feat: whyrating - initial project from turbostarter boilerplate
This commit is contained in:
Alejandro Gutiérrez
@@ -0,0 +1,131 @@
|
||||
---
|
||||
title: Two-Factor Authentication (2FA)
|
||||
description: Add an extra layer of security with two-factor authentication in your mobile app.
|
||||
url: /docs/mobile/auth/2fa
|
||||
---
|
||||
|
||||
# Two-Factor Authentication (2FA)
|
||||
|
||||
TurboStarter uses [Better Auth's 2FA plugin](https://www.better-auth.com/docs/plugins/2fa) to provide multi-factor authentication (MFA) capabilities in your mobile app. Two-factor authentication adds an extra layer of security by requiring users to provide a second form of verification alongside their password.
|
||||
|
||||
## Available methods
|
||||
|
||||
TurboStarter supports multiple 2FA verification methods through Better Auth:
|
||||
|
||||
* **TOTP (Time-based One-Time Password)** - codes generated by authenticator apps
|
||||
* **OTP (One-Time Password)** - codes sent via email or SMS
|
||||
* **Backup codes** - single-use recovery codes for account recovery
|
||||
|
||||
You can use any TOTP-compatible authenticator app, such as:
|
||||
|
||||
* [Google Authenticator](https://support.google.com/accounts/answer/1066447)
|
||||
* [Authy](https://authy.com/)
|
||||
* [Microsoft Authenticator](https://www.microsoft.com/en-us/security/mobile-authenticator-app)
|
||||
* [1Password](https://1password.com/features/authenticator/)
|
||||
* [Bitwarden](https://bitwarden.com/help/authenticator-keys/)
|
||||
|
||||
## Enabling 2FA
|
||||
|
||||
<Steps>
|
||||
<Step>
|
||||
### Enable in settings
|
||||
|
||||
Users enable two-factor authentication in their account security settings within the mobile app.
|
||||
|
||||
|
||||
</Step>
|
||||
|
||||
<Step>
|
||||
### Setup authenticator
|
||||
|
||||
A QR code is displayed in the mobile app for users to scan with their authenticator app. Users can also manually enter the setup key if needed.
|
||||
|
||||
|
||||
</Step>
|
||||
|
||||
<Step>
|
||||
### Verify setup
|
||||
|
||||
Users enter a verification code from their authenticator to confirm setup directly in the mobile app.
|
||||
</Step>
|
||||
|
||||
<Step>
|
||||
### Backup codes
|
||||
|
||||
Users receive single-use backup codes for account recovery, which can be saved or shared from the mobile app.
|
||||
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
<Callout type="info">
|
||||
Recovery codes are essential for account recovery if users lose access to
|
||||
their authenticator device. Make sure to educate users about safely storing
|
||||
their backup codes, and consider providing options to save them to the device
|
||||
or share them securely.
|
||||
</Callout>
|
||||
|
||||
## Using 2FA
|
||||
|
||||
<Steps>
|
||||
<Step>
|
||||
### Sign in normally
|
||||
|
||||
Users enter their email and password or use other authentication methods (biometric, social login) as usual in the mobile app.
|
||||
</Step>
|
||||
|
||||
<Step>
|
||||
### 2FA prompt
|
||||
|
||||
After successful password verification, users are prompted for their 2FA code in a native mobile interface.
|
||||
|
||||
|
||||
</Step>
|
||||
|
||||
<Step>
|
||||
### Enter verification code
|
||||
|
||||
Users input the 6-digit code from their authenticator app using the mobile keyboard.
|
||||
</Step>
|
||||
|
||||
<Step>
|
||||
### Access granted
|
||||
|
||||
Upon successful verification, users gain access to their account and are navigated to the main app screen.
