Neon.Auth reference

Auth

Source: src/Neon/Auth.ts

Own the managed Better Auth integration on one branch. This is distinct from Alchemy’s deployment authentication provider. Existing or inherited singleton integrations require explicit adoption. Users and sessions are runtime data. OAuth providers and trusted origins are owned only by their child resources. Disabling Auth preserves the neon_auth database schema. Neon refuses to enable it again while that schema exists; this provider never drops user identity data to recreate an externally disabled integration.

Auth: Enable managed authentication

const auth = yield* Neon.Auth("Auth", {
  branch,
  allowLocalhost: false,
  emailAndPassword: { enabled: true, require_email_verification: true },
});
yield* Neon.AuthTrustedDomain("SiteOrigin", { auth, domain: site.url });

AuthOAuthProvider

Source: src/Neon/AuthOAuthProvider.ts

Independently own one managed Auth OAuth provider. Shared credentials are for development only. Existing providers, including inherited providers, require explicit adoption. Removing managed credential fields is rejected; replace the child explicitly to switch back to development credentials.

AuthOAuthProvider: Configure an OAuth application

yield* Neon.AuthOAuthProvider("GitHub", {
  auth, provider: "github", clientId: "application-id",
  clientSecret: yield* Config.Redacted("GITHUB_CLIENT_SECRET"),
});

AuthTrustedDomain

Source: src/Neon/AuthTrustedDomain.ts

Own one trusted origin without replacing the Auth integration or overwriting other origins. Existing entries require explicit adoption.

AuthTrustedDomain: Trust a deployed frontend

yield* Neon.AuthTrustedDomain("SiteOrigin", { auth, domain: site.url });

ConnectAuth

Source: src/Neon/ConnectAuth.ts

Bind managed Auth’s public connection configuration. This does not create an admin credential, verify a JWT, or replace the standard Neon Auth SDK.

ConnectAuth: Connect managed authentication

const authClient = yield* Neon.ConnectAuth(auth);
// In the request handler:
const baseUrl = yield* authClient.baseUrl;