Configuration
All configuration options, environment variables, and validation for the auth plugin.
The plugin is configured via config/plugins/robojs/auth.ts. The config type is AuthPluginOptions, validated at startup with a Zod schema in strict mode. Unrecognized fields cause errors.
Config file example
import Discord from '@robojs/auth/providers/discord'
import EmailPassword from '@robojs/auth/providers/email-password'
import { createFlashcoreAdapter } from '@robojs/auth'
import type { AuthPluginOptions } from '@robojs/auth'
const adapter = createFlashcoreAdapter({ secret: process.env.AUTH_SECRET! })
const config: AuthPluginOptions = {
appName: 'My App',
adapter,
secret: process.env.AUTH_SECRET,
providers: [
Discord({ clientId: process.env.DISCORD_CLIENT_ID!, clientSecret: process.env.DISCORD_CLIENT_SECRET! }),
EmailPassword({ adapter })
],
session: { strategy: 'database', maxAge: 60 * 60 * 24 * 30 }
}
export default configimport Discord from '@robojs/auth/providers/discord'
import EmailPassword from '@robojs/auth/providers/email-password'
import { createFlashcoreAdapter } from '@robojs/auth'
const adapter = createFlashcoreAdapter({ secret: process.env.AUTH_SECRET! })
const config = {
appName: 'My App',
adapter,
secret: process.env.AUTH_SECRET,
providers: [
Discord({ clientId: process.env.DISCORD_CLIENT_ID!, clientSecret: process.env.DISCORD_CLIENT_SECRET! }),
EmailPassword({ adapter })
],
session: { strategy: 'database', maxAge: 60 * 60 * 24 * 30 }
}
export default configCore options
Prop
Type
Session options
Configure session strategy, lifetime, and refresh behavior via the session object.
Prop
Type
Auth.js options
Advanced hooks and customizations from Auth.js.
Prop
Type
Email options
Email delivery, templates, and triggers. See the dedicated email delivery page for details.
Prop
Type
Upstream proxy
Forward all auth routes to another Robo instance. See upstream proxy for configuration examples.
Prop
Type
Environment variables
These variables are read by the plugin during initialization.
| Variable | Purpose | Read/Written |
|---|---|---|
AUTH_SECRET | JWT signing secret | Read; written if resolved from config |
NEXTAUTH_SECRET | Fallback for AUTH_SECRET | Read only |
AUTH_URL | Canonical callback URL | Read; written if resolved |
NEXTAUTH_URL | Fallback for AUTH_URL | Read only |
AUTH_REDIRECT_PROXY_URL | Preview deployment proxy | Read; written if configured |
PORT | Fallback port (default 3000) | Read only |
NODE_ENV | Production detection | Read only |
Validation
The exported authPluginOptionsSchema (Zod) and normalizeAuthOptions() function enable programmatic validation.
import { authPluginOptionsSchema, normalizeAuthOptions } from '@robojs/auth'
const validated = authPluginOptionsSchema.parse(rawConfig)
const normalized = normalizeAuthOptions(rawConfig)import { authPluginOptionsSchema, normalizeAuthOptions } from '@robojs/auth'
const validated = authPluginOptionsSchema.parse(rawConfig)
const normalized = normalizeAuthOptions(rawConfig)Secret auto-generation
In production, a missing secret causes an error. In development, a temporary random secret is generated with a warning. Always set AUTH_SECRET for consistent sessions across restarts.
Cookie security
For http:// URLs, the plugin automatically sets secure=false on cookies to prevent rejection in local development.