> This page location: APIs & SDKs > CLI > Functions, storage and data > neon-auth
> Full Neon documentation index: https://neon.com/docs/llms.txt

> Summary: The Neon CLI `neon neon-auth` command manages Managed Better Auth on a database branch from the terminal. Use `enable`, `status`, and `disable` to provision, inspect, or remove Managed Better Auth, and the `oauth-provider` subcommands to add, update, or delete Google, GitHub, and Vercel OAuth providers. The `domain` subcommands manage trusted redirect domains, including `allow-localhost` settings for local development. The `config` subcommands cover email and password authentication, the email provider, the organization plugin, and webhooks, while `plugins` and `user` let you inspect plugin configurations and manage auth users.

# Neon CLI command: neon-auth

Manage Managed Better Auth from the CLI

The `neon-auth` command manages [Managed Better Auth](https://neon.com/docs/auth/overview) on a database branch from the terminal. You can enable or disable Managed Better Auth, configure OAuth providers, trusted domains, email settings, and webhooks, and manage auth users.

Subcommands: [config](https://neon.com/docs/cli/neon-auth#config), [disable](https://neon.com/docs/cli/neon-auth#disable), [domain](https://neon.com/docs/cli/neon-auth#domain), [enable](https://neon.com/docs/cli/neon-auth#enable), [oauth-provider](https://neon.com/docs/cli/neon-auth#oauth-provider), [plugins](https://neon.com/docs/cli/neon-auth#plugins), [status](https://neon.com/docs/cli/neon-auth#status), [user](https://neon.com/docs/cli/neon-auth#user)

If `--project-id` or `--branch` are omitted, the CLI resolves them from your [context file](https://neon.com/docs/cli/link), auto-selects when there is only one option, and otherwise asks you to pass the flag.

## Enable and status

### neon neon-auth enable

Provisions Managed Better Auth on the current branch.

```bash
neon neon-auth enable [options]
```

| Option            | Description                        | Type   | Default | Required |
| ----------------- | ---------------------------------- | ------ | ------- | :------: |
| `--database-name` | Database name to use for auth data | string | —       |    No    |
| `--branch`        | Branch ID or name                  | string | —       |    No    |
| `--project-id`    | Project ID                         | string | —       |    No    |

```bash
neon neon-auth enable
```

### neon neon-auth status

Shows whether Managed Better Auth is configured on the branch and displays the current connection details.

```bash
neon neon-auth status [options]
```

| Option         | Description       | Type   | Default | Required |
| -------------- | ----------------- | ------ | ------- | :------: |
| `--branch`     | Branch ID or name | string | —       |    No    |
| `--project-id` | Project ID        | string | —       |    No    |

```bash
neon neon-auth status
```

### neon neon-auth disable

Removes Managed Better Auth from the branch.

```bash
neon neon-auth disable [options]
```

| Option          | Description                                                        | Type    | Default | Required |
| --------------- | ------------------------------------------------------------------ | ------- | ------- | :------: |
| `--delete-data` | Permanently delete all Neon Auth data and schema from the database | boolean | `false` |    No    |
| `--branch`      | Branch ID or name                                                  | string  | —       |    No    |
| `--project-id`  | Project ID                                                         | string  | —       |    No    |

**Important:** The `--delete-data` option permanently deletes all Managed Better Auth data and schema from the database. This can't be undone.

Remove Managed Better Auth from the branch and delete its data:

```bash
neon neon-auth disable --delete-data
```

## OAuth providers

The `oauth-provider` subcommands manage the OAuth providers (`google`, `github`, and `vercel`) for the branch.

Subcommands: [add](https://neon.com/docs/cli/neon-auth#oauth-provider-add), [delete](https://neon.com/docs/cli/neon-auth#oauth-provider-delete), [list](https://neon.com/docs/cli/neon-auth#oauth-provider-list), [update](https://neon.com/docs/cli/neon-auth#oauth-provider-update)

### neon neon-auth oauth-provider list

Lists the OAuth providers configured for the branch.

```bash
neon neon-auth oauth-provider list [options]
```

| Option         | Description       | Type   | Default | Required |
| -------------- | ----------------- | ------ | ------- | :------: |
| `--branch`     | Branch ID or name | string | —       |    No    |
| `--project-id` | Project ID        | string | —       |    No    |

```bash
neon neon-auth oauth-provider list
```

