Run a first-party identity provider
A product needs to issue OIDC authentication through its own Better Auth server.
Better Auth · Const
oidcProvider
oidcProvider configures Better Auth as an OpenID Connect provider that other services can use for authentication. Add it to betterAuth, update the schema, and configure client registration as needed.
How it works
oidcProvider adds an OpenID Connect provider to Better Auth. Configure it inside betterAuth, run the required schema migration or generation, and then use the provider's OAuth endpoints and client-registration APIs to let other services authenticate through your application.
Syntax
oidcProvider(options)Parameters
| Name | Type | Description |
|---|---|---|
options | OIDC provider configuration object | Configuration object for the OIDC provider plugin; the page demonstrates loginPage and refers to additional configuration options. |
Returns
A Better Auth OIDC provider plugin instance to place in the plugins configuration array.
Key points
- It lets your Better Auth application operate its own OIDC provider instead of depending on an external identity service.
- Install it by placing
oidcProvider(...)in thepluginsarray passed tobetterAuth. - New clients can be registered through the client-side
oauth2.registermethod. - Server-side code can register clients with
auth.api.registerOAuthApplication. - The plugin provides a UserInfo API for clients that need claims about the signed-in user.
Common mistakes
- The page marks this plugin for deprecation; new implementations should evaluate the OAuth Provider Plugin instead.
- After enabling the plugin, update the database schema before relying on its persistence.
- Dynamic client registration is not enabled automatically; explicitly opt in when public registration is required.
Example: Configure an OIDC provider
import { betterAuth } from "better-auth";
import { oidcProvider } from "better-auth/plugins";
export const auth = betterAuth({
plugins: [
oidcProvider({
loginPage: "/sign-in",
}),
],
});Registers the OIDC provider plugin and directs unauthenticated authorization flows to the application's sign-in page.
When to use it
Connect relying-party applications
External applications need to obtain authorization and authenticate users through the application.
Enable dynamic client registration
An operator wants clients to sign up through an API rather than provisioning each one manually.
Interview questions
QWhat does oidcProvider do?
oidcProvider turns a Better Auth server into an OpenID Connect provider. It is added to the plugins array and can receive options such as loginPage.
Follow-up: How can clients be registered? Use oauth2.register on the client or auth.api.registerOAuthApplication on the server.
QHow do clients obtain user information?
The plugin exposes a UserInfo endpoint at /oauth2/userinfo. Clients must send a valid access token to retrieve authenticated-user information.
Follow-up: What prerequisite does the endpoint enforce? The access token must be valid and associated with the client’s authenticated flow.
QWhat setup step is required after adding the plugin?
After configuration, the database schema must be migrated or generated so Better Auth can create the required fields and tables. This is part of installation rather than an optional cleanup step.
Follow-up: How can public clients register themselves? Set allowDynamicClientRegistration to true and add the oidcClient() plugin to the auth client configuration.
Related
betterAuthoauth2.registerauth.api.registerOAuthApplicationoidcClientallowDynamicClientRegistration/oauth2/userinfo