Skip to content
ErawanACADEMYไทย

Make it real

A sign-in for your users — without storing a password

The moment an app has more than one user, it needs to know who is who. This is the shortest way there: Erawan handles the sign-in, so your app never holds anyone's password.

7 September 2026 · about 4 minutes

Rather not set it up yourself? Erawan does it for free on Hobby and above.

Does this app need a sign-in?

If you are the only one using this app, such as an admin page or a tool you made for yourself, you do not need a sign-in at all. Ask your AI to deploy it for the owner only (--access owner), and Erawan keeps everyone else out at the door.

This lesson is for an app that customers or the public sign up for and sign in to. Erawan's sign-in works from the free plan up.

1. Ask your AI for it

Add a sign-in to this app with Erawan's auth add-on, with Google and LINE.

From a terminal, run this.

erawan addon add my-app auth

The app restarts with what it needs in its environment: AUTH_ISSUER_URL, AUTH_CLIENT_ID, AUTH_CLIENT_SECRET and AUTH_JWKS_URL. You do not sign up for anything or configure anything at Google or LINE.

These are ordinary OpenID Connect values, so any sign-in library for your language works, and there is nothing Erawan-specific to learn. To see all of them in one place, run this.

erawan auth info my-app

2. Choose how people sign in

Unless you set it, the sign-in page offers all four: Google, LINE, GitHub and email. Keep only the ones your users actually have. A shop whose customers mostly use LINE does not need a GitHub button confusing them.

erawan auth providers set my-app google,line

3. Where people land after signing in

After signing in, people are sent back to your app, but only to an address on the list. Anything not on it is refused, so nobody can trick the flow into handing a token to somewhere else.

The list already has the usual paths on my-app.erawan.app, such as /auth/callback and /api/auth/callback, and localhost:3000 for development. If your app uses another path or port, or moves to your own domain, add it.

erawan auth callback add my-app https://shop.example.com/auth/callback

4. Put the sign-in page in Thai

The page your users see can open in Thai, and carry your app's name, colour and logo. The command below sets Thai. For a name, colour or logo, add --name, --color or --logo. To see the colours you can pick, run erawan auth theme show my-app.

erawan auth theme set my-app --lang th

If signing in goes wrong

  • Users are signed out every hour. It means the app did not ask for offline_access when it sent them to sign in. Ask your AI to add that scope, and the app gets a refresh token to keep the session alive.
  • Signing in ends in invalid_client. It means the app sends its client secret in a Basic header, while Erawan is set to expect it in the request body. Run erawan auth method set my-app basic. It takes effect at once, with no redeploy.

What your app never does

Store a password, hash one, or send a reset email. None of that reaches your app, and a password that was never in your database cannot leak from it.

To see who has signed in, run this. Email addresses and names are partly hidden by default, because this is your users' data. Add --unmask when you really need to see them in full.

erawan auth users my-app

Once you have real users, move to your own domain

The erawan.app address is fine for sites and demos, but an app people sign in to belongs on your own domain, because a browser treats that domain as your site alone, separate from the other apps on erawan.app. The steps are in Use your own domain with Erawan, from the Hobby plan up.

Add a Postgres database to your app →

All Erawan Cloud lessons