OAuth providers

GitHub and Google sign-in are wired up but disabled until you configure credentials. The signin form hides each button if its credentials aren't set.

GitHub

1. Go to Settings → Developer settings → OAuth Apps → New OAuth App on GitHub.
2. Set the callback URL:
   • Dev: http://localhost:3000/api/auth/callback/github
   • Prod: https://yourdomain.com/api/auth/callback/github
3. Copy the Client ID + Client Secret into frontend/.env:

   AUTH_GITHUB_ID=...
   AUTH_GITHUB_SECRET=...
   

Google

1. Go to Google Cloud Console → APIs & Services → Credentials → Create credentials → OAuth client ID.
2. Application type: Web application. Authorized redirect URIs:
   • Dev: http://localhost:3000/api/auth/callback/google
   • Prod: https://yourdomain.com/api/auth/callback/google
3. Configure the OAuth consent screen (APIs & Services → OAuth consent screen). Scopes: openid, email, profile.
4. Copy the Client ID + Client Secret into frontend/.env (never commit them):

   AUTH_GOOGLE_ID=...
   AUTH_GOOGLE_SECRET=...
   

Publishing an External consent screen requires a privacy policy URL (https://yourdomain.com/privacy) and terms URL (https://yourdomain.com/terms). Both pages ship as placeholders (frontend/app/privacy/page.tsx, frontend/app/terms/page.tsx) with an AI prompt at the top of the file; replace them before you publish.

Google rejects localhost redirect URIs on production OAuth clients; create a separate dev client for local work.

The sign-in page shows the GitHub and Google buttons from their credentials, not from the provider list: frontend/app/signin/page.tsx checks each pair of AUTH_* variables, and SignInForm.tsx renders one button per provider. To add a provider, register it in frontend/auth.config.ts, add its check to page.tsx and its button to SignInForm.tsx. To remove one, drop it from auth.config.ts and unset its credentials, or the page keeps a button that cannot sign anyone in.