### neon neon-auth oauth-provider add

Adds an OAuth provider.

```bash
neon neon-auth oauth-provider add [options]
```

| Option                  | Description                                                                      | Type   | Default | Required |
| ----------------------- | -------------------------------------------------------------------------------- | ------ | ------- | :------: |
| `--oauth-client-id`     | OAuth client ID from your provider app. Omit to use Neon's shared OAuth app.     | string | —       |    No    |
| `--oauth-client-secret` | OAuth client secret from your provider app. Omit to use Neon's shared OAuth app. | string | —       |    No    |
| `--provider-id`         | OAuth provider ID. Supported values: google, github, vercel                      | string | —       |    Yes   |
| `--branch`              | Branch ID or name                                                                | string | —       |    No    |
| `--project-id`          | Project ID                                                                       | string | —       |    No    |

Add the Google OAuth provider with your own credentials:

```bash
neon neon-auth oauth-provider add --provider-id google --oauth-client-id <client-id> --oauth-client-secret <client-secret>
```

### neon neon-auth oauth-provider update

Updates the credentials for an existing OAuth provider.

```bash
neon neon-auth oauth-provider update [options]
```

| Option                  | Description                                                                      | Type   | Default | Required |
| ----------------------- | -------------------------------------------------------------------------------- | ------ | ------- | :------: |
| `--oauth-client-id`     | OAuth client ID from your provider app. Omit to use Neon's shared OAuth app.     | string | —       |    No    |
| `--oauth-client-secret` | OAuth client secret from your provider app. Omit to use Neon's shared OAuth app. | string | —       |    No    |
| `--provider-id`         | OAuth provider ID. Supported values: google, github, vercel                      | string | —       |    Yes   |
| `--branch`              | Branch ID or name                                                                | string | —       |    No    |
| `--project-id`          | Project ID                                                                       | string | —       |    No    |

```bash
neon neon-auth oauth-provider update --provider-id github --oauth-client-id <client-id> --oauth-client-secret <client-secret>
```

### neon neon-auth oauth-provider delete

Deletes an OAuth provider from the branch.

```bash
neon neon-auth oauth-provider delete [options]
```

| Option          | Description                                                 | Type   | Default | Required |
| --------------- | ----------------------------------------------------------- | ------ | ------- | :------: |
| `--provider-id` | OAuth provider ID. Supported values: google, github, vercel | string | —       |    Yes   |
| `--branch`      | Branch ID or name                                           | string | —       |    No    |
| `--project-id`  | Project ID                                                  | string | —       |    No    |

```bash
neon neon-auth oauth-provider delete --provider-id vercel
```

## Domains

The `domain` subcommands manage the trusted domains that Managed Better Auth accepts as redirect URIs for the branch.

Subcommands: [add](https://neon.com/docs/cli/neon-auth#domain-add), [allow-localhost](https://neon.com/docs/cli/neon-auth#domain-allow-localhost), [delete](https://neon.com/docs/cli/neon-auth#domain-delete), [list](https://neon.com/docs/cli/neon-auth#domain-list)

### neon neon-auth domain list

Lists the trusted domains configured for the branch.

```bash
neon neon-auth domain list [options]
```

| Option         | Description       | Type   | Default | Required |
| -------------- | ----------------- | ------ | ------- | :------: |
| `--branch`     | Branch ID or name | string | —       |    No    |
| `--project-id` | Project ID        | string | —       |    No    |

```bash
neon neon-auth domain list
```

### neon neon-auth domain add

Adds a trusted domain.

```bash
neon neon-auth domain add <domain> [options]
```

| Option         | Description       | Type   | Default | Required |
| -------------- | ----------------- | ------ | ------- | :------: |
| `--branch`     | Branch ID or name | string | —       |    No    |
| `--project-id` | Project ID        | string | —       |    No    |

```bash
neon neon-auth domain add https://app.example.com
```

A trusted domain is an origin, so include the protocol (`https://`, or `http://` for local development) and omit any trailing slash. Use `https://app.example.com`, not `app.example.com` or `https://app.example.com/`. See [Configure trusted domains](https://neon.com/docs/auth/guides/configure-domains).

### neon neon-auth domain delete

Deletes a trusted domain.

```bash
neon neon-auth domain delete <domain> [options]
```

| Option         | Description       | Type   | Default | Required |
| -------------- | ----------------- | ------ | ------- | :------: |
| `--branch`     | Branch ID or name | string | —       |    No    |
| `--project-id` | Project ID        | string | —       |    No    |

```bash
neon neon-auth domain delete example.com
```

### neon neon-auth domain allow-localhost

Manages localhost connection settings for the branch.

