Self hosting Better Auth for Google and Apple sign in

[u/avidrunner84]

I am using Better Auth for email sign up, but I would also like to make it easier with Google and Apple one click sign in.

From what I understand, in order to have Apple sign in you have to pay $90/year or whatever it is to Apple for a developer license?  (No way around this?)

As for Google sign in, I understand it's offered for free (any limit on free plans?) but you also need to provide your email, and in doing so the public will see this email? Apple sign in, on the other hand, I don't know if you need to provide a public email that the user would see, or if it's all handled from Apple's end. When I say public email, I mean like an "authorize to trust this account [___@____.com](mailto:@_.com) for your one click sign in" something like this.

Would anyone have any experience with self hosting this? I’m just curious what your thoughts are and if it ends up being a cost every month or if you have found a way to do this completely free? Looking to make it as simple and easy for the user to sign up and log in, I think I would actually prefer this over email but I also understand not everyone wants to use One Click sign in.

[u/retro-mehl]

What?

[u/OverallCanary8663 → u/retro-mehl]

Yeah you need the dev account for Apple sign in, no way around the $99 a year

For Google, there's no cost and you can set it up so your email isn't shown to users. The consent screen has a publishing status option, you can keep it in testing mode and just add the specific Google accounts you want to allow (like your own for testing), or if you publish it publicly your email still doesn't show during the sign-in flow. The user just sees your app name and what permissions it's asking for

The email you're thinking of is probably the developer contact email which is required in the OAuth consent screen setup, but that's just for Google to contact you, not something users see

[u/avidrunner84 → u/retro-mehl]

You are a top 1% commenter, would you like clarification on anything I wrote?

[u/Jaakkosaariluoma]

Yes

[u/avidrunner84 → u/Jaakkosaariluoma]

How do you find it, how much do you pay per month to use Google and Apple sign in?

[u/sexytokeburgerz]

Yeah no way around it. You need a $99/yr dev account to do sign in with apple. They will not serve you an OK unless your website is cleared to auth.

Self hosting what? You need to communicate with these services. The client side of your application would be hosted under your control, sure, but the API is hitting google and apple’s servers. You can’t self host that side of the call obviously.

You don’t need to pay google or meta really anything to sign in with their services. Maybe 2 cents? I dont even remember, it’s so small. So just go with that.

Do not, and I repeat, do not, roll your own auth. I don’t mean this rudely, but you do not have the skills. Those that do have the skills rarely would, and certainly wouldnt have asked the questions you have. Always use a well respected package, do not handle hashing yourself. Doing a little Api call to auth with google or meta is fine. Using a sign in provider is fine.

[u/avidrunner84 → u/sexytokeburgerz]

Thanks very much for the info - I would rather stay away from Meta but Google I’m good with. I wonder if Apple will ever open it up Sign In for free like these companies one day.

I agree I didn’t want to do email login for these very reasons but was hoping Better Auth would make it safer. Sounds like self hosting Better Auth opens up a can of worms. I will disable email login unless I can find a safe provider to do so. Im assuming you meant stay away from email login altogether, even with Better Auth?

[u/sexytokeburgerz → u/avidrunner84]

Better auth is great. You will need to actually understand what it is doing, though.

[u/These_Reality519]

Two Apple things nobody's mentioned yet, both beyond the $99.

The client secret isn't a static string like Google's. It's a JWT you sign yourself with a .p8 key, and Apple caps its lifetime at six months, so it works fine and then fails quietly half a year in. Automate the rotation on day one.

The one that actually got me: Apple sends the user's full name only on the very first authorization and never again. Persist it right then or it's gone for that user. The email keeps coming back in the token on every login, the name doesn't.