auth-setup

# Butterbase Auth Setup Two umbrella tools cover end-user authentication: - **`manage_oauth`** — provider configuration (Google, GitHub, Apple, X, custom) - **`manage_auth_config`** — auth hooks, JWT lifetimes, service key generation For broad app build-out, see also `butterbase-skills:build-app`. This skill is the deep dive. --- ## 1. The role model Every request runs under one of three database roles: | Auth header | Role | `current_user_id()` | RLS | |-------------|------|---------------------|-----| | _none_ | `butterbase_anon` | NULL | enforced; default deny | | End-user JWT (issued by `manage_oauth` or email login) | `butterbase_user` | user UUID | enforced | | Service key (`bb_sk_*`) | `butterbase_service` | NULL | bypassed | Auth is what transforms a request into the right role. RLS is what filters the data. Both must be configured. --- ## 2. Configure an OAuth provider ```js manage_oauth({ app_id: "app_abc123", action: "configure", provider: "google", client_id: "123456789.apps.googleusercontent.com", client_secret: "GOCSPX-...", redirect_uris: ["https://api.butterbase.ai/auth/app_abc123/oauth/google/callback"] // scopes / authorization_url / token_url / userinfo_url / provider_metadata are auto-filled for built-in providers }) ``` **Built-in providers (URLs and scopes pre-filled):** `google`, `github`, `discord`, `facebook`, `linkedin`, `microsoft`, `apple`, `x`. **Custom providers:** pass `authorization_url`, `token_url`, `userinfo_url`, ...