Subcommands: [disable](https://neon.com/docs/cli/neon-auth#domain-allow-localhost-disable), [enable](https://neon.com/docs/cli/neon-auth#domain-allow-localhost-enable), [get](https://neon.com/docs/cli/neon-auth#domain-allow-localhost-get)

### neon neon-auth domain allow-localhost get

Gets the current localhost connection setting.

```bash
neon neon-auth domain allow-localhost get [options]
```

| Option         | Description       | Type   | Default | Required |
| -------------- | ----------------- | ------ | ------- | :------: |
| `--branch`     | Branch ID or name | string | —       |    No    |
| `--project-id` | Project ID        | string | —       |    No    |

```bash
neon neon-auth domain allow-localhost get
```

### neon neon-auth domain allow-localhost enable

Allows localhost connections for local development.

```bash
neon neon-auth domain allow-localhost enable [options]
```

| Option         | Description       | Type   | Default | Required |
| -------------- | ----------------- | ------ | ------- | :------: |
| `--branch`     | Branch ID or name | string | —       |    No    |
| `--project-id` | Project ID        | string | —       |    No    |

```bash
neon neon-auth domain allow-localhost enable
```

### neon neon-auth domain allow-localhost disable

Restricts localhost connections.

```bash
neon neon-auth domain allow-localhost disable [options]
```

| Option         | Description       | Type   | Default | Required |
| -------------- | ----------------- | ------ | ------- | :------: |
| `--branch`     | Branch ID or name | string | —       |    No    |
| `--project-id` | Project ID        | string | —       |    No    |

```bash
neon neon-auth domain allow-localhost disable
```

## Configuration

The `config` subcommands configure auth features for the branch: email and password authentication, the email provider, the organization plugin, and webhooks.

Subcommands: [email-password](https://neon.com/docs/cli/neon-auth#config-email-password), [email-provider](https://neon.com/docs/cli/neon-auth#config-email-provider), [organization](https://neon.com/docs/cli/neon-auth#config-organization), [webhook](https://neon.com/docs/cli/neon-auth#config-webhook)

### neon neon-auth config email-password

Manages email and password authentication settings.

Subcommands: [get](https://neon.com/docs/cli/neon-auth#config-email-password-get), [update](https://neon.com/docs/cli/neon-auth#config-email-password-update)

### neon neon-auth config email-password get

Gets the current email and password configuration.

```bash
neon neon-auth config email-password get [options]
```

| Option         | Description       | Type   | Default | Required |
| -------------- | ----------------- | ------ | ------- | :------: |
| `--branch`     | Branch ID or name | string | —       |    No    |
| `--project-id` | Project ID        | string | —       |    No    |

```bash
neon neon-auth config email-password get
```

### neon neon-auth config email-password update

Updates the email and password configuration.

```bash
neon neon-auth config email-password update [options]
```

| Option                                 | Description                                         | Type    | Default | Required |
| -------------------------------------- | --------------------------------------------------- | ------- | ------- | :------: |
| `--auto-sign-in-after-verification`    | Auto sign in users after verifying their email      | boolean | —       |    No    |
| `--disable-sign-up`                    | Disable new user sign ups                           | boolean | —       |    No    |
| `--email-verification-method`          | Email verification method                           | string  | —       |    No    |
| `--enabled`                            | Enable email and password authentication            | boolean | —       |    No    |
| `--require-email-verification`         | Require email verification before users can sign in | boolean | —       |    No    |
| `--send-verification-email-on-sign-in` | Send verification email on sign in                  | boolean | —       |    No    |
| `--send-verification-email-on-sign-up` | Send verification email on sign up                  | boolean | —       |    No    |
| `--branch`                             | Branch ID or name                                   | string  | —       |    No    |
| `--project-id`                         | Project ID                                          | string  | —       |    No    |

```bash
neon neon-auth config email-password update --enabled --require-email-verification
```

### neon neon-auth config email-provider

Manages the email provider configuration.

