> ## Documentation Index
> Fetch the complete documentation index at: https://supastack.dev/llms.txt
> Use this file to discover all available pages before exploring further.
> For the full documentation corpus in one file, fetch: https://supastack.dev/llms-full.txt

# Authentication

Identity and sessions through Better Auth.

## Create and verify a real account

Authentication means proving who is using the app. Start Postgres and run migrations using the database guide first, then leave the Web server running. Open http://localhost:3000/auth, choose email/password sign-up, enter your name, email and password, and submit. Keep EMAIL_PROVIDER=local for this first test.

When a flow requests an email code, open http://localhost:3000/mail-preview in another browser tab, find the most recent message for that address and copy its code back into the sign-in form. Request a fresh code if it expires. These messages stay in the local outbox; repeatedly checking an external inbox will not find them. Sign out, then sign in again to confirm the database-backed account works.

If sign-up reports a database connection or missing-table error, finish database setup instead of enabling social login. Google, GitHub, Apple, X and Microsoft buttons need their own provider application and callback settings; enable one only after its provider guide is complete. Better Auth is the shipped default engine and does not need a paid authentication account for local email sign-in.

[Start Postgres before creating an account](https://supastack.dev/docs/web/database.md)

[Use and troubleshoot email sign-in codes](https://supastack.dev/docs/web/setup-ai.md)

[Configure Google sign-in](https://supastack.dev/docs/web/setup-oauth.md)

[Add Google sign-in](https://supastack.dev/docs/web/google-sign-in.md)

[Add GitHub sign-in](https://supastack.dev/docs/web/github-sign-in.md)


## Choose enabled sign-in methods

The foundation includes email/password, OTP, and configurable social authentication. Better Auth owns identity and sessions, while the application composes provider configuration and transactional OTP delivery.

Enable only the social providers you have configured. Provider client secrets and the authentication secret stay on the server.


## Connect identity to a workspace

Authenticated handlers resolve session state before accessing workspace records. Workspace provisioning must remain idempotent so replaying a lifecycle hook does not create duplicate ownership records.


## Verify session behavior

Test sign-in, invalid or expired OTPs, single-use consumption, sign-out, and rejected anonymous access. Memory-adapter tests cover handler semantics; production database persistence and real provider callbacks need separate acceptance.


If you want to continue setup, read [Set up AI](https://supastack.dev/docs/web/setup-ai.md).


## Next

[Billing and access](https://supastack.dev/docs/modules/billing.md)