Credentials and Google Providers

1. Create an OAuth client in Google Cloud Console (APIs and Services → Credentials).
2. Authorized redirect URI: http://localhost:3000/api/auth/callback/google (and your production domain).
3. Put the id and secret in .env.local.

AUTH_SECRET=generated-by-npx-auth-secret
AUTH_GOOGLE_ID=1234567890-abc.apps.googleusercontent.com
AUTH_GOOGLE_SECRET=GOCSPX-xxxxxxxx

// components/GoogleButton.tsx (server component with a form action)
import { signIn } from '@/auth';

export default function GoogleButton() {
  return (
    <form
      action={async () => {
        'use server';
        await signIn('google', { redirectTo: '/account' });
      }}
    >
      <button type="submit">Continue with Google</button>
    </form>
  );
}

The Credentials provider lets you check an email and password against your own database. Store only a password hash (bcrypt or argon2).

// auth.ts
import NextAuth from 'next-auth';
import Credentials from 'next-auth/providers/credentials';
import Google from 'next-auth/providers/google';
import bcrypt from 'bcryptjs';
import { z } from 'zod';
import { prisma } from '@/lib/prisma';

const LoginSchema = z.object({ email: z.string().email(), password: z.string().min(8) });

export const { handlers, auth, signIn, signOut } = NextAuth({
  session: { strategy: 'jwt' },
  providers: [
    Google,
    Credentials({
      credentials: { email: {}, password: {} },
      authorize: async (raw) => {
        const parsed = LoginSchema.safeParse(raw);
        if (!parsed.success) return null;
        const user = await prisma.user.findUnique({ where: { email: parsed.data.email } });
        if (!user?.passwordHash) return null;
        const ok = await bcrypt.compare(parsed.data.password, user.passwordHash);
        return ok ? { id: user.id, name: user.name, email: user.email, role: user.role } : null;
      },
    }),
  ],
});