Can I share client API routes across subdomains?

Nnainglinnkhant I have a monorepo setup and trying to use one app's API routes from another app....

B

bekacru•2/14/25, 5:13 AM

remove

no-cors

no-cors

no-cors

no-cors. it should work just make sure to configure your server for cors. Make sure not to use wild card origins and to enabled credentials

Bbekacru remove `no-cors`. it should work just make sure to configure your server for cor...

N

nainglinnkhantOP•2/14/25, 9:03 AM

When I remove

no-cors

no-cors

no-cors

no-cors, I get the cors error as below:

Access to fetch at 'http://localhost:3001/api/auth/sign-in/social' from origin 'http://localhost:3002' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

Access to fetch at 'http://localhost:3001/api/auth/sign-in/social' from origin 'http://localhost:3002' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

Access to fetch at 'http://localhost:3001/api/auth/sign-in/social' from origin 'http://localhost:3002' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

Access to fetch at 'http://localhost:3001/api/auth/sign-in/social' from origin 'http://localhost:3002' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

My server config is as below. Do I need to add or change anything to make it work?

export const auth = betterAuth({
  database: drizzleAdapter(db, {
    provider: "pg",
    usePlural: true,
  }),
  user: {
    changeEmail: {
      enabled: true,
      sendChangeEmailVerification,
    },
  },
  advanced: {
    generateId: false,
  },
  trustedOrigins: [env.NEXT_PUBLIC_WEB_URL, env.NEXT_PUBLIC_ADMIN_URL],
  socialProviders: {
    google: {
      clientId: env.GOOGLE_CLIENT_ID,
      clientSecret: env.GOOGLE_CLIENT_SECRET,
    },
    github: {
      clientId: env.GITHUB_CLIENT_ID,
      clientSecret: env.GITHUB_CLIENT_SECRET,
    },
  },
  databaseHooks: {
    user: {
      create: {
        after: afterUserCreated,
      },
    },
    session: {
      create: {
        before: beforeSessionCreated,
      },
    },
  },
  plugins: [
    nextCookies(),
    organization({
      sendInvitationEmail,
    }),
    admin(),
    magicLink({
      sendMagicLink,
    }),
    oAuthProxy(),
    customSession(customizeSession),
  ],
});

export const auth = betterAuth({
  database: drizzleAdapter(db, {
    provider: "pg",
    usePlural: true,
  }),
  user: {
    changeEmail: {
      enabled: true,
      sendChangeEmailVerification,
    },
  },
  advanced: {
    generateId: false,
  },
  trustedOrigins: [env.NEXT_PUBLIC_WEB_URL, env.NEXT_PUBLIC_ADMIN_URL],
  socialProviders: {
    google: {
      clientId: env.GOOGLE_CLIENT_ID,
      clientSecret: env.GOOGLE_CLIENT_SECRET,
    },
    github: {
      clientId: env.GITHUB_CLIENT_ID,
      clientSecret: env.GITHUB_CLIENT_SECRET,
    },
  },
  databaseHooks: {
    user: {
      create: {
        after: afterUserCreated,
      },
    },
    session: {
      create: {
        before: beforeSessionCreated,
      },
    },
  },
  plugins: [
    nextCookies(),
    organization({
      sendInvitationEmail,
    }),
    admin(),
    magicLink({
      sendMagicLink,
    }),
    oAuthProxy(),
    customSession(customizeSession),
  ],
});

export const auth = betterAuth({
  database: drizzleAdapter(db, {
    provider: "pg",
    usePlural: true,
  }),
  user: {
    changeEmail: {
      enabled: true,
      sendChangeEmailVerification,
    },
  },
  advanced: {
    generateId: false,
  },
  trustedOrigins: [env.NEXT_PUBLIC_WEB_URL, env.NEXT_PUBLIC_ADMIN_URL],
  socialProviders: {
    google: {
      clientId: env.GOOGLE_CLIENT_ID,
      clientSecret: env.GOOGLE_CLIENT_SECRET,
    },
    github: {
      clientId: env.GITHUB_CLIENT_ID,
      clientSecret: env.GITHUB_CLIENT_SECRET,
    },
  },
  databaseHooks: {
    user: {
      create: {
        after: afterUserCreated,
      },
    },
    session: {
      create: {
        before: beforeSessionCreated,
      },
    },
  },
  plugins: [
    nextCookies(),
    organization({
      sendInvitationEmail,
    }),
    admin(),
    magicLink({
      sendMagicLink,
    }),
    oAuthProxy(),
    customSession(customizeSession),
  ],
});

