nevr-env

Appearance

Auth Namespace ​

The auth namespace provides authentication providers for popular auth libraries and services.

ts
import { auth } from "nevr-env/plugins";

Providers ​

ProviderDescription
auth.betterAuth()Better-Auth - Full-featured TypeScript auth library
auth.clerk()Clerk - Drop-in authentication UI
auth.auth0()Auth0 - Enterprise identity platform
auth.nextauth()NextAuth.js / Auth.js - Authentication for Next.js

Better-Auth ​

Full-featured TypeScript authentication library with OAuth, email/password, magic links, and 2FA.

Basic Usage ​

ts
import { createEnv } from "nevr-env";
import { auth } from "nevr-env/plugins";

const env = createEnv({
  plugins: [auth.betterAuth()],
  runtimeEnv: process.env,
});

// env.BETTER_AUTH_SECRET
// env.BETTER_AUTH_URL
// env.BETTER_AUTH_TRUSTED_ORIGINS (optional)

Options ​

OptionTypeDefaultDescription
providersOAuthProvider[][]OAuth providers to include
emailPasswordbooleanfalseInclude email/password authentication
magicLinkbooleanfalseInclude magic link configuration
twoFactorbooleanfalseInclude 2FA (TOTP) configuration
sessionbooleanfalseInclude session configuration
rateLimitbooleanfalseInclude rate limiting configuration
variableNamesobject-Custom variable names
extendobject-Extend schema with custom fields

Available OAuth Providers ​

ts
type OAuthProvider =
  | "google" | "github" | "discord" | "twitter" | "facebook"
  | "apple" | "microsoft" | "linkedin" | "spotify" | "twitch"
  | "slack" | "gitlab" | "bitbucket" | "dropbox" | "notion";

Environment Variables by Option ​

Default (no options) ​

VariableRequiredDescription
BETTER_AUTH_SECRET✅Secret key for signing tokens (min 32 chars)
BETTER_AUTH_URL✅Base URL of your application
BETTER_AUTH_TRUSTED_ORIGINS❌Comma-separated list of trusted origins

providers: ["google", "github"] ​

VariableRequiredDescription
GOOGLE_CLIENT_ID✅Google OAuth client ID
GOOGLE_CLIENT_SECRET✅Google OAuth client secret
GITHUB_CLIENT_ID✅GitHub OAuth client ID
GITHUB_CLIENT_SECRET✅GitHub OAuth client secret

emailPassword: true ​

VariableRequiredDefaultDescription
BETTER_AUTH_EMAIL_VERIFICATION❌"true"Require email verification
BETTER_AUTH_PASSWORD_MIN_LENGTH❌8Minimum password length
VariableRequiredDefaultDescription
BETTER_AUTH_MAGIC_LINK_EXPIRY❌300Magic link expiry in seconds

twoFactor: true ​

VariableRequiredDescription
BETTER_AUTH_2FA_ISSUER❌TOTP issuer name for authenticator apps

session: true ​

VariableRequiredDefaultDescription
BETTER_AUTH_SESSION_EXPIRY❌604800Session expiry in seconds (7 days)
BETTER_AUTH_SESSION_UPDATE_AGE❌86400Session update frequency (1 day)

rateLimit: true ​

VariableRequiredDefaultDescription
BETTER_AUTH_RATE_LIMIT_WINDOW❌60Rate limit window in seconds
BETTER_AUTH_RATE_LIMIT_MAX❌100Maximum requests per window

Examples ​

ts
// Full-featured setup
auth.betterAuth({
  providers: ["google", "github", "discord"],
  emailPassword: true,
  magicLink: true,
  twoFactor: true,
  session: true,
  rateLimit: true,
})

// Custom variable names
auth.betterAuth({
  variableNames: {
    secret: "AUTH_SECRET",
    url: "APP_URL",
  }
})

Clerk ​

Drop-in authentication UI with built-in user management.

Basic Usage ​

ts
const env = createEnv({
  plugins: [auth.clerk()],
  runtimeEnv: process.env,
});

// env.CLERK_PUBLISHABLE_KEY
// env.CLERK_SECRET_KEY

Options ​

OptionTypeDefaultDescription
jwtKeybooleanfalseInclude JWT verification key
webhookbooleanfalseInclude webhook secret
urlsbooleanfalseInclude sign-in/sign-up URLs
organizationbooleanfalseInclude organization settings
allowDevelopmentbooleantrue in devAllow test keys in production
variableNamesobject-Custom variable names
extendobject-Extend schema with custom fields

