Skip to main content
Rootprint ships with email and password sign-in. Admins add external providers under Settings → Authentication: Google, GitHub, and one OpenID Connect issuer. You configure each provider on its own, and every provider follows the rules below.

Add a provider

Each provider page covers registering the app and the fields to fill in. Two things work the same for every provider:
  • Callback URL. Register https://<your-rootprint>/api/auth/callback/<provider> at the provider, where <provider> is google, github, or oidc. Replace <your-rootprint> with the host of your Rootprint instance. The provider’s form in Settings → Authentication shows the exact Callback URL.
  • Saving applies live. Click Save and the provider’s Continue with … button appears on the sign-in page. No restart is needed.

Provider rules

Rootprint checks admission at sign-in. It evaluates Google’s allowed domains, GitHub’s allowed organizations, and the OpenID Connect issuer when a user signs in. Editing an allow-list takes effect at the next sign-in attempt. Open sessions stay open. New users get the user role. The first sign-in through an allowed provider creates the account. Promote the user under Settings → Users if they need admin access. Rootprint links accounts by email. When a provider reports an email that matches an existing Rootprint account, the sign-in attaches the provider to that account. A user can hold a password and several linked providers at the same time. Invites and password resets work with providers. See Manage users for onboarding through a provider and for adding a password to a provider-only account. Rootprint encrypts stored OAuth tokens with BETTER_AUTH_SECRET. Set it yourself; see Environment variables.

Remove a provider

Open Settings → Authentication, click Edit on the provider’s row, and click Remove. The sign-in button disappears, and every user with an account linked to that provider is signed out of all sessions, including password sessions. Removing OpenID Connect also removes its link from every account. Users keep their Rootprint accounts. They can sign in with another linked provider, or with a password while password sign-in is on. An admin can reset the password of anyone who has none.

Password sign-in

Settings → Authentication has a Password sign-in toggle. Turn it off to require an external provider for every sign-in. While it is off:
  • Invites still work, but the invited person must sign in through a provider with the invited email. The setup link cannot sign them in.
  • Reset password is hidden.
Rootprint does not check that a working provider exists before you disable password sign-in. Sign in through a provider yourself first, or you can lock every admin out. To recover without a working session, delete the password_sign_in_disabled row from app_settings and restart Rootprint:

API

The Auth settings API group in the API reference covers provider status, credentials, allow-lists, removal, and the password sign-in toggle. All need an admin session.