What does it cost to self-host Google and Apple sign-in with Better Auth?

The email login option doesn’t automatically become unsafe just because Better Auth is self-hosted. Keeping it is reasonable if you configure the library correctly, protect secrets, use HTTPS, verify email addresses where appropriate, and follow its recommended password-storage settings. Social sign-in can reduce friction, but it’s usually better to offer it alongside email rather than assuming every user wants to use Google or Apple.

Sign in with Apple requires an Apple Developer Program membership, which is currently about $99 per year. There isn’t really a free route for production Apple sign-in. Google OAuth is generally free for ordinary applications. The developer contact email in the consent-screen configuration is primarily for Google to contact you; users normally see your application name and the permissions being requested, not that private contact address. During development, you can keep the app in testing mode and allow only selected Google accounts.

Apple has a couple of implementation details worth planning for. Its client secret is a JWT signed with a private .p8 key, and Apple limits that JWT’s lifetime to six months, so automate renewal before it expires. Also, Apple generally provides the user’s name only during the first authorization. Save it immediately, because later sign-ins may not include it again. The email identifier is available on subsequent sign-ins, including Apple’s private relay address when the user chooses to hide their real email.

Self-hosting Better Auth means your application and auth logic run on your infrastructure, but Google and Apple still handle the identity-provider side. You can’t self-host those provider APIs. Use a reputable authentication library rather than implementing password hashing and account security yourself. Google sign-in usually has no meaningful cost, while Apple’s developer membership is the main unavoidable expense.