I'm using Better Auth for email registration, but I'd like to make sign-up and login easier by adding one-click Google and Apple sign-in. Is Apple's developer membership, which costs about $99 per year, required for Sign in with Apple, or is there any free alternative? For Google, I understand the service is generally free, but I'm unsure whether the developer contact email from the OAuth setup is shown to users during authorization. Does Apple expose a similar email, or can it provide a private relay address instead? I'm also interested in the practical experience of self-hosting this setup, including any recurring costs, configuration issues, and whether using Better Auth is a safe approach for email and social login.
3 Answers
Apple can provide a private relay address when users choose to hide their email, so your application may receive an Apple-generated forwarding address rather than the person’s real one. Be careful with Apple’s implementation details too: the client secret is a JWT signed with a private key and it expires after at most six months, so rotation should be automated. Also, Apple only sends the user’s full name during the first authorization. Save it immediately because later logins may not include it.
Self-hosting Better Auth doesn’t mean you can self-host Google or Apple’s identity services. Your application and auth database can run on your own infrastructure, but the OAuth requests still communicate with Google and Apple. Better Auth can handle the security-sensitive parts of sessions, password hashing, callbacks, and provider integration, which is much safer than inventing your own authentication system. Email login isn’t inherently unsafe when it’s implemented by a reputable, maintained library; just follow its password, session, verification, reset-token, and rate-limiting guidance.
Sign in with Apple requires an Apple Developer Program membership, which is currently about $99 per year. There isn’t a normal free path around that requirement. Apple also requires your website and authentication setup to be configured before it will approve the flow. Google OAuth generally has no cost for ordinary applications. The email you enter as the developer contact is for Google to reach you and isn’t normally displayed as part of the user authorization screen; users typically see your app name and the permissions being requested.
So using a personal email as the Google developer contact usually isn’t a privacy problem, since it’s separate from the account information shown to users. Apple’s developer membership and contact details are handled through Apple’s developer setup instead.
For a small project, Google is usually the simplest low-cost provider to start with. The main ongoing work is keeping redirect URLs, secrets, callback handling, and provider credentials configured correctly rather than paying a per-login fee.