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
### Trusted devices
|
||||
|
||||
Users can mark their mobile device as trusted during 2FA verification. Trusted devices won't require 2FA verification for 60 days, providing a balance between security and convenience. This is particularly useful for personal mobile devices.
|
||||
|
||||
## Mobile-specific considerations
|
||||
|
||||
### Biometric integration
|
||||
|
||||
On mobile devices, 2FA can be enhanced with biometric authentication (fingerprint, face recognition) for added security and convenience.
|
||||
|
||||
### App switching
|
||||
|
||||
The mobile app should handle switching between your app and authenticator apps seamlessly, maintaining the authentication state when users return.
|
||||
|
||||
### Offline support
|
||||
|
||||
Consider implementing offline backup code verification for scenarios where users may have limited connectivity.
|
||||
|
||||
### Push notifications
|
||||
|
||||
For OTP delivery via SMS or email, ensure your app handles incoming notifications gracefully during the authentication flow.
|
||||
|
||||
## Configuration
|
||||
|
||||
2FA is configured through Better Auth's plugin system. The plugin handles:
|
||||
|
||||
* Secure secret generation and storage
|
||||
* QR code generation for authenticator setup
|
||||
* TOTP code validation
|
||||
* Backup code generation and management
|
||||
* Trusted device management
|
||||
* Mobile-specific session handling
|
||||
|
||||
For detailed implementation instructions, refer to the [Better Auth 2FA documentation](https://www.better-auth.com/docs/plugins/2fa).
|
||||
@@ -0,0 +1,122 @@
|
||||
---
|
||||
title: Configuration
|
||||
description: Configure authentication for your application.
|
||||
url: /docs/mobile/auth/configuration
|
||||
---
|
||||
|
||||
# Configuration
|
||||
|
||||
TurboStarter supports multiple different authentication methods:
|
||||
|
||||
* **Password** - the traditional email/password method
|
||||
* **Magic Link** - passwordless email link authentication
|
||||
* **Anonymous** - guest mode for users who want to proceed anonymously
|
||||
* **OAuth** - OAuth providers, [Apple](https://www.better-auth.com/docs/authentication/apple), [Google](https://www.better-auth.com/docs/authentication/google) and [Github](https://www.better-auth.com/docs/authentication/github) are set up by default
|
||||
|
||||
All authentication methods are enabled by default, but you can easily customize them to your needs. You can enable or disable any method, and configure them according to your requirements.
|
||||
|
||||
<Callout>
|
||||
Remember that you can mix and match these methods or add new ones - for
|
||||
example, you can have both password and magic link authentication enabled at
|
||||
the same time, giving your users more flexibility in how they authenticate.
|
||||
</Callout>
|
||||
|
||||
Authentication configuration can be customized through a simple configuration file. The following sections explain the available options and how to configure each authentication method based on your requirements.
|
||||
|
||||
## API
|
||||
|
||||
To enable new authentication method or add some plugin, you'd need to update the API configuration. Please refer to [web authentication configuration](/docs/web/auth/configuration) for more information as it's not strictly related with mobile app configuration.
|
||||
|
||||
<Callout title="Remember to add your app scheme as trusted origin">
|
||||
For mobile apps, we need to define an [authentication trusted origin](https://www.better-auth.com/docs/reference/security#trusted-origins) using a mobile app scheme instead.
|
||||
|
||||
App schemes (like `turbostarter://`) are used for [deep linking](https://docs.expo.dev/guides/linking/) users to specific screens in your app after authentication.
|
||||
|
||||
To find your app scheme, take a look at `apps/mobile/app.config.ts` file and then add it to your auth server configuration:
|
||||
|
||||
```ts title="server.ts"
|
||||
export const auth = betterAuth({
|
||||
...
|
||||
|
||||
trustedOrigins: ["turbostarter://**"],
|
||||
|
||||
...
|
||||
});
|
||||
```
|
||||
|
||||
Adding your app scheme to the trusted origins list is crucial for security - it prevents CSRF attacks and blocks malicious open redirects by ensuring only requests from approved origins (your app) are allowed through.
|
||||
|
||||
[Read more about auth security in Better Auth's documentation.](https://www.better-auth.com/docs/reference/security)
|
||||
</Callout>
|
||||
|
||||
## UI
|
||||
|
||||
We have separate configuration that determines what is displayed to your users in the **UI**. It's set at `apps/mobile/config/auth.ts`.
