Authentication
Which auth setup to use for internal and public-facing apps.
Which auth setup you use depends on who logs in.
| App type | Who logs in | Auth setup |
|---|---|---|
| Internal user software | Members, volunteers, staff | Keycloak + NextAuth |
| Public-facing apps | The general public | NextAuth |
Never build your own authentication: no hand-rolled password storage, sessions or JWT handling. Always use the setups above.
Internal software: Keycloak + NextAuth
Keycloak is our central identity provider for internal users, so members sign in with one account everywhere. Your app talks to Keycloak over OpenID Connect through NextAuth's Keycloak provider.
- One Keycloak client per app (and per environment).
- Manage roles and groups in Keycloak, not in your app's database.
- Your app gets its client ID, client secret and issuer URL from environment variables:
AUTH_SECRET=
AUTH_KEYCLOAK_ID=
AUTH_KEYCLOAK_SECRET=
AUTH_KEYCLOAK_ISSUER=To get a Keycloak client for your app, submit a service access request.
Public-facing apps: NextAuth
Public users don't get Keycloak accounts. Use NextAuth with the providers the app needs (e.g. email magic links or OAuth providers), and store users in the app's own PostgreSQL database through the Drizzle adapter.