks and email links; the deploy workflow falls back to VITE_BASE_URL

Generate BETTER_AUTH_SECRET with openssl rand -base64 32 and upload it as a runtime secret as described in Deploy to Cloudflare.

  1. (Optional) Add Google sign-in. Two server variables are required, and both are needed:
VariablePurpose
GOOGLE_CLIENT_IDThe OAuth client ID from Google Cloud Console
GOOGLE_CLIENT_SECRETThe secret of that same client

The Google button appears only when both are set; with just the ID there is no button and no entry point that could only fail. Register the callback URLs on the OAuth client in Google Cloud Console:

FieldValue
Authorized JavaScript originhttps://<your-domain>
Authorized redirect URIhttps://<your-domain>/api/auth/callback/google

For local development, add http://localhost:3000 and http://localhost:3000/api/auth/callback/google as well.

  1. (Optional) Require email verification. With requireEmailVerification: true, new users must verify their address before signing in. This depends on the mail module: configure a provider and MAIL_FROM as described in Email, otherwise sign-up and sign-in never send a message.

Verify

  • Locally, run pnpm dev and sign up at /{locale}/auth/register; a verification email should arrive.
  • Online, curl -s https://<your-domain>/api/auth/get-session returns 200 with session as null, which means the auth API is healthy.
  • pnpm run check:env:prod passes, which means the production variables and the configuration of every enabled module are complete.

Notes

  • requireEmailVerification is a security control, not a mail switch: it does not loosen itself when mail.enabled is turned off. Requiring verification without a working mail setup makes the auth API return 503 rather than silently allowing sign-in without verification.
  • Google sign-in is not blocked by email verification — Google returns an already-verified address, and only the email and password path is subject to that constraint.
  • Secret environment variables never carry a VITE_ prefix, or they end up in the client bundle.