API reference

The public surface of

@thunderid/better-auth, as documented in its reference pages.

functionthunderid()

Returns a typed GenericOAuthConfig for a ThunderID issuer.

Options

issuerrequired

string

ThunderID issuer URL, for example https://thunderid.example.com. A trailing slash is trimmed. The OIDC discovery URL is derived as {issuer}/.well-known/openid-configuration, so all endpoints come from the discovery document.

clientIdrequired

string

OAuth client ID.

clientSecretoptional

string

OAuth client secret. Omit for public clients using tokenEndpointAuth: {method: 'none'}.

scopesoptional

string[]

Requested scopes. Defaults to ['openid', 'profile', 'email'].

tokenEndpointAuthoptional

object

Token endpoint authentication method, for example {method: 'client_secret_post'}.

pkceoptional

boolean

Force PKCE on or off. Better Auth enables PKCE by default.

redirectURIoptional

string

Override the callback URL. It must still resolve to Better Auth's callback route for this provider, which ends in `/callback/thunderid`.

endSessionEndpointoptional

string

RP-initiated logout endpoint. Defaults to the discovery document.

postLogoutRedirectURIoptional

string

Where ThunderID returns the user after logout.

disableProviderLogoutoptional

boolean

Skip provider logout on sign-out. Defaults to false.

disableImplicitSignUpoptional

boolean

Require an explicit sign-up request before creating a user. Defaults to false.

disableSignUpoptional

boolean

Reject sign-in for users who do not already exist. Defaults to false.

overrideUserInfooptional

boolean

Refresh the stored user profile from ThunderID on every sign-in. Defaults to false.