What does it cost to self-host Google and Apple sign-in with Better Auth?
Asked by
MellowPine47
I'm using Better Auth for email registration, but I'd like to add one-click sign-in with Google and Apple to make registration and login easier. For Apple, do I need the paid Apple Developer Program membership, or is there any free alternative? For Google, is OAuth free for a normal application, and does the developer contact email shown in Google Cloud Console become visible to users during sign-in? I'm also unsure whether Apple exposes the developer's email address or handles everything through Apple's own authorization flow. If I self-host Better Auth, are there any ongoing provider costs or important setup details I should know about?
Answers
Self-hosting Better Auth means your application and auth logic run on your infrastructure, but Google and Apple still handle the identity-provider side. You can’t self-host those provider APIs. Use a reputable authentication library rather than implementing password hashing and account security yourself. Google sign-in usually has no meaningful cost, while Apple’s developer membership is the main unavoidable expense.
Reply to this answer
Apple has a couple of implementation details worth planning for. Its client secret is a JWT signed with a private .p8 key, and Apple limits that JWT’s lifetime to six months, so automate renewal before it expires. Also, Apple generally provides the user’s name only during the first authorization. Save it immediately, because later sign-ins may not include it again. The email identifier is available on subsequent sign-ins, including Apple’s private relay address when the user chooses to hide their real email.
Reply to this answer
Sign in with Apple requires an Apple Developer Program membership, which is currently about $99 per year. There isn’t really a free route for production Apple sign-in. Google OAuth is generally free for ordinary applications. The developer contact email in the consent-screen configuration is primarily for Google to contact you; users normally see your application name and the permissions being requested, not that private contact address. During development, you can keep the app in testing mode and allow only selected Google accounts.
Reply to this answer
The email login option doesn’t automatically become unsafe just because Better Auth is self-hosted. Keeping it is reasonable if you configure the library correctly, protect secrets, use HTTPS, verify email addresses where appropriate, and follow its recommended password-storage settings. Social sign-in can reduce friction, but it’s usually better to offer it alongside email rather than assuming every user wants to use Google or Apple.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions