# Authentication — BrandApp Playground

> Better Auth wired to Reopt OAuth — server setup, client setup, session reads, and the catch-all route.

- Canonical page: https://brandapp-playground.vercel.app/auth
- Markdown: https://brandapp-playground.vercel.app/auth.md
- SDK module: `@reopt-ai/brandapp-sdk/better-auth`

## What it demonstrates

- `createReoptAdapter()` — stores users and sessions in Reopt's backend, so the consumer
  app needs no local database.
- `createReoptOAuth()` — registers Reopt as an OAuth2 provider for *Sign in with Reopt*.
- `nextCookies()` — must be the last Better Auth plugin so it can forward the
  `Set-Cookie` headers produced by the plugins before it.

## Scopes

Beyond `openid`, `profile`, and `email`, the playground requests:

- `offline_access` — refresh token
- `brandapp:read` — read the linked BrandApp customer
- `brandapp:write` — required by `linkCurrentUser` and withdrawal, which mutate the link

## Two OAuth clients

The adapter and the login flow can use separate clients. Production keeps the
brand-configured shared client for the adapter and uses
`PLAYGROUND_BRANDAPP_CLIENT_ID` / `PLAYGROUND_BRANDAPP_CLIENT_SECRET` for the login flow,
whose redirect URI must match the public host.

## Session caching

The Reopt adapter delegates session reads to the Reopt API on every request.
`session.cookieCache` skips that round trip for its `maxAge` (300s here); the trade-off
is that session invalidation lags by up to that window.

## Related

- [Verify session](https://brandapp-playground.vercel.app/auth/session.md)
- [Single Logout](https://brandapp-playground.vercel.app/logout.md)
- [Health Check](https://brandapp-playground.vercel.app/health.md)

---

Index of every document: https://brandapp-playground.vercel.app/llms.txt
Single-file copy: https://brandapp-playground.vercel.app/llms-full.txt
HTTP API description: https://brandapp-playground.vercel.app/openapi.json