Updated Sep 2026

OAuth Providers

"Sign in with ___" is table stakes. Here's the breakdown of the major OAuth

OAuth

A secure way to log in using another account (like Google or GitHub) without sharing your password with the app.

"Like a hotel key card. The front desk (Google) vouches for you, so the room (app) lets you in."

providers: who they reach, what they cost you in setup pain, and exactly what to configure for Auth.js v5 on Next.js 16.

1Quick Comparison

Provider	Audience	Cost to you	Setup	Best for
Google	Nearly everyone	Free	Medium	Consumer apps, B2C products
GitHub	Developers	Free	Easy	Developer tools, open-source projects
Apple	Apple device owners	Dev program fee	Hard	iOS apps, privacy-focused users
X (Twitter)	Social / media crowd	Check pricing	Hard	Social apps, media platforms
Facebook (Meta)	Very broad	Free	Medium	Social apps, older demographics
Microsoft (Entra ID)	Work & school accounts	Free	Hard	Enterprise apps, B2B SaaS
LinkedIn	Professionals	Free	Medium	Recruiting, B2B, professional tools
Discord	Gamers & communities	Free	Easy	Gaming, community apps, bots

"Cost to you" means provider fees for basic sign-in, as of Sep 2026. Always confirm on the provider's current pricing page; developer programs and API plans change.

2How OAuth Works (Every Provider)

User clicks login

Redirects to provider

User approves

Grants permission

Callback redirect

Back to your app with a code

Exchange for tokens

Server gets the profile

Hitting redirect_uri_mismatch or client_id=undefined? Read The OAuth Trap

3The Universal Setup Pattern

Every provider follows the same four steps. Learn it once, set up any provider in minutes.

Create an app in the provider's console

Every provider has a developer portal where you create an "app" or "OAuth client".

Copy the Client ID + Client Secret

A public ID and a private secret. Guard the secret like a password.

Register callback URLs

Localhost and production, exact host (www or apex). Auth.js path: /api/auth/callback/<provider>.

Add env vars locally and on Vercel

AUTH_{PROVIDER}_ID and AUTH_{PROVIDER}_SECRET in .env.local and in Vercel (Production + Preview). Redeploy.

auth.ts (Auth.js v5, several providers)

import NextAuth from "next-auth";
import Google from "next-auth/providers/google";
import GitHub from "next-auth/providers/github";
import MicrosoftEntraID from "next-auth/providers/microsoft-entra-id";

// Each provider reads AUTH_<PROVIDER>_ID / AUTH_<PROVIDER>_SECRET automatically
export const { handlers, signIn, signOut, auth } = NextAuth({
  providers: [Google, GitHub, MicrosoftEntraID],
});

Not on Auth.js? Better Auth and Clerk use the same provider consoles and the same Client ID / Secret; only the env var names and callback paths differ. See the Authentication playbook.

4Provider Deep Dives

Google

Best for: Consumer apps, B2C products

Medium Setup

Audience

Nearly everyone

Cost

Free

Setup Time

15-30 min

Pros

+Huge user base: most people already have a Google account
+Highly trusted by users
+Rich profile data (name, email, avatar)
+No per-login fees for basic sign-in
+Excellent documentation

Cons

-Complex OAuth consent screen setup
-Brand/app verification can be required before launch (can take days)
-Strict app review process for sensitive scopes
-Many settings can be overwhelming

Setup Requirements

Developer Console

Google Cloud Console

Environment Variables

AUTH_GOOGLE_ID=your_client_id

AUTH_GOOGLE_SECRET=your_client_secret

Callback URL Format

https://yourdomain.com/api/auth/callback/google

Requires OAuth consent screen configuration. For production, you may need to verify your app.