|
||||
|
||||
The recommendation is to **not update this directly** - instead, please define the environment variables and override the default behavior.
|
||||
|
||||
```ts title="apps/mobile/config/auth.ts"
|
||||
import env from "env.config";
|
||||
import { Platform } from "react-native";
|
||||
|
||||
import { SocialProvider, authConfigSchema } from "@turbostarter/auth";
|
||||
|
||||
import type { AuthConfig } from "@turbostarter/auth";
|
||||
|
||||
export const authConfig = authConfigSchema.parse({
|
||||
providers: {
|
||||
password: env.EXPO_PUBLIC_AUTH_PASSWORD,
|
||||
magicLink: env.EXPO_PUBLIC_AUTH_MAGIC_LINK,
|
||||
anonymous: env.EXPO_PUBLIC_AUTH_ANONYMOUS,
|
||||
oAuth: [
|
||||
Platform.select({
|
||||
android: SocialProvider.GOOGLE,
|
||||
ios: SocialProvider.APPLE,
|
||||
}),
|
||||
SocialProvider.GITHUB,
|
||||
],
|
||||
},
|
||||
}) satisfies AuthConfig;
|
||||
```
|
||||
|
||||
The configuration is also validated using the Zod schema, so if something is off, you'll see the errors.
|
||||
|
||||
For example, if you want to switch from password to magic link, you'd change the following environment variables:
|
||||
|
||||
```dotenv title=".env.local"
|
||||
EXPO_PUBLIC_AUTH_PASSWORD=false
|
||||
EXPO_PUBLIC_AUTH_MAGIC_LINK=true
|
||||
```
|
||||
|
||||
To display third-party providers in the UI, you need to set the `oAuth` array to include the provider you want to display. The default is Google and Github.
|
||||
|
||||
```tsx title="apps/web/config/auth.ts"
|
||||
providers: {
|
||||
...
|
||||
oAuth: [
|
||||
Platform.select({
|
||||
android: SocialProvider.GOOGLE,
|
||||
ios: SocialProvider.APPLE,
|
||||
}),
|
||||
SocialProvider.GITHUB,
|
||||
],
|
||||
...
|
||||
},
|
||||
```
|
||||
|
||||
You can even display specific providers for specific platforms - for example, you can display Google authentication for Android and Apple authentication for iOS.
|
||||
|
||||
## Third party providers
|
||||
|
||||
To enable third-party authentication providers, you'll need to:
|
||||
|
||||
1. Set up an OAuth application in the provider's developer console (like [Apple Developer Portal](https://developer.apple.com/account/), [Google Cloud Console](https://console.cloud.google.com/), [Github Developer Settings](https://github.com/settings/developers) or any other provider you want to use)
|
||||
2. Configure the corresponding environment variables in your TurboStarter **API (web) application**
|
||||
|
||||
Each OAuth provider requires its own set of credentials and environment variables. Please refer to the [Better Auth documentation](https://better-auth.com/docs/concepts/oauth) for detailed setup instructions for each supported provider.
|
||||
|
||||
<Callout title="Multiple environments">
|
||||
Make sure to set both development and production environment variables
|
||||
appropriately. Your OAuth provider may require different callback URLs for
|
||||
each environment.
|
||||
</Callout>
|
||||
@@ -0,0 +1,51 @@
|
||||
---
|
||||
title: User flow
|
||||
description: Discover the authentication flow in Turbostarter.
|
||||
url: /docs/mobile/auth/flow
|
||||
---
|
||||
|
||||
# User flow
|
||||
|
||||
TurboStarter ships with a fully functional authentication system. Most of the screens and components are preconfigured and easily customizable to your needs.
|
||||
|
||||
Here you will find a quick walkthrough of the authentication flow.
|
||||
|
||||
## Sign up
|
||||
|
||||
The sign-up screen is where users can create an account. They need to provide their email address and password.
