Neon is expanding into a backend: Object Storage, Functions, and AI Gateway now in beta
Neon
    Docs
    Log inSign up
    /APIs & SDKs/Functions, storage and data/neon-auth

    Neon CLI command: neon-auth

    Manage Managed Better Auth from the CLI

    The neon-auth command manages Managed Better Auth on a database branch from the terminal. You can enable or disable Managed Better Auth, configure OAuth providers, trusted domains, email settings, and webhooks, and manage auth users.

    Requires neon 2.23.0 or later. Check your version with neon --version.

    Subcommands: config, disable, domain, enable, oauth-provider, plugins, status, user

    If --project-id or --branch are omitted, the CLI resolves them from your context file, auto-selects when there is only one option, and prompts otherwise.

    Enable and status

    neon neon-auth enable

    Provisions Managed Better Auth on the current branch.

    neon neon-auth enable [options]
    OptionDescriptionTypeDefaultRequired
    --database-nameDatabase name to use for auth datastring—No
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No
    neon neon-auth enable

    neon neon-auth status

    Shows whether Managed Better Auth is configured on the branch and displays the current connection details.

    neon neon-auth status [options]
    OptionDescriptionTypeDefaultRequired
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No
    neon neon-auth status

    neon neon-auth disable

    Removes Managed Better Auth from the branch.

    neon neon-auth disable [options]
    OptionDescriptionTypeDefaultRequired
    --delete-dataPermanently delete all Neon Auth data and schema from the databasebooleanfalseNo
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No

    important

    The --delete-data option permanently deletes all Managed Better Auth data and schema from the database. This can't be undone.

    Remove Managed Better Auth from the branch and delete its data:

    neon neon-auth disable --delete-data

    OAuth providers

    The oauth-provider subcommands manage the OAuth providers (google, github, and vercel) for the branch.

    Subcommands: add, delete, list, update

    neon neon-auth oauth-provider list

    Lists the OAuth providers configured for the branch.

    neon neon-auth oauth-provider list [options]
    OptionDescriptionTypeDefaultRequired
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No
    neon neon-auth oauth-provider list

    neon neon-auth oauth-provider add

    Adds an OAuth provider.

    neon neon-auth oauth-provider add [options]
    OptionDescriptionTypeDefaultRequired
    --oauth-client-idOAuth client ID from your provider app. Omit to use Neon's shared OAuth app.string—No
    --oauth-client-secretOAuth client secret from your provider app. Omit to use Neon's shared OAuth app.string—No
    --provider-idOAuth provider ID. Supported values: google, github, vercelstring—Yes
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No

    Add the Google OAuth provider with your own credentials:

    neon neon-auth oauth-provider add --provider-id google --oauth-client-id <client-id> --oauth-client-secret <client-secret>

    neon neon-auth oauth-provider update

    Updates the credentials for an existing OAuth provider.

    neon neon-auth oauth-provider update [options]
    OptionDescriptionTypeDefaultRequired
    --oauth-client-idOAuth client ID from your provider app. Omit to use Neon's shared OAuth app.string—No
    --oauth-client-secretOAuth client secret from your provider app. Omit to use Neon's shared OAuth app.string—No
    --provider-idOAuth provider ID. Supported values: google, github, vercelstring—Yes
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No
    neon neon-auth oauth-provider update --provider-id github --oauth-client-id <client-id> --oauth-client-secret <client-secret>

    neon neon-auth oauth-provider delete

    Deletes an OAuth provider from the branch.

    neon neon-auth oauth-provider delete [options]
    OptionDescriptionTypeDefaultRequired
    --provider-idOAuth provider ID. Supported values: google, github, vercelstring—Yes
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No
    neon neon-auth oauth-provider delete --provider-id vercel

    Domains

    The domain subcommands manage the trusted domains that Managed Better Auth accepts as redirect URIs for the branch.

    Subcommands: add, allow-localhost, delete, list

    neon neon-auth domain list

    Lists the trusted domains configured for the branch.

    neon neon-auth domain list [options]
    OptionDescriptionTypeDefaultRequired
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No
    neon neon-auth domain list

    neon neon-auth domain add

    Adds a trusted domain.

    neon neon-auth domain add <domain> [options]
    OptionDescriptionTypeDefaultRequired
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No
    neon neon-auth domain add example.com

    neon neon-auth domain delete

    Deletes a trusted domain.

    neon neon-auth domain delete <domain> [options]
    OptionDescriptionTypeDefaultRequired
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No
    neon neon-auth domain delete example.com

    neon neon-auth domain allow-localhost

    Manages localhost connection settings for the branch.

    Subcommands: disable, enable, get

    neon neon-auth domain allow-localhost get

    Gets the current localhost connection setting.

    neon neon-auth domain allow-localhost get [options]
    OptionDescriptionTypeDefaultRequired
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No
    neon neon-auth domain allow-localhost get

    neon neon-auth domain allow-localhost enable

    Allows localhost connections for local development.

    neon neon-auth domain allow-localhost enable [options]
    OptionDescriptionTypeDefaultRequired
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No
    neon neon-auth domain allow-localhost enable

    neon neon-auth domain allow-localhost disable

    Restricts localhost connections.

    neon neon-auth domain allow-localhost disable [options]
    OptionDescriptionTypeDefaultRequired
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No
    neon neon-auth domain allow-localhost disable

    Configuration

    The config subcommands configure auth features for the branch: email and password authentication, the email provider, the organization plugin, and webhooks.

    Subcommands: email-password, email-provider, organization, webhook

    neon neon-auth config email-password

    Manages email and password authentication settings.

