ThunderID provider helper for the Better Auth Generic OAuth plugin.

This is a community provider helper: it returns a typed GenericOAuthConfig for a ThunderID issuer. All OAuth 2.0 / OIDC handling is performed by Better Auth itself — this package only supplies configuration, so there is no ThunderID SDK dependency and no protocol logic to keep in sync.

Pre-requisites

• Requires better-auth >= 1.7.0 as a peer dependency.
• A running ThunderID instance with an OAuth 2.0 / OIDC application registered. See the ThunderID documentation for details.

Installation

npm install @thunderid/better-auth

Usage

import {thunderid} from '@thunderid/better-auth';
import {betterAuth} from 'better-auth';
import {genericOAuth} from 'better-auth/plugins';

export const auth = betterAuth({
  plugins: [
    genericOAuth({
      config: [
        thunderid({
          clientId: process.env.THUNDERID_CLIENT_ID!,
          clientSecret: process.env.THUNDERID_CLIENT_SECRET!,
          issuer: process.env.THUNDERID_ISSUER!,
        }),
      ],
    }),
  ],
});

Use your existing Better Auth client, or create one. No client plugin is required, since the generic OAuth plugin exposes sign-in through the standard social-provider API:

import {createAuthClient} from 'better-auth/react';

export const authClient = createAuthClient();

Sign in from the client with the thunderid provider ID:

await authClient.signIn.social({
  provider: 'thunderid',
  callbackURL: '/dashboard',
});

Callback URL

Register this redirect URI on your ThunderID application:

{baseURL}/api/auth/callback/thunderid

For example, http://localhost:3000/api/auth/callback/thunderid in development.

Options

| Option | Type | Default | Description | | ----------------------- | ---------- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | issuer | string | — | Required. ThunderID issuer URL, e.g. https://thunderid.example.com. A trailing slash is trimmed. The OIDC discovery URL is derived as {issuer}/.well-known/openid-configuration, so all endpoints come from the discovery document. | | clientId | string | — | Required. OAuth client ID. | | clientSecret | string | — | OAuth client secret. Omit for public clients using tokenEndpointAuth: {method: 'none'}. | | scopes | string[] | ['openid', 'profile', 'email'] | Requested scopes. | | tokenEndpointAuth | object | provider default | Token endpoint authentication method, e.g. {method: 'client_secret_post'}. | | pkce | boolean | discovery default | Force PKCE on or off. | | redirectURI | string | Better Auth default | Override the callback URL. | | endSessionEndpoint | string | discovery default | RP-initiated logout endpoint. | | postLogoutRedirectURI | string | — | Where ThunderID returns the user after logout. | | disableProviderLogout | boolean | false | Skip provider logout on sign-out. | | disableImplicitSignUp | boolean | false | Require an explicit sign-up request before creating a user. | | disableSignUp | boolean | false | Reject sign-in for users who do not already exist. | | overrideUserInfo | boolean | false | Refresh the stored user profile from ThunderID on every sign-in. |

Every option other than issuer is passed through from Better Auth's BaseOAuthProviderOptions and behaves exactly as it does for the built-in provider helpers.

License

This project is licensed under the Apache License 2.0.