export const auth = betterAuth({
  database: drizzleAdapter(db, {
    provider: "pg",
    usePlural: true,
  }),
  user: {
    changeEmail: {
      enabled: true,
      sendChangeEmailVerification,
    },
  },
  advanced: {
    generateId: false,
  },
  trustedOrigins: [env.NEXT_PUBLIC_WEB_URL, env.NEXT_PUBLIC_ADMIN_URL],
  socialProviders: {
    google: {
      clientId: env.GOOGLE_CLIENT_ID,
      clientSecret: env.GOOGLE_CLIENT_SECRET,
    },
    github: {
      clientId: env.GITHUB_CLIENT_ID,
      clientSecret: env.GITHUB_CLIENT_SECRET,
    },
  },
  databaseHooks: {
    user: {
      create: {
        after: afterUserCreated,
      },
    },
    session: {
      create: {
        before: beforeSessionCreated,
      },
    },
  },
  plugins: [
    nextCookies(),
    organization({
      sendInvitationEmail,
    }),
    admin(),
    magicLink({
      sendMagicLink,
    }),
    oAuthProxy(),
    customSession(customizeSession),
  ],
});

Nnainglinnkhant When I remove `no-cors`, I get the cors error as below: ```typescript Access to...

N

nainglinnkhantOP•2/15/25, 2:13 PM

@bekacru could you please check this? : )

Nnainglinnkhant @bekacru could you please check this? : )

B

bekacru•2/15/25, 2:26 PM

share your cors config

Bbekacru share your cors config

N

nainglinnkhantOP•2/15/25, 2:33 PM

you mean

crossSubDomainCookies

crossSubDomainCookies

crossSubDomainCookies

crossSubDomainCookies? If you mean other cors config, could you please tell me how to configure?

Nnainglinnkhant you mean `crossSubDomainCookies`? If you mean other cors config, could you pleas...

B

bekacru•2/15/25, 2:38 PM

what framework are you using?

Bbekacru what framework are you using?

N

nainglinnkhantOP•2/15/25, 2:39 PM

I'm using nextjs 15

N

nainglinnkhantOP•2/15/25, 7:39 PM

@bekacru It worked after manually modifying the header of GET and POST route handlers. But for social sign-ins, it still redirects to the original baseURL (for example, I call the localhost:3001's API route from localhost:3002 and after sign-in is successful, it redirects to the localhost:3001 instead of localhost:3002). I get that it's the expected behavior. But is there any way to change it? I tried setting callbackURL like below but doesn't work.

await signIn.social({
  provider: "github",
  callbackURL: "http://localhost:3002",
});

await signIn.social({
  provider: "github",
  callbackURL: "http://localhost:3002",
});

await signIn.social({
  provider: "github",
  callbackURL: "http://localhost:3002",
});

await signIn.social({
  provider: "github",
  callbackURL: "http://localhost:3002",
});

Nnainglinnkhant @bekacru It worked after manually modifying the header of GET and POST route han...

B

bekacru•2/15/25, 7:49 PM

this should work. Make sure it's in a trusted origin.

Bbekacru this should work. Make sure it's in a trusted origin.

N

nainglinnkhantOP•2/15/25, 7:52 PM

export const auth = betterAuth({
  database: drizzleAdapter(db, {
    provider: "pg",
    usePlural: true,
  }),
  user: {
    changeEmail: {
      enabled: true,
      sendChangeEmailVerification,
    },
  },
  advanced: {
    generateId: false,
  },
  trustedOrigins: [env.NEXT_PUBLIC_WEB_URL, env.NEXT_PUBLIC_ADMIN_URL],
  socialProviders: {
    google: {
      clientId: env.GOOGLE_CLIENT_ID,
      clientSecret: env.GOOGLE_CLIENT_SECRET,
    },
    github: {
      clientId: env.GITHUB_CLIENT_ID,
      clientSecret: env.GITHUB_CLIENT_SECRET,
    },
  },
  databaseHooks: {
    user: {
      create: {
        after: afterUserCreated,
      },
    },
    session: {
      create: {
        before: beforeSessionCreated,
      },
    },
  },
  plugins: [
    nextCookies(),
    organization({
      sendInvitationEmail,
    }),
    admin(),
    magicLink({
      sendMagicLink,
    }),
    oAuthProxy(),
    customSession(customizeSession),
  ],
});

