Authentication

GitHub OAuth

The login page offers a GitHub button only when both halves of the credential are set:

GITHUB_CLIENT_ID=…
GITHUB_CLIENT_SECRET=…

Create the OAuth app

On GitHub, open Settings → Developer settings → OAuth Apps → New OAuth App.
Set the homepage URL to your deployment's origin (for local development, http://localhost:3000).
Set the authorization callback URL to <origin>/api/auth/callback/github.
Copy the client ID and generate a client secret, then set both environment variables.

Callback URLs and the site URL

The auth module auto-detects the base URL from the incoming request. Set NUXT_PUBLIC_SITE_URL only for a custom domain or when you need deterministic OAuth callbacks:

NUXT_PUBLIC_SITE_URL=https://agent-zero.example.com

Rebuild after changing credentialsThe login page derives its sign-in methods at build time. After setting or removing the GitHub credentials, rebuild the app or the button state will be stale (the server still enforces the real policy). See Authentication overview.

Edit this pageorReport an issue

Authentication overview

The dashboard UI is protected by Better Auth, mounted in-process at /api/auth/** by @onmax/nuxt-better-auth from apps/dashboard/server/auth.config.ts.

Permissions

Agent Zero separates three kinds of authority. None of them implies another.