|
||||
|
||||
|
||||
|
||||
Once successful, users are asked to confirm their email address. This is enabled by default - and due to security reasons, it's not possible to disable it.
|
||||
|
||||
<Callout type="warn" title="Sending authentication emails">
|
||||
Make sure to configure the [email provider](/docs/web/emails/configuration) together with the [auth hooks](/docs/web/emails/sending#authentication-emails) to be able to send emails from your app.
|
||||
</Callout>
|
||||
|
||||
|
||||
|
||||
## Sign in
|
||||
|
||||
The sign-in screen is where users can log in to their account. They need to provide their email address and password, use magic link (if enabled) or third-party providers.
|
||||
|
||||
|
||||
|
||||
## Sign out
|
||||
|
||||
The sign out button is located in the user account settings.
|
||||
|
||||
|
||||
|
||||
## Forgot password
|
||||
|
||||
The forgot password screen is where users can reset their password. They need to provide their email address and follow the instructions in the email.
|
||||
|
||||
It comes together with the reset password screen, where users land from a forgot email. There they can reset their password by providing new password and confirming it.
|
||||
|
||||
|
||||
|
||||
## Two-factor authentication
|
||||
|
||||
Two-factor authentication is a security feature that requires users to provide a code sent to their email or phone number in addition to their password when logging in.
|
||||
|
||||
|
||||
@@ -0,0 +1,72 @@
|
||||
---
|
||||
title: OAuth
|
||||
description: Get started with social authentication.
|
||||
url: /docs/mobile/auth/oauth
|
||||
---
|
||||
|
||||
# OAuth
|
||||
|
||||
Better Auth supports almost **30** (!) different [OAuth providers](https://www.better-auth.com/docs/concepts/oauth). They can be easily configured and enabled in the kit without any additional configuration needed.
|
||||
|
||||
<Callout title="Everything configured!">
|
||||
TurboStarter provides you with all the configuration required to handle OAuth providers responses from your app:
|
||||
|
||||
* redirects
|
||||
* middleware
|
||||
* confirmation API routes
|
||||
|
||||
You just need to configure one of the below providers on their side and set correct credentials as environment variables in your TurboStarter app.
|
||||
</Callout>
|
||||
|
||||
|
||||
|
||||
Third Party providers need to be configured, managed and enabled fully on the provider's side. TurboStarter just needs the correct credentials to be set as environment variables in your app and passed to the [authentication API configuration](/docs/web/auth/configuration#api).
|
||||
|
||||
To enable OAuth providers in your TurboStarter app, you need to:
|
||||
|
||||
1. Set up an OAuth application in the provider's developer console (like [Apple Developer Portal](https://developer.apple.com/account/), [Google Cloud Console](https://console.cloud.google.com/), [Github Developer Settings](https://github.com/settings/developers) or any other provider you want to use)
|
||||
2. Configure the provider's credentials as environment variables in your app. For example, for Google OAuth:
|
||||
|
||||
```dotenv title="apps/web/.env.local"
|
||||
GOOGLE_CLIENT_ID=
|
||||
GOOGLE_CLIENT_SECRET=
|
||||
```
|
||||
|
||||
Then, pass it to the authentication configuration in `packages/auth/src/server.ts`:
|
||||
|
||||
```ts title="server.ts"
|
||||
export const auth = betterAuth({
|
||||
...
|
||||
|
||||
socialProviders: {
|
||||
[SocialProvider.GOOGLE]: {
|
||||
clientId: env.GOOGLE_CLIENT_ID,
|
||||
clientSecret: env.GOOGLE_CLIENT_SECRET,
|
||||
},
|
||||
},
|
||||
|
||||
...
|
||||
});
|
||||
```
|
||||
|
||||
<Callout title="Remember to add your app scheme as trusted origin">
|
||||
For mobile apps, we need to define a trusted origin using an app scheme instead of a classic URL. App schemes (like `turbostarter://`) are used for [deep linking](https://docs.expo.dev/guides/linking/) users to specific screens in your app after authentication.
