Sign-in with OAuth and OpenID Connect: Production checklist

Production checklist

Production checklist in the Sign-in with OAuth and OpenID Connect guide.

For agentsUpdated 2026-10-20

Secrets in the environment, never in the repository; the session secret is 32 characters or more.
security.allowedHosts set, and your proxy sets the forwarded host and protocol itself, so event.url.origin (used for returnTo) is the public origin.
The redirect URI and post-logout URI registered at the provider are exactly the ones in the code.
A rate limiter on the login and callback routes, as above; a shared RateLimitStore when you run several processes.
A shared SessionStore for several processes. The sign-in state lives in the session, so a visitor must reach the same store at the callback.
Do not log full callback URLs: they carry a one-use code and state.
Tell users to sign out with the button, and keep logout a POST.
Consider a lower absoluteTimeoutSeconds for the session when the provider's grants are short.