ObjectStackAuth Config
Auth Config protocol schemas
Better-Auth Configuration Protocol
Defines the configuration required to initialize the Better-Auth kernel.
Used in server-side configuration injection.
Source: packages/spec/src/system/auth-config.zod.ts
TypeScript Usage
import { AuthConfig, AuthPluginConfig, AuthProviderConfig, MutualTLSConfig } from '@objectstack/spec/system';
import type { AuthConfig, AuthPluginConfig, AuthProviderConfig, MutualTLSConfig } from '@objectstack/spec/system';
// Validate data
const result = AuthConfig.parse(data);AuthConfig
Properties
| Property | Type | Required | Description |
|---|---|---|---|
| secret | string | optional | Encryption secret |
| baseUrl | string | optional | Base URL for auth routes |
| databaseUrl | string | optional | Database connection string |
| providers | Object[] | optional | |
| plugins | Object | optional | |
| session | Object | optional | |
| mutualTls | Object | optional | Mutual TLS (mTLS) configuration |
AuthPluginConfig
Properties
| Property | Type | Required | Description |
|---|---|---|---|
| organization | boolean | ✅ | Enable Organization/Teams support |
| twoFactor | boolean | ✅ | Enable 2FA |
| passkeys | boolean | ✅ | Enable Passkey support |
| magicLink | boolean | ✅ | Enable Magic Link login |
AuthProviderConfig
Properties
| Property | Type | Required | Description |
|---|---|---|---|
| id | string | ✅ | Provider ID (github, google) |
| clientId | string | ✅ | OAuth Client ID |
| clientSecret | string | ✅ | OAuth Client Secret |
| scope | string[] | optional | Requested permissions |
MutualTLSConfig
Properties
| Property | Type | Required | Description |
|---|---|---|---|
| enabled | boolean | ✅ | Enable mutual TLS authentication |
| clientCertRequired | boolean | ✅ | Require client certificates for all connections |
| trustedCAs | string[] | ✅ | PEM-encoded CA certificates or file paths |
| crlUrl | string | optional | Certificate Revocation List (CRL) URL |
| ocspUrl | string | optional | Online Certificate Status Protocol (OCSP) URL |
| certificateValidation | Enum<'strict' | 'relaxed' | 'none'> | ✅ | Certificate validation strictness level |
| allowedCNs | string[] | optional | Allowed Common Names (CN) on client certificates |
| allowedOUs | string[] | optional | Allowed Organizational Units (OU) on client certificates |
| pinning | Object | optional | Certificate pinning configuration |