> ## Documentation Index
> Fetch the complete documentation index at: https://docs.theauth.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Add an OAuth Provider

> theauth-go ships 12 built-in OAuth/OIDC providers.

theauth-go ships 12 built-in OAuth/OIDC providers. Each provider is a separate subpackage under `provider/`, so a consumer only pulls in the HTTP surface for the providers it actually wires.

## Install a provider

```bash theme={"dark"}
go get github.com/glincker/theauth-go/v2
```

All provider packages are included in the main module. No separate install is needed.

## Wire a provider

```go theme={"dark"}
import (
    "github.com/glincker/theauth-go/v2"
    "github.com/glincker/theauth-go/v2/provider/github"
    "github.com/glincker/theauth-go/v2/storage/postgres"
)

a, _ := theauth.New(theauth.Config{
    Storage: store,
    BaseURL: "https://myapp.com",
    Providers: []theauth.Provider{
        github.New(github.Config{
            ClientID:     os.Getenv("GITHUB_CLIENT_ID"),
            ClientSecret: os.Getenv("GITHUB_CLIENT_SECRET"),
        }),
    },
})
```

## Available providers

| Provider | Package |
| - | - |
| GitHub | `github.com/glincker/theauth-go/v2/provider/github` |
| Google | `github.com/glincker/theauth-go/v2/provider/google` |
| Microsoft | `github.com/glincker/theauth-go/v2/provider/microsoft` |
| Discord | `github.com/glincker/theauth-go/v2/provider/discord` |
| Apple | `github.com/glincker/theauth-go/v2/provider/apple` |
| Facebook | `github.com/glincker/theauth-go/v2/provider/facebook` |
| Slack | `github.com/glincker/theauth-go/v2/provider/slack` |
| GitLab | `github.com/glincker/theauth-go/v2/provider/gitlab` |
| Bitbucket | `github.com/glincker/theauth-go/v2/provider/bitbucket` |
| Twitch | `github.com/glincker/theauth-go/v2/provider/twitch` |
| LinkedIn | `github.com/glincker/theauth-go/v2/provider/linkedin` |
| X (Twitter) | `github.com/glincker/theauth-go/v2/provider/x` |

Each exposes a `Config` struct and a `New(Config) theauth.Provider` constructor. Each also ships its own runnable example under `examples/oauth-<provider>/` (see [Example Apps](/go/getting-started/example-apps)).

## Multiple providers at once

```go theme={"dark"}
a, _ := theauth.New(theauth.Config{
    Storage: store,
    BaseURL: "https://myapp.com",
    Providers: []theauth.Provider{
        github.New(github.Config{
            ClientID:     os.Getenv("GITHUB_CLIENT_ID"),
            ClientSecret: os.Getenv("GITHUB_CLIENT_SECRET"),
        }),
        google.New(google.Config{
            ClientID:     os.Getenv("GOOGLE_CLIENT_ID"),
            ClientSecret: os.Getenv("GOOGLE_CLIENT_SECRET"),
        }),
    },
})
```

See [`examples/oauth-multi-provider/`](https://github.com/glincker/theauth-go/tree/main/examples/oauth-multi-provider) for a full runnable example.

## Endpoints

When providers are configured, `a.Mount(r)` adds:

```
GET /auth/providers/{name}/start    -- redirect to provider
GET /auth/providers/{name}/callback -- consume code, issue session
```

Where `{name}` is any registered provider's `Name()`, e.g. `github`, `google`, `microsoft`, `discord`, `apple`, `facebook`, `slack`, `gitlab`, `bitbucket`, `twitch`, `linkedin`, or `x`.

## Provider tokens

Provider access tokens are encrypted with AES-256-GCM before storage. The `Config.EncryptionKey` (32-byte) is required if you want provider token storage. Without it, the OAuth state is stored as-is and provider tokens are not persisted.

## Custom provider

Implement the `theauth.Provider` interface:

```go theme={"dark"}
type Provider interface {
    // Name returns the stable registry key, e.g. "github". Routes mount as
    // /auth/providers/{name}/start and /auth/providers/{name}/callback.
    Name() string

    // AuthURL builds the absolute authorization URL. state and
    // codeChallenge are generated by the caller.
    AuthURL(state, codeChallenge, redirectURI string, scopes []string) string

    // ExchangeCode trades an authorization code (and PKCE verifier) for a
    // ProviderToken.
    ExchangeCode(ctx context.Context, code, codeVerifier, redirectURI string) (*ProviderToken, error)

    // UserInfo returns the canonical user profile for the supplied token.
    UserInfo(ctx context.Context, token *ProviderToken) (*ProviderUser, error)
}
```

Pass your implementation to `Config.Providers` alongside the built-in providers.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.