GitHub

Best for: Developer tools, open-source projects

Easy Setup

Audience

Developers

Cost

Free

Setup Time

5-10 min

Pros

+Instant setup - no verification required
+Perfect for developer-focused apps
+Access to repos, gists, and profile data
+Simple, clean interface
+No cost to create an OAuth App

Cons

-Much smaller audience than Google
-Only relevant for developer audiences
-Limited profile data compared to Google
-Users must have GitHub account

Setup Requirements

Developer Console

GitHub Developer Settings

Environment Variables

AUTH_GITHUB_ID=your_client_id

AUTH_GITHUB_SECRET=your_client_secret

Callback URL Format

https://yourdomain.com/api/auth/callback/github

Register http://localhost:3000/api/auth/callback/github and your production callback (OAuth Apps accept up to 10 callback URLs), or keep separate dev and prod OAuth Apps. Env vars must be named AUTH_GITHUB_ID / AUTH_GITHUB_SECRET for Auth.js v5 to find them.

Apple

Best for: iOS apps, privacy-focused users

Hard Setup

Audience

Apple device owners

Cost

Dev program fee

Setup Time

30+ min

Pros

+Expected by iOS users; helps meet App Store login rules
+High trust with Apple users
+"Hide My Email" option protects user privacy
+Seamless on Apple devices

Cons

-Paid Apple Developer Program membership required ($99/year)
-Client secret is a signed JWT you must regenerate periodically
-Limited user data (name + email only)
-Private relay email makes user contact tricky

Setup Requirements

Developer Console

Apple Developer Portal

Environment Variables

AUTH_APPLE_ID=your_client_id

AUTH_APPLE_SECRET=your_client_secret

Callback URL Format

https://yourdomain.com/api/auth/callback/apple

Apple needs a real HTTPS callback (no plain localhost), and Auth.js's redirect proxy doesn't support Apple. If your iOS app uses third-party social login, check App Store Review Guideline 4.8 for the current login-option rules.

X (Twitter)

Best for: Social apps, media platforms

Hard Setup

Audience

Social / media crowd

Cost

Check pricing

Setup Time

30+ min

Pros

+Great for social/media apps
+Access to tweets, followers, profile
+Strong presence in tech/news communities
+OAuth 2.0 with PKCE

Cons

-API access tiers and pricing change often; check before you build
-Frequent API changes and instability
-User base is niche compared to Google/Facebook
-Complex approval process for elevated access

Setup Requirements

Developer Console

X Developer Portal

Environment Variables

AUTH_TWITTER_ID=your_client_id

AUTH_TWITTER_SECRET=your_client_secret

Callback URL Format

https://yourdomain.com/api/auth/callback/twitter

X's API plans and limits have changed repeatedly. Check the current X developer pricing page before promising 'Sign in with X' to anyone.

Facebook (Meta)

Best for: Social apps, older demographics

Medium Setup

Audience

Very broad

Cost

Free

Setup Time

15-30 min

Pros

+Massive user base
+Rich social graph data available
+Users familiar with Facebook login
+Free for basic auth

Cons

-App review required for most permissions
-Privacy concerns make users hesitant
-Complex permission system
-Facebook's reputation has declined
-Younger users avoiding Facebook

Setup Requirements

Developer Console

Meta for Developers

Environment Variables

AUTH_FACEBOOK_ID=your_client_id

AUTH_FACEBOOK_SECRET=your_client_secret

Callback URL Format

https://yourdomain.com/api/auth/callback/facebook

Many users now hesitant to grant Facebook access. Consider if your target audience uses Facebook.

Microsoft (Entra ID)

Best for: Enterprise apps, B2B SaaS

Hard Setup

Audience

Work & school accounts

Cost

Free

Setup Time

30+ min

Pros

+Essential for enterprise/B2B apps
+Access to Microsoft 365 ecosystem
+Outlook, Teams, OneDrive integration
+Corporate SSO capabilities
+Works with both work and personal Microsoft accounts

Cons

-Azure portal is complex and confusing
-Tenant configuration can be tricky
-Consumer vs Work account confusion
-Heavy for simple consumer apps

Setup Requirements

Developer Console

Azure Portal → Microsoft Entra ID → App registrations

Environment Variables

AUTH_MICROSOFT_ENTRA_ID_ID=your_client_id

AUTH_MICROSOFT_ENTRA_ID_SECRET=your_client_secret

AUTH_MICROSOFT_ENTRA_ID_ISSUER=see notes

Callback URL Format

https://yourdomain.com/api/auth/callback/microsoft-entra-id

Use the microsoft-entra-id provider (the old azure-ad one is legacy). The ISSUER depends on who can sign in: https://login.microsoftonline.com/common/v2.0 for work + personal accounts, or /<tenant-id>/v2.0 for a single company.

