Sign-in

The auth resource gives a project its own sign-in service: users, sessions, email and password, magic links, and Google, GitHub or Vercel sign-in. It stores users in the project's database (adding auth brings database). Production and development each have their own sign-in with their own users: the development copy trusts http://localhost:3000 only.

#Pricing

No separate charge today: sign-in is part of the project's database. Pricing is not decided.

#Limits

• Social providers: google, github, vercel. Only Google has shared keys (no OAuth app of your own needed); GitHub and Vercel need your own client_id and client_secret.
• Magic link lifetime: 5–1440 minutes. App name in emails: 1–256 characters.
• Allowed email domains: at most 50 (empty = anyone may sign up).
• Link-style email verification needs your own SMTP sender; the shared sender does one-time codes (otp).
• Not available yet: session lifetime, email templates, MFA, banning users.

#In the app

The nextjs-saas template (vibiz init --template nextjs-saas) has sign-in wired: currentUser() in lib/auth/server.ts returns the signed-in user, and /api/auth/* serves the flows. The app's env carries:

Before the app runs on a domain outside Vibiz hosting, add it (vibiz domains add app.example.com --elsewhere) so sign-in trusts it. An owner's is trusted at once; one an agent key adds is trusted once its TXT record (trust_record) is in and vibiz domains verify finds it, or the owner confirms it (Hosting ▸ Your own domain). A domain Vibiz hosting serves is trusted too.

#Settings

vibiz auth --dev                                   # the development copy's settings
vibiz auth providers add google --dev              # shared keys
vibiz auth providers add github --own --client-id Iv1.abc --dev   # secret from GITHUB_CLIENT_SECRET or a prompt
vibiz auth domains acme.com,partner.com --dev      # only these email domains may sign up
vibiz auth domains none --dev

curl -X PATCH "https://app.vibiz.app/v1/projects/$PROJECT/auth/settings?env=development" \
  -H "Authorization: Bearer $VIBIZ_API_KEY" -H 'content-type: application/json' \
  -d '{"magic_link":{"enabled":true,"expires_in_minutes":30},"allowed_email_domains":["acme.com"]}'

curl -X PUT "https://app.vibiz.app/v1/projects/$PROJECT/auth/providers/google?env=development" \
  -H "Authorization: Bearer $VIBIZ_API_KEY" -H 'content-type: application/json' \
  -d '{"credentials":"shared"}'

The settings carry each provider's callback_url (per environment) and, under available_providers, where to create the OAuth app and the steps for that provider's console. Secrets are never returned: has_client_secret, has_password.

#What agents can and can't do

Agents change the development copy: app name, email and password, magic link, localhost, allowed email domains, and shared-key providers on or off (vibiz_auth_settings). Production settings and test emails are the owner's: an agent key gets 403 owner_only. Your own OAuth secrets and SMTP passwords are entered by a person (the console, or the CLI's hidden prompt), never through an agent.

#Errors