Skip to content

Documentation

Set up Discord login

Zendha uses Auth.js with Discord OAuth 2.0. The client secret stays on the server. Accounts and sessions are stored in PostgreSQL. The browser only receives an HTTP-only session cookie.

1. Create a Discord application

  1. Open the Discord Developer Portal and create an application.
  2. Open OAuth2 and copy the Client ID and Client Secret.
  3. Add a redirect URL for every address you open in the browser:http://localhost:3000/api/auth/callback/discordhttp://192.168.1.4:3000/api/auth/callback/discord
  4. For a deployed site, add the same path on your public origin, for example https://your-domain/api/auth/callback/discord.

2. Add environment variables

Copy .env.example to .env.local. Generate AUTH_SECRET with a long random string. Restart the dev server after saving the file.

AUTH_SECRET=
AUTH_DISCORD_ID=
AUTH_DISCORD_SECRET=
DATABASE_URL=postgresql://USER:PASSWORD@HOST:5441/DATABASE
POSTGRES_URI=postgresql://USER:PASSWORD@HOST:5437/DATABASE

3. What the login requests

The authorization URL asks only for the identify scope. After you approve it, Auth.js validates the OAuth state and PKCE code verifier, then stores your Discord id, username, display name, and avatar in PostgreSQL. The session cookie is HTTP-only and SameSite=Lax. It is marked Secure when the site uses HTTPS.

Routes

  • / public landing page
  • /login Discord sign-in
  • /api/auth/* Auth.js endpoints, including the Discord callback
  • /dashboard protected workspace