|
||||
|
||||
To find your app scheme, take a look at `apps/mobile/app.config.ts` file and then add it to your auth server configuration:
|
||||
|
||||
```ts title="server.ts"
|
||||
export const auth = betterAuth({
|
||||
...
|
||||
|
||||
trustedOrigins: ["turbostarter://**"],
|
||||
|
||||
...
|
||||
});
|
||||
```
|
||||
|
||||
Adding your app scheme to the trusted origins list is crucial for security - it prevents CSRF attacks and blocks malicious open redirects by ensuring only requests from approved origins (your app) are allowed through.
|
||||
|
||||
[Read more about auth security in Better Auth's documentation.](https://www.better-auth.com/docs/reference/security)
|
||||
</Callout>
|
||||
|
||||
Also, we included some native integrations (["Sign in with Apple"](/docs/mobile/auth/oauth/apple) for iOS and ["Sign in with Google"](/docs/mobile/auth/oauth/google) for Android) to make the sign-in process smoother and faster for the user.
|
||||
@@ -0,0 +1,74 @@
|
||||
---
|
||||
title: Apple
|
||||
description: Configure "Sign in with Apple" for your mobile application.
|
||||
url: /docs/mobile/auth/oauth/apple
|
||||
---
|
||||
|
||||
# Apple
|
||||
|
||||
**"Sign in with Apple"** provides a native, privacy-preserving SSO experience on iOS. Use the system Apple button and the Apple Authentication APIs to sign users in, then verify the identity token on your backend and create a session with your auth server.
|
||||
|
||||
<Callout title="Apple ID authentication is available on iOS only">
|
||||
Native Apple ID authentication is available on iOS only. You are advised to
|
||||
present the official system button (or our custom component - also compliant!)
|
||||
and follow [Apple's Human Interface
|
||||
Guidelines](https://developer.apple.com/design/human-interface-guidelines/sign-in-with-apple)
|
||||
for best practices.
|
||||
</Callout>
|
||||
|
||||
|
||||
|
||||
## Why use native Apple ID authentication?
|
||||
|
||||
<Cards>
|
||||
<Card title="First-class native UX">
|
||||
System sheet + official button, aligned with [Apple's Human Interface Guidelines](https://developer.apple.com/design/human-interface-guidelines/sign-in-with-apple) for trust and conversion.
|
||||
</Card>
|
||||
|
||||
<Card title="Privacy-forward">
|
||||
Private relay email and limited data by design, ensuring your users' privacy is protected and compliant with App Store guidelines.
|
||||
</Card>
|
||||
|
||||
<Card title="Fewer passwords">
|
||||
Fast, low-friction sign-in on iOS enabling your users to sign in without the need to remember or create additional passwords.
|
||||
</Card>
|
||||
|
||||
<Card title="Secure by default">
|
||||
JWT verification on the server with [Better Auth](https://www.better-auth.com/docs/authentication/apple), keeping your users' credentials secure.
|
||||
</Card>
|
||||
|
||||
<Card title="Seamless sessions">
|
||||
We exchange Apple credentials for an app session and persist it in the app.
|
||||
</Card>
|
||||
</Cards>
|
||||
|
||||
## Requirements
|
||||
|
||||
* Enable the "Sign in with Apple" capability for your bundle identifier in the [Apple Developer Portal](https://developer.apple.com/account/resources/identifiers/list)
|
||||
* Add the entitlement and build with [EAS](/docs/mobile/publishing/checklist) (or configure natively)
|
||||
* Ensure your app's deep link scheme is added to the auth server's [trusted origins configuration](/docs/mobile/auth/configuration)
|
||||
|
||||
Check the [Better Auth documentation](https://www.better-auth.com/docs/authentication/apple) for more details on how to configure all the required keys and certificates.
|
||||
|
||||
## High-level flow
|
||||
|
||||
1. Check availability with `AppleAuthentication.isAvailableAsync()`.
|
||||
2. Render the system `AppleAuthenticationButton` or custom TurboStarter component.
|
||||
3. Call `AppleAuthentication.signInAsync()` requesting `FULL_NAME` and/or `EMAIL` as needed.
|
||||
4. Send the returned `idTokeb` identifier to the API powered by [Better Auth](https://www.better-auth.com/docs/authentication/apple) to verify and establish a session.
