features:
  database: true  # Required
  auth: true

env_schema:
  - name: AUTH_SECRET
    type: string
    required: true
    secret: true
    description: "Session signing secret (32+ chars)"

runtm secrets set AUTH_SECRET=$(openssl rand -base64 32)

runtm deploy

'use client';

import { useSession, signIn, signOut } from '@/lib/auth-client';

export function AuthStatus() {
  const { data: session, status } = useSession();

  if (status === 'loading') {
    return <span>Loading...</span>;
  }

  if (!session) {
    return (
      <button onClick={() => signIn()}>
        Sign In
      </button>
    );
  }

  return (
    <div>
      <span>Welcome, {session.user.email}</span>
      <button onClick={() => signOut()}>
        Sign Out
      </button>
    </div>
  );
}

// app/dashboard/page.tsx
import { AuthGuard } from '@/components/auth/AuthGuard';
import { Dashboard } from '@/components/Dashboard';

export default function DashboardPage() {
  return (
    <AuthGuard>
      <Dashboard />
    </AuthGuard>
  );
}

import { LoginForm } from '@/components/auth/LoginForm';

export default function LoginPage() {
  return (
    <div className="max-w-md mx-auto mt-20">
      <h1 className="text-2xl font-bold mb-6">Sign In</h1>
      <LoginForm />
    </div>
  );
}

# backend/app/api/v1/me.py
from fastapi import APIRouter, Depends, HTTPException
from app.core.auth import get_current_user

router = APIRouter()

@router.get("/me")
async def get_me(user = Depends(get_current_user)):
    if not user:
        raise HTTPException(status_code=401, detail="Not authenticated")
    return user

from fastapi import Depends
from app.core.auth import require_auth

@router.get("/protected")
async def protected_route(user = Depends(require_auth)):
    return {"message": f"Hello, {user['email']}"}

// frontend/lib/auth.ts
import { betterAuth } from 'better-auth';

export const auth = betterAuth({
  // ... base config
  socialProviders: {
    google: {
      clientId: process.env.GOOGLE_CLIENT_ID!,
      clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
    },
    github: {
      clientId: process.env.GITHUB_CLIENT_ID!,
      clientSecret: process.env.GITHUB_CLIENT_SECRET!,
    },
  },
});

env_schema:
  - name: AUTH_SECRET
    type: string
    required: true
    secret: true
  - name: GOOGLE_CLIENT_ID
    type: string
    required: false
  - name: GOOGLE_CLIENT_SECRET
    type: string
    required: false
    secret: true

// app/login/page.tsx
export default function CustomLoginPage() {
  return (
    <div className="min-h-screen flex items-center justify-center bg-gray-100">
      <div className="bg-white p-8 rounded-lg shadow-md w-full max-w-md">
        <h1 className="text-2xl font-bold text-center mb-6">
          Welcome Back
        </h1>
        <LoginForm 
          redirectTo="/dashboard"
          showSignup={true}
        />
      </div>
    </div>
  );
}

<LoginForm redirectTo="/dashboard" />