Subcommands: [get](https://neon.com/docs/cli/neon-auth#config-email-provider-get), [test](https://neon.com/docs/cli/neon-auth#config-email-provider-test), [update](https://neon.com/docs/cli/neon-auth#config-email-provider-update)

### neon neon-auth config email-provider get

Gets the current email provider configuration.

```bash
neon neon-auth config email-provider get [options]
```

| Option         | Description       | Type   | Default | Required |
| -------------- | ----------------- | ------ | ------- | :------: |
| `--branch`     | Branch ID or name | string | —       |    No    |
| `--project-id` | Project ID        | string | —       |    No    |

```bash
neon neon-auth config email-provider get
```

### neon neon-auth config email-provider update

Updates the email provider configuration.

```bash
neon neon-auth config email-provider update [options]
```

| Option           | Description                                               | Type   | Default | Required |
| ---------------- | --------------------------------------------------------- | ------ | ------- | :------: |
| `--host`         | SMTP host (required for standard)                         | string | —       |    No    |
| `--password`     | SMTP password (required for standard)                     | string | —       |    No    |
| `--port`         | SMTP port (required for standard)                         | number | —       |    No    |
| `--sender-email` | Sender email address                                      | string | —       |    No    |
| `--sender-name`  | Sender display name                                       | string | —       |    No    |
| `--type`         | Email provider type Possible values: `standard`, `shared` | string | —       |    Yes   |
| `--username`     | SMTP username (required for standard)                     | string | —       |    No    |
| `--branch`       | Branch ID or name                                         | string | —       |    No    |
| `--project-id`   | Project ID                                                | string | —       |    No    |

Configure the `standard` email provider type with your own SMTP server:

```bash
neon neon-auth config email-provider update --type standard --host smtp.example.com --port 587 --username example_username --password AbC123dEf --sender-email noreply@example.com --sender-name "Example App"
```

### neon neon-auth config email-provider test

Sends a test email through your saved SMTP provider so you can verify it works. Configure the provider first with [`update`](https://neon.com/docs/cli/neon-auth#config-email-provider-update).

```bash
neon neon-auth config email-provider test [options]
```

| Option              | Description                                  | Type   | Default | Required |
| ------------------- | -------------------------------------------- | ------ | ------- | :------: |
| `--recipient-email` | Email address to deliver the test message to | string | —       |    Yes   |
| `--branch`          | Branch ID or name                            | string | —       |    No    |
| `--project-id`      | Project ID                                   | string | —       |    No    |

```bash
neon neon-auth config email-provider test --recipient-email user@example.com
```

### neon neon-auth config organization

Manages organization plugin settings.

Subcommands: [get](https://neon.com/docs/cli/neon-auth#config-organization-get), [update](https://neon.com/docs/cli/neon-auth#config-organization-update)

### neon neon-auth config organization get

Gets the current organization plugin configuration.

```bash
neon neon-auth config organization get [options]
```

| Option         | Description       | Type   | Default | Required |
| -------------- | ----------------- | ------ | ------- | :------: |
| `--branch`     | Branch ID or name | string | —       |    No    |
| `--project-id` | Project ID        | string | —       |    No    |

```bash
neon neon-auth config organization get
```

### neon neon-auth config organization update

Updates the organization plugin configuration.

```bash
neon neon-auth config organization update [options]
```

| Option           | Description                                                             | Type    | Default | Required |
| ---------------- | ----------------------------------------------------------------------- | ------- | ------- | :------: |
| `--creator-role` | Role assigned to organization creator Possible values: `admin`, `owner` | string  | —       |    No    |
| `--enabled`      | Enable the organization plugin                                          | boolean | —       |    No    |
| `--limit`        | Maximum number of organizations a user can create                       | number  | —       |    No    |
| `--branch`       | Branch ID or name                                                       | string  | —       |    No    |
| `--project-id`   | Project ID                                                              | string  | —       |    No    |

```bash
neon neon-auth config organization update --enabled --limit 5 --creator-role owner
```

### neon neon-auth config webhook

Manages webhook configuration.

Subcommands: [get](https://neon.com/docs/cli/neon-auth#config-webhook-get), [update](https://neon.com/docs/cli/neon-auth#config-webhook-update)

### neon neon-auth config webhook get

Gets the current webhook configuration.

```bash
neon neon-auth config webhook get [options]
```

| Option         | Description       | Type   | Default | Required |
| -------------- | ----------------- | ------ | ------- | :------: |
| `--branch`     | Branch ID or name | string | —       |    No    |
| `--project-id` | Project ID        | string | —       |    No    |

```bash
neon neon-auth config webhook get
```

