Authentication

## Overview Authentication is powered by Better Auth with multiple sign-in methods: - **Email and password** with password policy enforcement and Have I Been Pwned checks - **Magic links** for passwordless sign-in - **Passkeys** (WebAuthn) for hardware-backed authentication - **Two-factor authentication** (TOTP) with backup codes - **OAuth** providers (Google, Microsoft) ## Configuring OAuth Providers Only Google and Microsoft are supported as external providers (GitHub social login is intentionally not offered). Set the following environment variables: ### Google (optional) - `BETTER_AUTH_GOOGLE_CLIENT_ID` - `BETTER_AUTH_GOOGLE_CLIENT_SECRET` ### Microsoft (optional) - `BETTER_AUTH_MICROSOFT_CLIENT_ID` - `BETTER_AUTH_MICROSOFT_CLIENT_SECRET` - `BETTER_AUTH_MICROSOFT_TENANT_ID` (optional) : Entra tenant endpoint. Use `common` for work and personal Microsoft accounts, `organizations` for work/school only, `consumers` for personal only, or your directory GUID for a single tenant. When unset, Better Auth defaults to `common`. Set `NEXT_PUBLIC_AUTH_PROVIDERS` to a comma-separated list (e.g. `google` or `google,microsoft`) to control which branded buttons appear on the **standard** sign-in and sign-up pages (`/sign-in`, `/sign-up`). When unset, Google and Microsoft buttons are shown for every provider configured on the server. OAuth only works when the matching client ID and secret are set in Infisical or env. ### External users (Microsoft entry point) Share **`/sign-in/external`** (and **`/sign-up/external`** when self-registration is allowed) with external users who should sign in with Microsoft only. This route is independent of `NEXT_PUBLIC_AUTH_PROVIDERS`, so you can hide Microsoft on `/sign-in` while still offering it at the external URL. Example: set `NEXT_PUBLIC_AUTH_PROVIDERS=google` on production so the main sign-in page shows Google (and email/passkey/SSO) only; external partners use `https://your-domain/en/sign-in/external`. Register the redirect URI `https://your-domain/api/auth/callback/microsoft` in your Entra app registration. ## Two-Factor Authentication Users can enable TOTP-based 2FA from Settings > Security. When enabled, sign-in requires a 6-digit code from an authenticator app. Backup codes are generated for account recovery. ## Session Management Sessions use JWT stored in httpOnly cookies with a 1-hour TTL and 7-day refresh tokens. Users can view and revoke active sessions from Settings > Security.