    Subcommands: get, update

    neon neon-auth config email-password get

    Gets the current email and password configuration.

    neon neon-auth config email-password get [options]
    OptionDescriptionTypeDefaultRequired
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No
    neon neon-auth config email-password get

    neon neon-auth config email-password update

    Updates the email and password configuration.

    neon neon-auth config email-password update [options]
    OptionDescriptionTypeDefaultRequired
    --auto-sign-in-after-verificationAuto sign in users after verifying their emailboolean—No
    --disable-sign-upDisable new user sign upsboolean—No
    --email-verification-methodEmail verification methodstring—No
    --enabledEnable email and password authenticationboolean—No
    --require-email-verificationRequire email verification before users can sign inboolean—No
    --send-verification-email-on-sign-inSend verification email on sign inboolean—No
    --send-verification-email-on-sign-upSend verification email on sign upboolean—No
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No
    neon neon-auth config email-password update --enabled --require-email-verification

    neon neon-auth config email-provider

    Manages the email provider configuration.

    Subcommands: get, test, update

    neon neon-auth config email-provider get

    Gets the current email provider configuration.

    neon neon-auth config email-provider get [options]
    OptionDescriptionTypeDefaultRequired
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No
    neon neon-auth config email-provider get

    neon neon-auth config email-provider update

    Updates the email provider configuration.

    neon neon-auth config email-provider update [options]
    OptionDescriptionTypeDefaultRequired
    --hostSMTP host (required for standard)string—No
    --passwordSMTP password (required for standard)string—No
    --portSMTP port (required for standard)number—No
    --sender-emailSender email addressstring—No
    --sender-nameSender display namestring—No
    --typeEmail provider type Possible values: standard, sharedstring—Yes
    --usernameSMTP username (required for standard)string—No
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No

    Configure the standard email provider type with your own SMTP server:

    neon neon-auth config email-provider update --type standard --host smtp.example.com --port 587 --username example_username --password AbC123dEf --sender-email noreply@example.com --sender-name "Example App"

    neon neon-auth config email-provider test

    Sends a test email so you can verify your SMTP configuration.

    neon neon-auth config email-provider test [options]
    OptionDescriptionTypeDefaultRequired
    --hostSMTP hoststring—Yes
    --passwordSMTP passwordstring—Yes
    --portSMTP portnumber—Yes
    --recipient-emailEmail address to send test email tostring—Yes
    --sender-emailSender email addressstring—Yes
    --sender-nameSender display namestring—Yes
    --usernameSMTP usernamestring—Yes
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No
    neon neon-auth config email-provider test --recipient-email user@example.com --host smtp.example.com --port 587 --username example_username --password AbC123dEf --sender-email noreply@example.com --sender-name "Example App"

    neon neon-auth config organization

    Manages organization plugin settings.

    Subcommands: get, update

    neon neon-auth config organization get

    Gets the current organization plugin configuration.

    neon neon-auth config organization get [options]
    OptionDescriptionTypeDefaultRequired
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No
    neon neon-auth config organization get

    neon neon-auth config organization update

    Updates the organization plugin configuration.

    neon neon-auth config organization update [options]
    OptionDescriptionTypeDefaultRequired
    --creator-roleRole assigned to organization creator Possible values: admin, ownerstring—No
    --enabledEnable the organization pluginboolean—No
    --limitMaximum number of organizations a user can createnumber—No
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No
    neon neon-auth config organization update --enabled --limit 5 --creator-role owner

    neon neon-auth config webhook

    Manages webhook configuration.

    Subcommands: get, update

    neon neon-auth config webhook get

    Gets the current webhook configuration.

    neon neon-auth config webhook get [options]
    OptionDescriptionTypeDefaultRequired
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No
    neon neon-auth config webhook get

    neon neon-auth config webhook update

    Updates the webhook configuration.

    neon neon-auth config webhook update [options]
    OptionDescriptionTypeDefaultRequired
    --enabledEnable webhooksboolean—Yes
    --enabled-eventsEvents to enable Possible values: user.before_create, user.created, send.otp, send.magic_linkstring—No
    --timeoutWebhook timeout in seconds (1-10)number—No
    --urlWebhook endpoint URLstring—No
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No
    neon neon-auth config webhook update --enabled --url https://example.com/webhooks/neon-auth --enabled-events user.created --timeout 5

    Plugins

    The plugins subcommands show the Managed Better Auth plugin configurations for the branch.

    Subcommands: get, list

    neon neon-auth plugins list

    Lists all plugin configurations.

    neon neon-auth plugins list [options]
    OptionDescriptionTypeDefaultRequired
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No
    neon neon-auth plugins list

    neon neon-auth plugins get

    Gets a specific plugin configuration.

    neon neon-auth plugins get <plugin-name> [options]
    OptionDescriptionTypeDefaultRequired
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No
    neon neon-auth plugins get organization

    Users

    The user subcommands manage Managed Better Auth users on the branch.

    Subcommands: create, delete, set-role

    neon neon-auth user create

    Creates an auth user.

    neon neon-auth user create [options]
    OptionDescriptionTypeDefaultRequired
    --emailUser email addressstring—Yes
    --nameUser display name (defaults to email if not provided)string—No
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No
    neon neon-auth user create --email alex@example.com --name "Alex Lopez"

    neon neon-auth user delete

    Deletes an auth user.

    neon neon-auth user delete <user-id> [options]
    OptionDescriptionTypeDefaultRequired
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No
    neon neon-auth user delete <user-id>

    neon neon-auth user set-role

    Sets roles for an auth user.

    neon neon-auth user set-role <user-id> [options]
    OptionDescriptionTypeDefaultRequired
    --rolesRoles to assignstring—Yes
    --branchBranch ID or namestring—No
    --project-idProject IDstring—No
    neon neon-auth user set-role <user-id> --roles admin
    Was this page helpful?
    Edit on GitHub
    Previous data-apiNext api

    On this page

    Copy neon init command