Skip to main content
Version: Next

Interface: ExternalAuthProviderManifest

EXPERIMENTAL. An external auth provider, described declaratively.

Adapter packages produce this from their spec helpers (e.g. clerk() from @wasp.sh/auth-clerk/spec), and hand-written adapters produce it via customAuthProvider. Both go through defineAuthProviderManifest, which validates the manifest and stamps it as authentic -- the compiler rejects hand-crafted object literals.

Properties​

__waspAuthProviderManifest​

readonly __waspAuthProviderManifest: true

Marks a manifest as constructed by defineAuthProviderManifest rather than hand-crafted. Adapters never set this themselves.

capabilities​

capabilities: string[]

The provider's capabilities, as an open set of strings. Known today: "issue-sessions", "session-revocation", "cookie-transport". Unknown entries are ignored, so adapters can declare capabilities newer than the compiler.

contractVersion​

contractVersion: 1

Version of the auth provider contract the adapter was built against. Wasp rejects manifests with a contract version it does not support, which turns adapter/compiler version skew into a clear error.

env​

env: object

Env vars the provider needs, rendered into generated env validation.

client​

client: EnvVarRequirement[]

server​

server: EnvVarRequirement[]

id​

id: string

Stable identifier of the provider ("external:clerk", "external:better-auth"). Must carry the external: prefix -- the unprefixed namespace is reserved for Wasp's own auth methods, which record identities in the same place. Identities Wasp provisions for this provider's subjects are recorded under this name, so it must stay stable across deploys.

kind​

kind: "external"

Discriminates the provider union. Always "external".

options?​

optional options?: unknown

Serializable adapter options, passed verbatim to the adapter's server factory. Must survive a JSON round-trip; the compiler checks.

routes?​

optional routes?: object

Routes the provider wants mounted on Wasp's server, for providers that bring their own HTTP endpoints (Better Auth). rawBody mounts them without the JSON body parser, for handlers that read the body themselves.

basePath​

basePath: `/${string}`

rawBody?​

optional rawBody?: boolean

server​

server: { package: string; } | Reference<AnyObject>

The provider's server adapter: either the module specifier of an adapter package's server entry (which must export createServerAdapter), or a reference to a user-code module exporting an AuthProvider.

setupFn?​

optional setupFn?: Reference<AnyFunction>

Setup function for the provider's underlying library, following the same convention as db.prismaSetupFn: a reference to a user-code function the adapter calls with its integration config, whose return value becomes the configuration to use. This is how an app reaches everything serializable options cannot carry -- hooks, plugins, email-sending callbacks.

userSignupFields?​

optional userSignupFields?: Reference<AnyObject>

Populates the app's user entity when Wasp provisions a local user for a subject it has not seen before, from the claims the provider verified. Required in practice when the user entity has non-nullable fields.