StudioAPI supports Google and GitHub OAuth for account creation and sign-in.

Flow

1. Dashboard links to https://use.studioapi.dev/auth/google or /auth/github.
2. The provider authorizes and redirects back to https://use.studioapi.dev/auth/{provider}/callback.
3. The backend validates state, fetches the verified profile, upserts the user, and redirects to the dashboard with a JWT in the URL fragment:

https://app.studioapi.dev/oauth/callback#token=<jwt>

Requirements

• Google: the account must return a verified email.
• GitHub: the user must have a primary verified email and grant read:user user:email scope.
• Callback URIs are configured with GOOGLE_REDIRECT_URI and GITHUB_REDIRECT_URI.

Redirect URIs (current)

• Google: https://use.studioapi.dev/auth/google/callback
• GitHub: https://use.studioapi.dev/auth/github/callback

Security

• OAuth state is a signed cookie (HttpOnly, Secure, SameSite=Lax, 10-minute TTL).
• New OAuth users are created with email_verified = true and the OAuth subject stored as the password hash placeholder.
• Suspended accounts are rejected at login.