Best for: Recruiting, B2B, professional tools

Medium Setup

Audience

Professionals

Cost

Free

Setup Time

15-30 min

Pros

+Perfect for professional/B2B apps
+Rich professional profile data
+High trust in business contexts
+Access to company and job data

Cons

-Restrictive API access policies
-Limited to professional audience
-Some features require partnership
-Review process for most data scopes

Setup Requirements

Developer Console

LinkedIn Developer Portal

Environment Variables

AUTH_LINKEDIN_ID=your_client_id

AUTH_LINKEDIN_SECRET=your_client_secret

Callback URL Format

https://yourdomain.com/api/auth/callback/linkedin

Discord

Best for: Gaming, community apps, bots

Easy Setup

Audience

Gamers & communities

Cost

Free

Setup Time

5-10 min

Pros

+Huge gaming and community audience
+Easy setup, minimal verification
+Access to guilds (servers) user is in
+Great for community-based apps

Cons

-Niche audience (gamers, communities)
-Limited professional use cases
-User base skews younger
-Not suitable for enterprise apps

Setup Requirements

Developer Console

Discord Developer Portal

Environment Variables

AUTH_DISCORD_ID=your_client_id

AUTH_DISCORD_SECRET=your_client_secret

Callback URL Format

https://yourdomain.com/api/auth/callback/discord

5Saucy Recommendations

New consumer app?

Start with Google (plus GitHub if your users are developers). Add more only when users ask.

Enterprise / B2B?

Microsoft Entra ID + Google. Corporate users expect Microsoft; plenty of companies run on Google Workspace.

Mobile app?

Google + Apple covers most phones. Check Apple's current App Store login rules before shipping. More in iOS Setup.

Gaming / community?

Discord is king. Add Google as a fallback for people who don't game.

Every provider you add is another console, another secret to rotate, and another set of callback URLs. Two good providers beat six half-configured ones.

6Common Mistakes

Missing callback URLs

You need one per host you sign in from: localhost:3000, your production domain (www or apex, whichever users actually land on), and any stable staging domain. Miss one and that environment breaks.

Wrong env var names

Auth.js v5 auto-reads AUTH_GOOGLE_ID, AUTH_GITHUB_ID, and so on. v4-era names like GITHUB_ID or NEXTAUTH_SECRET leave the provider with client_id=undefined.

Exposing client secrets

Never put a secret in client-side code, a NEXT_PUBLIC_ variable, or git. Server-side env vars only.

Forgetting production env vars

Your .env.local doesn't deploy. Add every variable in Vercel for Production (and Preview if you test sign-in there).

Not redeploying after adding env vars

Env var changes apply to new deployments only. Redeploy.

Promising a provider before checking its terms

Some providers gate API access behind paid plans or app review (X, Facebook, LinkedIn for certain scopes). Read the current terms first.

Provider-specific setup: Auth.js OAuth docs

OAuth Providers

1Quick Comparison

2How OAuth Works (Every Provider)

3The Universal Setup Pattern

Create an app in the provider's console

Copy the Client ID + Client Secret

Register callback URLs

Add env vars locally and on Vercel

4Provider Deep Dives

Google

Pros

Cons

Setup Requirements

GitHub

Pros

Cons

Setup Requirements

Apple

Pros

Cons

Setup Requirements

X (Twitter)

Pros

Cons

Setup Requirements

Facebook (Meta)

Pros

Cons

Setup Requirements

Microsoft (Entra ID)

Pros

Cons

Setup Requirements

LinkedIn

Pros

Cons

Setup Requirements

Discord

Pros

Cons

Setup Requirements

5Saucy Recommendations

New consumer app?

Enterprise / B2B?

Mobile app?

Gaming / community?

6Common Mistakes

Missing callback URLs

Wrong env var names

Exposing client secrets

Forgetting production env vars

Not redeploying after adding env vars

Promising a provider before checking its terms

Related Resources

The OAuth Trap

Authentication Playbook

Environment Variables

Terminology