Self hosting Better Auth for Google and Apple sign in
I am using Better Auth for email sign up, but I would also like to make it easier with Google and Apple one click sign in. From what I understand, in order to have Apple sign in you have to pay $90/year or whatever it is to Apple for a developer license? (No…
I am using Better Auth for email sign up, but I would also like to make it easier with Google and Apple one click sign in. From what I understand, in order to have Apple sign in you have to pay $90/year or whatever it is to Apple for a developer license? (No way around this?) As for Google sign in, I understand it's offered for free (any limit on free plans?) but you also need to provide your email, and in doing so the public will see this email? Apple sign in, on the other hand, I don't know if you need to provide a public email that the user would see, or if it's all handled from Apple's end. When I say public email, I mean like an "authorize to trust this account ___@____.com for your one click sign in" something like this. Would anyone have any experience with self hosting this? I’m just curious what your thoughts are and if it ends up being a cost every month or if you have found a way to do this completely free? Looking to make it as simple and easy for the user to sign up and log in, I think I would actually prefer this over email but I also understand not everyone wants to use One Click sign in.
Collected discussion
Yeah you need the dev account for Apple sign in, no way around the $99 a year For Google, there's no cost and you can set it up so your email isn't shown to users. The consent screen has a publishing status option, you can keep it in testing mode and just add the specific Google accounts you want to allow (like your own for testing), or if you publish it publicly your email still doesn't show during the sign-in flow. The user just sees your app name and what permissions it's asking for The email you're thinking of is probably the developer contact email which is required in the OAuth consent screen setup, but that's just for Google to contact you, not something users see
Thanks very much for the info - I would rather stay away from Meta but Google I’m good with. I wonder if Apple will ever open it up Sign In for free like these companies one day. I agree I didn’t want to do email login for these very reasons but was hoping Better Auth would make it safer. Sounds like self hosting Better Auth opens up a can of worms. I will disable email login unless I can find a safe provider to do so. Im assuming you meant stay away from email login altogether, even with Better Auth?
Better auth is great. You will need to actually understand what it is doing, though.
When you sign in with Google, it usually just asks for your basic profile stuff (like your name, email, and picture) depending on your OAuth settings. People definitely see the email address you set up in your Google Cloud Console consent screen.
Why for the love of god is there always people using AI to write comments for them? You can’t write a paragraph without asking an LLM for a lift? You’re so cooked in life if that’s the case
I’m guessing it’s a bad idea to use personal email for Google Cloud Console. What about with Apple and developer account to set it up?
Oh, I am confused now.. according to this comment it’s definitely shown to the public https://www.reddit.com/r/webdev/s/S6idZvynNt
I dont understand what your talking about? Why would the email you use to log in to gcp matter for whats shown on the consent screen? You create a consent screen and get that verified. Also self hosting better auth makes no sense unless you have a very specific usecase. Just use clerk for free and get both google and apple oauth.
Here’s a maximally, hilariously obvious one: Great question! 🚀 You’ve touched on something really important here. It’s not just about writing comments — it’s about efficiency, clarity, and communication in the modern digital age. Let’s break it down: ✅ Accessibility: Not everyone finds writing easy, and that’s okay! ✅ Time-saving: Why spend 10 minutes when you can spend 2? ✅ Confidence: Some people just want a little lift. 💪 At the end of the day, whether someone uses an LLM or not, what truly matters is the human connection we build together. 🌟 Hope this helps! Let me know if you’d like me to expand on any of these points. 😊 The “Hope this helps! Let me know if you’d like me to expand” closer is the kill shot. Enjoy the downvotes. 😄
What?
Yeah no way around it. You need a $99/yr dev account to do sign in with apple. They will not serve you an OK unless your website is cleared to auth. Self hosting what? You need to communicate with these services. The client side of your application would be hosted under your control, sure, but the API is hitting google and apple’s servers. You can’t self host that side of the call obviously. You don’t need to pay google or meta really anything to sign in with their services. Maybe 2 cents? I dont even remember, it’s so small. So just go with that. Do not, and I repeat, do not, roll your own auth. I don’t mean this rudely, but you do not have the skills. Those that do have the skills rarely would, and certainly wouldnt have asked the questions you have. Always use a well respected package, do not handle hashing yourself. Doing a little Api call to auth with google or meta is fine. Using a sign in provider is fine.
Yes
Two Apple things nobody's mentioned yet, both beyond the $99. The client secret isn't a static string like Google's. It's a JWT you sign yourself with a .p8 key, and Apple caps its lifetime at six months, so it works fine and then fails quietly half a year in. Automate the rotation on day one. The one that actually got me: Apple sends the user's full name only on the very first authorization and never again. Persist it right then or it's gone for that user. The email keeps coming back in the token on every login, the name doesn't.