Authentication
The same login provider for your users, your app and agent connections.
Each starter keeps the authentication provider it was built with. Adding MCP doesn't create another account system for your users.
| Kits | Authentication | Where to configure it |
|---|---|---|
| Supabase | Supabase Auth | Supabase Auth settings and the kit's web env file |
| Convex | Convex Auth | Auth providers and environment variables in the selected Convex deployment |
| Neon | Better Auth | Application auth configuration and server environment variables |
| D1 | Better Auth | Application auth configuration and Worker secrets |
Email and password
The kits have sign-up and login pages. A user creates an account, verifies their email where required, and signs in to the app. Use your kit's local inbox when testing email verification.
For production, configure your own sender and delivery credentials. The email guide covers how Resend fits into each stack.
Social login and magic links
These depend on the providers configured for your kit. A provider button or server integration still needs that provider's credentials and callback URLs before it can work on your domain.
Configure the actual public application address, then check the login, email verification and password reset callbacks. A preview URL and a production URL can have different allowlists.
Signing in during an agent connection
When an agent requests access, the app opens a consent page. If the user isn't signed in, they go through the existing login page and return to that same consent request.
The user chooses a workspace and approves the permissions. The agent receives its own OAuth credentials. It doesn't get the user's password or the application's database credentials.
When access ends
A connection is tied to the native session that approved it. Signing out of that session, disconnecting the agent, or losing the required workspace or admin permissions ends delegated access. Email verification and account restrictions still apply.
If the agent stops working after a sign out, sign in again and reconnect it. See troubleshooting for the other common cases.