Make it real

A sign-in for your users — without storing a password

The moment an app has more than one user it needs to know who is asking. This is the shortest way to get that, and the reason your app is better off never holding a password at all.

7 September 2026 · about 3 minutes

1. Add it

erawan addon add my-app auth

That gives the app its own OpenID Connect issuer and restarts it with the details in its environment. Nothing to sign up for and nothing to configure at a provider.

2. Choose who may sign in

erawan auth providers set my-app google,line

Google, LINE, GitHub and email are the four. Set the ones your users actually have — a sign-in screen offering four buttons to an audience that only uses one is a screen people bounce off.

3. Point it back at your app

After somebody signs in, the browser has to be sent somewhere. That destination is a list you control, and anything not on it is refused:

erawan auth callback add my-app https://my-app.erawan.app/callback

Add http://localhost:… too while you are building. The list exists because an open redirect on a sign-in flow is how a token ends up somewhere it should not, so the refusal is the feature.

4. Read it in your code

Your app receives the issuer, client id and secret as environment variables and speaks ordinary OIDC — any library for your language works, and there is nothing Erawan-shaped to learn.

erawan auth info my-app

That prints the discovery endpoint most libraries only need to be handed.

What you never do

Store a password. Hash one. Send a reset email. Decide how long a session lasts, or what to do when somebody's address changes at Google. None of that reaches your app, which means none of it is yours to get wrong — and a password you never held cannot leak from a database you did not secure.

What you can see is who has signed in, masked by default because it is your users' data and not yours to page through casually:

erawan auth users my-app

erawan auth theme, in the docs →

All lessons