Sign In with Social Provider

Authenticate a user via Better Auth social sign-in. Public endpoint.

Two branches:

Web (redirect): omit idToken; the response returns an url to the provider's consent screen (redirect: true).

Native mobile (idToken): send idToken.token obtained from the native Google/Apple SDK. The server verifies it, signs the user into the account it is linked to, and returns session details directly (redirect: false). The session bearer token is returned in the body (token) — the reliable source for native clients — and mirrored in the set-auth-token response header. Store it securely and send it as Authorization: Bearer <token> on subsequent requests.

Only existing users can sign in (self-registration is disabled); the social identity must already be linked to a Core account.

When the identity is not linked to any account, the request is rejected with 401 and the body message signup disabled (the code is Better Auth's generic OAUTH_LINK_ERROR, so the message is what distinguishes this case). Native clients should surface it as "this account is not registered, contact the school" rather than a generic sign-in failure. The web redirect branch reports the same case by returning to errorCallbackURL with ?error=signup_disabled.

curl --location '/auth/sign-in/social' \ --header 'Content-Type: application/json' \ --data '{ "provider": "string", "idToken": { "token": "string", "nonce": "string", "accessToken": "string", "refreshToken": "string" }, "callbackURL": "string", "newUserCallbackURL": "string", "errorCallbackURL": "string", "disableRedirect": true, "requestSignUp": true, "loginHint": "string", "additionalData": { "property1": "string", "property2": "string" } }'

{ "redirect": true, "token": "string", "url": "string", "user": { "id": "string", "email": "string", "name": "string", "image": "string", "emailVerified": true, "createdAt": "2019-08-24T14:15:22.123Z", "updatedAt": "2019-08-24T14:15:22.123Z" } }

Sign In with Social Provider

Request

Responses