export const auth = betterAuth({
  database: drizzleAdapter(db, {
    provider: "pg",
    usePlural: true,
  }),
  user: {
    changeEmail: {
      enabled: true,
      sendChangeEmailVerification,
    },
  },
  advanced: {
    generateId: false,
  },
  trustedOrigins: [env.NEXT_PUBLIC_WEB_URL, env.NEXT_PUBLIC_ADMIN_URL],
  socialProviders: {
    google: {
      clientId: env.GOOGLE_CLIENT_ID,
      clientSecret: env.GOOGLE_CLIENT_SECRET,
    },
    github: {
      clientId: env.GITHUB_CLIENT_ID,
      clientSecret: env.GITHUB_CLIENT_SECRET,
    },
  },
  databaseHooks: {
    user: {
      create: {
        after: afterUserCreated,
      },
    },
    session: {
      create: {
        before: beforeSessionCreated,
      },
    },
  },
  plugins: [
    nextCookies(),
    organization({
      sendInvitationEmail,
    }),
    admin(),
    magicLink({
      sendMagicLink,
    }),
    oAuthProxy(),
    customSession(customizeSession),
  ],
});

export const auth = betterAuth({
  database: drizzleAdapter(db, {
    provider: "pg",
    usePlural: true,
  }),
  user: {
    changeEmail: {
      enabled: true,
      sendChangeEmailVerification,
    },
  },
  advanced: {
    generateId: false,
  },
  trustedOrigins: [env.NEXT_PUBLIC_WEB_URL, env.NEXT_PUBLIC_ADMIN_URL],
  socialProviders: {
    google: {
      clientId: env.GOOGLE_CLIENT_ID,
      clientSecret: env.GOOGLE_CLIENT_SECRET,
    },
    github: {
      clientId: env.GITHUB_CLIENT_ID,
      clientSecret: env.GITHUB_CLIENT_SECRET,
    },
  },
  databaseHooks: {
    user: {
      create: {
        after: afterUserCreated,
      },
    },
    session: {
      create: {
        before: beforeSessionCreated,
      },
    },
  },
  plugins: [
    nextCookies(),
    organization({
      sendInvitationEmail,
    }),
    admin(),
    magicLink({
      sendMagicLink,
    }),
    oAuthProxy(),
    customSession(customizeSession),
  ],
});

export const auth = betterAuth({
  database: drizzleAdapter(db, {
    provider: "pg",
    usePlural: true,
  }),
  user: {
    changeEmail: {
      enabled: true,
      sendChangeEmailVerification,
    },
  },
  advanced: {
    generateId: false,
  },
  trustedOrigins: [env.NEXT_PUBLIC_WEB_URL, env.NEXT_PUBLIC_ADMIN_URL],
  socialProviders: {
    google: {
      clientId: env.GOOGLE_CLIENT_ID,
      clientSecret: env.GOOGLE_CLIENT_SECRET,
    },
    github: {
      clientId: env.GITHUB_CLIENT_ID,
      clientSecret: env.GITHUB_CLIENT_SECRET,
    },
  },
  databaseHooks: {
    user: {
      create: {
        after: afterUserCreated,
      },
    },
    session: {
      create: {
        before: beforeSessionCreated,
      },
    },
  },
  plugins: [
    nextCookies(),
    organization({
      sendInvitationEmail,
    }),
    admin(),
    magicLink({
      sendMagicLink,
    }),
    oAuthProxy(),
    customSession(customizeSession),
  ],
});

my auth server config already has trustedOrigins configured

Nnainglinnkhant ```typescript export const auth = betterAuth({ database: drizzleAdapter(db, { ...

B

bekacru•2/15/25, 7:55 PM

so you have 2 differnt nextjs projects?

Bbekacru so you have 2 differnt nextjs projects?

N

nainglinnkhantOP•2/15/25, 7:56 PM

yes, my plan is to use one app's auth routes from another app

Nnainglinnkhant yes, my plan is to use one app's auth routes from another app

B

bekacru•2/15/25, 8:10 PM

im not sure why this is working. It should redirect back to callback url unless some error happens. In which case, you should specefic

errorCallbackURL

errorCallbackURL

errorCallbackURL

errorCallbackURL instead.

Bbekacru im not sure why this is working. It should redirect back to callback url unless ...

N

nainglinnkhantOP•2/18/25, 10:07 AM

I see, thanks for your time!

M

MarvinKR•4/27/25, 11:50 AM

I have a similar issue with VITE in localhost:5173 but Bun server (Hono) is in localhost:3000 ?

Can I share client API routes across subdomains?

Similar Threads

Similar Threads

Similar Threads