|
||||
5. Optionally track credential state with `AppleAuthentication.getCredentialStateAsync(user)`.
|
||||
|
||||
<Callout type="warn" title="Verify on the server">
|
||||
Always verify the JWT signature from `idToken` on your backend using Apple's
|
||||
public keys before creating a session.
|
||||
</Callout>
|
||||
|
||||
For a more in-depth overview of Apple ID authentication—including implementation details, platform caveats, and advanced configuration—see the following resources:
|
||||
|
||||
<Cards>
|
||||
<Card title="Expo AppleAuthentication" href="https://docs.expo.dev/versions/latest/sdk/apple-authentication/" description="docs.expo.dev" />
|
||||
|
||||
<Card title="Login with Apple" href="https://www.better-auth.com/docs/authentication/apple" description="better-auth.com" />
|
||||
|
||||
<Card title="Sign in with Apple" href="https://developer.apple.com/documentation/sign_in_with_apple" description="developer.apple.com" />
|
||||
</Cards>
|
||||
@@ -0,0 +1,71 @@
|
||||
---
|
||||
title: Google
|
||||
description: Configure "Sign in with Google" for your mobile application.
|
||||
url: /docs/mobile/auth/oauth/google
|
||||
---
|
||||
|
||||
# Google
|
||||
|
||||
**"Sign in with Google"** enables a fast account-chooser experience on mobile (especially on Android). Configure your platform credentials, prompt the native account picker, then exchange the returned token on your backend to create a session with your auth server.
|
||||
|
||||
<Callout title="Platform support">
|
||||
On Android, Google Sign‑In uses [Google Identity
|
||||
Services](https://developers.google.com/identity?hl=pl) and integrates with
|
||||
the system account chooser. On iOS, the recommended Expo flow uses
|
||||
[expo-auth-session](https://docs.expo.dev/versions/latest/sdk/auth-session/)
|
||||
with Google for a native, web-based sign-in experience.
|
||||
</Callout>
|
||||
|
||||
|
||||
|
||||
## Why use Google authentication?
|
||||
|
||||
<Cards>
|
||||
<Card title="First-class native UX">
|
||||
Account picker and token storage integrated with the OS for speed and familiarity.
|
||||
</Card>
|
||||
|
||||
<Card title="Seamless across platforms">
|
||||
Android native chooser; iOS polished experience via Expo.
|
||||
</Card>
|
||||
|
||||
<Card title="Secure by default">
|
||||
Tokens are verified server-side with [Better Auth](https://www.better-auth.com/docs/authentication/google) before a session is issued.
|
||||
</Card>
|
||||
|
||||
<Card title="Faster onboarding">
|
||||
Reduce friction with one-tap sign-in and fewer passwords to remember.
|
||||
</Card>
|
||||
|
||||
<Card title="Scalable">
|
||||
Built on [Google Identity Services](https://developers.google.com/identity?hl=pl) and best-practice OAuth flows.
|
||||
</Card>
|
||||
</Cards>
|
||||
|
||||
## Requirements
|
||||
|
||||
* Configure [Google Cloud OAuth Client IDs](https://react-native-google-signin.github.io/docs/setting-up/get-config-file) (Android package + SHA-1, iOS bundle ID) in the [Google Cloud Console](https://console.cloud.google.com/)
|
||||
* Build with [EAS](/docs/mobile/publishing/checklist) to ensure native credentials are embedded correctly
|
||||
* Add your app deep link scheme to the auth server's [trusted origins configuration](/docs/mobile/auth/configuration)
|
||||
|
||||
Check the [Better Auth documentation](https://www.better-auth.com/docs/authentication/google) and [`@react-native-google-signin/google-signin` documentation](https://react-native-google-signin.github.io) for steps to configure your server verification, client IDs and more.