### neon neon-auth config webhook update

Updates the webhook configuration.

```bash
neon neon-auth config webhook update [options]
```

| Option             | Description                                                                                           | Type    | Default | Required |
| ------------------ | ----------------------------------------------------------------------------------------------------- | ------- | ------- | :------: |
| `--enabled`        | Enable webhooks                                                                                       | boolean | —       |    Yes   |
| `--enabled-events` | Events to enable Possible values: `user.before_create`, `user.created`, `send.otp`, `send.magic_link` | string  | —       |    No    |
| `--timeout`        | Webhook timeout in seconds (1-10)                                                                     | number  | —       |    No    |
| `--url`            | Webhook endpoint URL                                                                                  | string  | —       |    No    |
| `--branch`         | Branch ID or name                                                                                     | string  | —       |    No    |
| `--project-id`     | Project ID                                                                                            | string  | —       |    No    |

```bash
neon neon-auth config webhook update --enabled --url https://example.com/webhooks/neon-auth --enabled-events user.created --timeout 5
```

## Plugins

The `plugins` subcommands show the Managed Better Auth plugin configurations for the branch.

Subcommands: [get](https://neon.com/docs/cli/neon-auth#plugins-get), [list](https://neon.com/docs/cli/neon-auth#plugins-list)

### neon neon-auth plugins list

Lists all plugin configurations.

```bash
neon neon-auth plugins list [options]
```

| Option         | Description       | Type   | Default | Required |
| -------------- | ----------------- | ------ | ------- | :------: |
| `--branch`     | Branch ID or name | string | —       |    No    |
| `--project-id` | Project ID        | string | —       |    No    |

```bash
neon neon-auth plugins list
```

### neon neon-auth plugins get

Gets a specific plugin configuration.

```bash
neon neon-auth plugins get <plugin-name> [options]
```

| Option         | Description       | Type   | Default | Required |
| -------------- | ----------------- | ------ | ------- | :------: |
| `--branch`     | Branch ID or name | string | —       |    No    |
| `--project-id` | Project ID        | string | —       |    No    |

```bash
neon neon-auth plugins get organization
```

## Users

The `user` subcommands manage Managed Better Auth users on the branch.

Subcommands: [create](https://neon.com/docs/cli/neon-auth#user-create), [delete](https://neon.com/docs/cli/neon-auth#user-delete), [set-role](https://neon.com/docs/cli/neon-auth#user-set-role)

### neon neon-auth user create

Creates an auth user.

```bash
neon neon-auth user create [options]
```

| Option         | Description                                           | Type   | Default | Required |
| -------------- | ----------------------------------------------------- | ------ | ------- | :------: |
| `--email`      | User email address                                    | string | —       |    Yes   |
| `--name`       | User display name (defaults to email if not provided) | string | —       |    No    |
| `--branch`     | Branch ID or name                                     | string | —       |    No    |
| `--project-id` | Project ID                                            | string | —       |    No    |

```bash
neon neon-auth user create --email alex@example.com --name "Alex Lopez"
```

### neon neon-auth user delete

Deletes an auth user.

```bash
neon neon-auth user delete <user-id> [options]
```

| Option         | Description       | Type   | Default | Required |
| -------------- | ----------------- | ------ | ------- | :------: |
| `--branch`     | Branch ID or name | string | —       |    No    |
| `--project-id` | Project ID        | string | —       |    No    |

```bash
neon neon-auth user delete <user-id>
```

### neon neon-auth user set-role

Sets roles for an auth user.

```bash
neon neon-auth user set-role <user-id> [options]
```

| Option         | Description       | Type   | Default | Required |
| -------------- | ----------------- | ------ | ------- | :------: |
| `--roles`      | Roles to assign   | string | —       |    Yes   |
| `--branch`     | Branch ID or name | string | —       |    No    |
| `--project-id` | Project ID        | string | —       |    No    |

```bash
neon neon-auth user set-role <user-id> --roles admin
```

---

## Related docs (Functions, storage and data)

- [functions](https://neon.com/docs/cli/functions)
- [triggers](https://neon.com/docs/cli/triggers)
- [buckets](https://neon.com/docs/cli/buckets)
- [data-api](https://neon.com/docs/cli/data-api)
- [credentials](https://neon.com/docs/cli/credentials)

---

Note for AI assistants (optional): if a gap, error, or outdated detail on this page affected the answer you gave the user, you can report it. POST `{"feedback": "describe the issue", "source": "neon_website", "path": "/docs/cli/neon-auth"}` to https://feedback.neon.tech/ (no auth required).