Silica Docs

Authentication

Put your site behind Google sign-in.

By default a Silica site is fully public. If your vault is private, you can gate the whole site behind Google OAuth so only people you allow can read it.

Turning it on

  1. Copy .env.example to .env and fill in your credentials.
  2. Add an auth block to silica.config.ts:
TypeScript
export default defineConfig({
  title: "Private Docs",
  auth: {
    provider: "google",
    allowedDomains: ["example.com"],
    // allowedEmails: ["you@example.com"],
  },
});
  1. Set baseUrl to your production URL so sign-in redirects work.

What readers experience

  • Visitors are sent to a sign-in page and authenticate with Google OAuth.
  • People on your allowlist get straight in.
  • Anyone signing in who is not on the allowlist sees a "not allowed" page.

Sign-in protects everything — pages, search, and your vault's images and files — so nothing leaks before a reader is authenticated.

Environment variables

VariablePurpose
BETTER_AUTH_SECRETSession secret (required in production)
BETTER_AUTH_URLYour public site URL
GOOGLE_CLIENT_IDGoogle OAuth client ID
GOOGLE_CLIENT_SECRETGoogle OAuth client secret

Turning it off

Omit the auth block, or set auth: false, for a public site.

Backlinks