Providers

An OAuth provider is anything implementing port.OAuthProvider — three methods: Name() string, AuthURL(state, codeChallenge string) string, and Exchange(ctx, code, codeVerifier string) (*port.OAuthProfile, error). Register one with WithProvider, and its routes (/auth/oauth/{provider}, /auth/oauth/{provider}/callback, /auth/oauth/{provider}/link, /auth/oauth/{provider}/unlink) are mounted automatically — see Routes. You can register more than one provider at once; each needs a unique Name().

For linking/unlinking a provider on an already-logged-in account and listing what's connected — rather than the initial sign-up/sign-in flow covered below — see Guides → OAuth linking.

Every built-in provider uses PKCE (S256) regardless of whether the provider strictly requires it — see Security for why that matters.

Currently built in: GitHub and Google. More can be added the same way provider/github and provider/google are built — implementing port.OAuthProvider against any OAuth2 provider's token and userinfo endpoints.