usePublicOAuthClient

Requires oauthProviderClient() from @better-auth/oauth-provider/client. Read the client ID from the signed authorization query and leave the complete query string in the browser URL.

Usage

import { parseOAuthAuthorizationRequest } from "@better-auth-ui/core/plugins/oauth-provider"
import { usePublicOAuthClient } from "@better-auth-ui/react/plugins/oauth-provider"

const { clientId } = parseOAuthAuthorizationRequest(window.location.search)
const client = usePublicOAuthClient(authClient, clientId)

The query remains disabled until clientId is available.

Options factory and loader helpers

import {
  ensurePublicOAuthClient,
  fetchPublicOAuthClient,
  prefetchPublicOAuthClient,
  publicOAuthClientOptions
} from "@better-auth-ui/core/plugins/oauth-provider"

const options = publicOAuthClientOptions(authClient, clientId)
await ensurePublicOAuthClient(queryClient, authClient, clientId)
await prefetchPublicOAuthClient(queryClient, authClient, clientId)
const client = await fetchPublicOAuthClient(queryClient, authClient, clientId)

Params

Verify an authorization request

For consent pages, pass the complete signed query, including sig and exp:

const publicClient = usePublicOAuthClient(authClient, clientId, {
  oauthQuery: window.location.search,
  retry: false
})

For Solid, return these options from an accessor. The query uses Better Auth's publicClientPrelogin endpoint and requires allowPublicClientPrelogin: true in the server's OAuth provider configuration. A rejected signature does not fall back to an unverified metadata lookup. Each signed query has its own cache entry.

Omit oauthQuery for ordinary metadata lookups, such as the connected applications list. The imperative query helpers also accept this option.

The consent component reads the browser query by default. If your router updates the query without remounting the component or firing popstate, pass its complete query string through the component's oauthQuery prop. Consent submission forwards the same query that was verified.