---
name: journey-auth
description: Use as the auth build stage of the Butterbase journey, after journey-schema (and rls if separate). Implements the Auth section of 02-plan.md by delegating to auth-setup. Calls manage_oauth (configure) for providers and optionally manage_auth_config (configure_auth_hook, update_jwt). Skipped if the plan has no end-user auth.
---

# Journey: Auth

Stage 3c of the guided journey. Configure OAuth providers and (optionally) auth hooks.

## When to use

- Dispatched by `journey` when `current_stage: auth`.
- Directly via `/butterbase-skills:journey-auth`.
- Skipped (annotated `(n/a)` in `00-state.md`) if the plan has no end-user auth.

## Preflight

If `docs/butterbase/03-preflight.md` is missing, older than 24 hours, or `00-state.md` has `app_id: null`, invoke `butterbase-skills:journey-preflight` first. Wait for it to return successfully before proceeding.

## Inputs

- `docs/butterbase/02-plan.md` — the Auth section.
- `docs/butterbase/00-state.md` — for `app_id`.

## Procedure

0. **Refresh docs.** Call `butterbase_docs` with `topic: "auth"`. For provider-specific setup (Google/GitHub/Apple), also WebFetch `https://docs.butterbase.ai/auth`. Skip if cache is fresh.

1. Read the Auth section of `02-plan.md`. Print it back: `"About to configure auth: providers=<list>, demo_user=<yes/no>. Proceed?"`. Wait for `yes`.
2. Invoke `butterbase-skills:auth-setup` via the Skill tool, passing the Auth plan and `app_id`. The wrapped skill will prompt for each provider's client ID/secret and call `manage_oauth action: configure`. If a demo user is requested, it seeds one via `insert_row` on the users table.
3. After it returns, run `manage_oauth action: get` to confirm and print the redirect URLs the user must register with each provider.
4. Append one line to `docs/butterbase/04-build-log.md`:
   `<ISO timestamp>  auth  manage_oauth  ok`
5. Tick `- [x] auth` in `00-state.md`, set `current_stage:` to the next unchecked stage.
6. Return to `journey` orchestrator (or ask `"Continue to the next stage? (yes/no)"`).

## Outputs

- Configured OAuth providers.
- Optional seed user.
- One line in `04-build-log.md`.

## Anti-patterns

- ❌ Echoing OAuth client secrets back to the user.
- ❌ Forgetting to give the user the provider-side redirect URL — auth will silently fail without it.