Auth Without Headaches: Google, Magic Links, Dev Login

Authentication has exactly three states that matter: logged out, logged in free, logged in paid. Everything else is ceremony — which Boring compresses into one config file.

Google OAuth covers most users. Magic links cover the rest, backed by per-database adapters so verification tokens work identically on SQLite, MongoDB, and Supabase. Sessions are JWT, so no session-table lookups on hot paths; the session callback just exposes session.user.id for every provider.

The underrated feature is the dev escape hatch: in development only, [email protected] signs in as a free user and [email protected] as a paying one. No OAuth keys, no email inbox, full paywall testing. It is gated by NODE_ENV and vanishes from production builds entirely.

Two guards keep it sane forever. Stale sessions (valid cookie, deleted user) redirect to /auth, which only redirects away when the user row exists — so redirect loops are structurally impossible. And ADMIN_EMAILS is fail-closed in production: unset means nobody is admin, never everybody.