Environment Variables by Option ​

Default (no options) ​

VariableRequiredFormatDescription
CLERK_PUBLISHABLE_KEY✅pk_test_* or pk_live_*Publishable key for client-side
CLERK_SECRET_KEY✅sk_test_* or sk_live_*Secret key for server-side

jwtKey: true ​

VariableRequiredDescription
CLERK_JWT_KEY✅PEM-encoded public key for JWT verification

webhook: true ​

VariableRequiredFormatDescription
CLERK_WEBHOOK_SECRET✅whsec_*Webhook signing secret

urls: true ​

VariableRequiredDefaultDescription
CLERK_SIGN_IN_URL❌/sign-inSign-in page URL
CLERK_SIGN_UP_URL❌/sign-upSign-up page URL
CLERK_AFTER_SIGN_IN_URL❌/Redirect after sign-in
CLERK_AFTER_SIGN_UP_URL❌/Redirect after sign-up

organization: true ​

VariableRequiredDescription
CLERK_ORGANIZATION_ID❌Default organization ID
CLERK_ORGANIZATION_SLUG❌Default organization slug

Examples ​

ts
// With webhooks and URLs
auth.clerk({
  webhook: true,
  urls: true,
  organization: true,
})

// Production-only keys
auth.clerk({
  allowDevelopment: false,
})

Auth0 ​

Enterprise identity platform with social login and SSO.

Basic Usage ​

ts
const env = createEnv({
  plugins: [auth.auth0()],
  runtimeEnv: process.env,
});

// env.AUTH0_DOMAIN
// env.AUTH0_CLIENT_ID
// env.AUTH0_CLIENT_SECRET
// env.AUTH0_BASE_URL

Options ​

OptionTypeDefaultDescription
apibooleanfalseInclude API audience configuration
m2mbooleanfalseInclude M2M client credentials
managementbooleanfalseInclude Management API credentials
variableNamesobject-Custom variable names
extendobject-Extend schema with custom fields

Environment Variables by Option ​

Default (no options) ​

VariableRequiredFormatDescription
AUTH0_DOMAIN✅*.auth0.comAuth0 tenant domain
AUTH0_CLIENT_ID✅-Application client ID
AUTH0_CLIENT_SECRET✅-Application client secret
AUTH0_BASE_URL✅URLYour application base URL
AUTH0_ISSUER_BASE_URL❌URLAuth0 issuer URL

api: true ​

VariableRequiredDefaultDescription
AUTH0_AUDIENCE✅-API identifier/audience URL
AUTH0_SCOPE❌openid profile emailOAuth scopes

m2m: true ​

VariableRequiredDescription
AUTH0_M2M_CLIENT_ID✅M2M application client ID
AUTH0_M2M_CLIENT_SECRET✅M2M application client secret

management: true ​

VariableRequiredDescription
AUTH0_MGMT_CLIENT_ID✅Management API client ID
AUTH0_MGMT_CLIENT_SECRET✅Management API client secret

Examples ​

ts
// Full setup with API and Management
auth.auth0({
  api: true,
  management: true,
})

// M2M communication
auth.auth0({
  m2m: true,
})

NextAuth.js ​

Authentication for Next.js applications (Auth.js).

Basic Usage ​

ts
const env = createEnv({
  plugins: [auth.nextauth()],
  runtimeEnv: process.env,
});

// env.NEXTAUTH_SECRET
// env.NEXTAUTH_URL (optional)

Options ​

OptionTypeDefaultDescription
providersOAuthProvider[][]OAuth providers to include
databasebooleanfalseInclude database adapter config
emailbooleanfalseInclude email provider config
debugbooleanfalseInclude debug mode
variableNamesobject-Custom variable names
extendobject-Extend schema with custom fields

Environment Variables by Option ​

Default (no options) ​

VariableRequiredDescription
NEXTAUTH_SECRET✅Secret for token encryption (min 32 chars)
NEXTAUTH_URL❌Canonical URL (required in production)

providers: ["google", "github"] ​

VariableRequiredDescription
GOOGLE_CLIENT_ID✅Google OAuth client ID
GOOGLE_CLIENT_SECRET✅Google OAuth client secret
GITHUB_CLIENT_ID✅GitHub OAuth client ID
GITHUB_CLIENT_SECRET✅GitHub OAuth client secret

database: true ​

VariableRequiredDescription
DATABASE_URL✅Database connection URL for adapter

email: true ​

VariableRequiredDescription
EMAIL_SERVER✅SMTP connection string
EMAIL_FROM✅From email address

debug: true ​

VariableRequiredDefaultDescription
NEXTAUTH_DEBUG❌"false"Enable debug mode

Examples ​

ts
// With OAuth providers and database
auth.nextauth({
  providers: ["google", "github"],
  database: true,
})

// With email magic links
auth.nextauth({
  email: true,
})

Released under the MIT License.

Copyright © 2026 nevr-env contributors