|
||||
|
||||
## High-level flow
|
||||
|
||||
1. Configure Google OAuth Client IDs for Android and iOS in [Google Cloud Console](https://console.cloud.google.com/).
|
||||
2. Initialize the Google auth request in your app and render a "Sign in with Google" button.
|
||||
3. Prompt the account chooser; on success you receive an `idToken` and/or `accessToken`.
|
||||
4. Send the tokens to the API powered by [Better Auth](https://www.better-auth.com/docs/authentication/google) to verify and establish a session.
|
||||
5. Persist the session and proceed to the app.
|
||||
|
||||
For a more in-depth overview of Google authentication, including implementation details, platform caveats, and advanced configuration, see the following resources:
|
||||
|
||||
<Cards>
|
||||
<Card title="Use Google Authentication" href="https://docs.expo.dev/guides/google-authentication/" description="docs.expo.dev" />
|
||||
|
||||
<Card title="Login with Google" href="https://www.better-auth.com/docs/authentication/google" description="better-auth.com" />
|
||||
|
||||
<Card title="React Native Google Sign In" href="https://react-native-google-signin.github.io/" description="react-native-google-signin.github.io" />
|
||||
|
||||
<Card title="Authenticate users with Sign in with Google" href="https://developer.android.com/identity/sign-in/credential-manager-siwg" description="developer.android.com" />
|
||||
</Cards>
|
||||
@@ -0,0 +1,40 @@
|
||||
---
|
||||
title: Overview
|
||||
description: Get started with authentication.
|
||||
url: /docs/mobile/auth/overview
|
||||
---
|
||||
|
||||
# Overview
|
||||
|
||||
TurboStarter uses [Better Auth](https://better-auth.com) to handle authentication. It's a secure, production-ready authentication solution that integrates seamlessly with many frameworks and provides enterprise-grade security out of the box.
|
||||
|
||||
<Callout title="Why Better Auth?">
|
||||
One of the core principles of TurboStarter is to do things **as simple as possible**, and to make everything **as performant as possible**.
|
||||
|
||||
Better Auth provides an excellent developer experience with minimal configuration required, while maintaining enterprise-grade security standards. Its framework-agnostic approach and focus on performance makes it the perfect choice for TurboStarter.
|
||||
|
||||
Recently, Better Auth [announced](https://www.better-auth.com/blog/authjs-joins-better-auth) an incorporation of [Auth.js (27k+ stars on Github)](https://authjs.dev/), making it even more powerful and flexible.
|
||||
</Callout>
|
||||
|
||||
|
||||
|
||||
You can read more about Better Auth in the [official documentation](https://better-auth.com/docs).
|
||||
|
||||
TurboStarter supports multiple authentication methods:
|
||||
|
||||
* **Password** - the traditional email/password method
|
||||
* **Magic Link** - magic links with [deep linking](https://docs.expo.dev/linking/overview)
|
||||
* **Anonymous** - allowing users to proceed anonymously
|
||||
* **OAuth** - OAuth social providers ([Apple](https://www.better-auth.com/docs/authentication/apple), [Google](https://www.better-auth.com/docs/authentication/google) and [Github](https://www.better-auth.com/docs/authentication/github) preconfigured)
|
||||
* **Native Apple authentication** - ["Sign in with Apple"](/docs/mobile/auth/oauth/apple) for iOS
|
||||
* **Native Google authentication** - ["Sign in with Google"](/docs/mobile/auth/oauth/google) for Android
|
||||
|
||||
As well as common applications flows, with ready-to-use views and components:
|
||||
|
||||
* **Sign in** - sign in with email/password or OAuth providers
|
||||
* **Sign up** - sign up with email/password or OAuth providers
|
||||
* **Sign out** - sign out
|
||||
* **Password recovery** - forgot and reset password
|
||||
* **Email verification** - verify email
|
||||
|
||||
You can construct your auth flow like LEGO bricks - plug in needed parts and customize them to your needs.
|
||||
Reference in New Issue
Block a user