Auth Setup

This covers OAuth setup for Google, GitHub, Apple, X, and custom providers, plus JWT lifetime tuning and post-login hooks. You get two tools: manage_oauth for provider config and manage_auth_config for everything else. The role model is clean: anonymous, end-user JWT, or service key, each with different RLS behavior. Auth hooks are fire-and-forget functions that run after login, useful for creating profile rows or sending welcome emails but not for returning data to users. Service keys bypass RLS entirely, so the usual warnings apply. The redirect URI format is strict and provider quirks are documented, which saves time when Apple only returns names once or X refuses to give you emails.

GitHub stars: 532
last updated: Jun 11, 2026

View on GitHub

Install

$ npx -y skills add butterbase-ai/butterbase-skills --skill auth-setup --agent claude-code

Installs into .claude/skills of the current project.

Files

Butterbase Auth Setup

Two umbrella tools cover end-user authentication:

manage_oauth — provider configuration (Google, GitHub, Apple, X, custom)
manage_auth_config — auth hooks, JWT lifetimes, service key generation

For broad app build-out, see also butterbase-skills:build-app. This skill is the deep dive.

1. The role model

Every request runs under one of three database roles:

Auth header	Role	`current_user_id()`	RLS
none	`butterbase_anon`	NULL	enforced; default deny
End-user JWT (issued by `manage_oauth` or email login)	`butterbase_user`	user UUID	enforced
Service key (`bb_sk_*`)	`butterbase_service`	NULL	bypassed