# auth setup

Start with the parts you need. The service connects those parts to a provider; its configuration belongs to your app.

## 1. Initialize an app

Run this once in your app folder. An existing initialized Next.js app can skip it.

```
npx slices.sh install
```

## 2. Install the service registry

Add services/index.ts, the file `import "@/services"` loads: it registers every services/<service>/<config>.config.ts with @slices.sh/core. A provider setup writes the same file, so this step is for an app that has none yet. https://slices.sh/r/services.json

```
npx slices.sh add services
```

## 3. Install the headless library

Add the React parts with npm. Their styling and composition belong to your app.

```
npm install @slices.sh/auth@^0.1.10
```

## 4. Install the service

Use the interactive installer below to choose a provider and its options. The command installs the packages, services/<service>/default.config.ts, services/index.ts and the API route. No hand-written fetch or provider wrapper is needed.

```
npx slices.sh add auth.betterauth
```

## Auth: Better Auth

Sign-in, sessions, passkeys, two-factor and organizations inside the app, on Better Auth. Memory, MongoDB, Neon or Supabase for storage, each from its own package; AuthLocker for email and SMS codes and Google or GitHub. URL options: auth-methods (list), organizations (boolean), password-reset (boolean), two-factor (boolean), passkeys (boolean), db (string).

```
npx slices.sh add auth.betterauth
```

## Authentication options

Choose db=memory, mongo, neon or supabase; auth-methods is a comma-separated list of password, google, github, email-otp and phone-otp. Add passkeys=true, two-factor=true, organizations=true or password-reset=true when needed. Two-factor and password reset require password. Provision resources for persistent databases and external sign-in methods.

```
npx slices.sh add auth.betterauth --db mongo --auth-methods google,email-otp
```

## 5. Load your configuration

In the client component using the headless parts, load the service registry before rendering a required Root. Keep the client directive first.

```
"use client"

// services/index.ts comes from https://slices.sh/r/services.json (or any provider setup)
import "@/services"
```

## 6. Provisioning is included

The slices.sh installation command provisions the required resources automatically.

## Auth: Better Auth: setup note 1

BETTER_AUTH_SECRET signs every session and is generated into .env.local while this installs (32 random bytes, base64, nothing leaves the machine). Changing it signs everyone out; in production set the same one on every instance.

## Auth: Better Auth: setup note 2

The public origin (OAuth callbacks, the passkey domain) is the one each request comes to in development, and the deployment's own on Vercel. Elsewhere, or behind a proxy or a custom domain, set BETTER_AUTH_URL, such as https://acme.com.

## 7. Run your component

Required roots throw a setup error when no service is configured. A required capability can be named with enabled. Use enabled="optional" only when the feature is intentionally optional. Parts hide controls the configured provider cannot support.

```
npm run dev
```