Social login

bao supports any OAuth provider that better-auth supports. You enable providers in bao.config.json and supply credentials via your deploy workflow — no provider credentials ever touch bao’s infrastructure.

Enable a provider

Add the provider under auth.social in bao.config.json:

{
  "auth": {
    "social": {
      "github": {
        "enabled": true
      },
      "google": {
        "enabled": true
      }
    }
  }
}

Pass credentials to the deploy workflow

OAuth client IDs and secrets are passed as app_secrets in your GitHub Actions workflow. Each key follows the pattern {PROVIDER}_CLIENT_ID and {PROVIDER}_CLIENT_SECRET:

- name: Deploy
  uses: getbao/bao-action@v1
  with:
    app_secrets: |
      GITHUB_CLIENT_ID=${{ secrets.GITHUB_CLIENT_ID }}
      GITHUB_CLIENT_SECRET=${{ secrets.GITHUB_CLIENT_SECRET }}
      GOOGLE_CLIENT_ID=${{ secrets.GOOGLE_CLIENT_ID }}
      GOOGLE_CLIENT_SECRET=${{ secrets.GOOGLE_CLIENT_SECRET }}

Add the secrets to your GitHub repository under Settings → Secrets and variables → Actions.

Configure the OAuth callback URL

In your provider’s developer console, set the callback URL to:

https://{your-worker-url}/api/auth/callback/{provider}

For example:

https://my-app-production.workers.dev/api/auth/callback/github
https://my-app-production.workers.dev/api/auth/callback/google

Trigger the OAuth flow

From your client, redirect the user to the provider:

await authClient.signIn.social({
  provider: "github", // or "google"
  callbackURL: "/dashboard",
});

After the user authorises, the provider redirects back to the callback URL, the auth-service creates or updates the user record, and the browser is sent to callbackURL with a session cookie set.

Supported providers

bao currently supports GitHub and Google. Additional providers are on the roadmap.