Journey: Auth

Stage 3c of the guided journey. Configure OAuth providers and (optionally) auth hooks.

When to use

• Dispatched by journey when current_stage: auth.
• Directly via /butterbase-skills:journey-auth.
• Skipped (annotated (n/a) in 00-state.md) if the plan has no end-user auth.

Preflight

If docs/butterbase/03-preflight.md is missing, older than 24 hours, or 00-state.md has app_id: null, invoke butterbase-skills:journey-preflight first. Wait for it to return successfully before proceeding.

Inputs

• docs/butterbase/02-plan.md — the Auth section.
• docs/butterbase/00-state.md — for app_id.

Procedure

1. Refresh docs. Call butterbase_docs with topic: "auth". For provider-specific setup (Google/GitHub/Apple), also WebFetch https://docs.butterbase.ai/auth. Skip if cache is fresh.

1. Read the Auth section of 02-plan.md. Print it back: "About to configure auth: providers=<list>, demo_user=<yes/no>. Proceed?". Wait for yes.
2. Invoke butterbase-skills:auth-setup via the Skill tool, passing the Auth plan and app_id. The wrapped skill will prompt for each provider's client ID/secret and call manage_oauth action: configure. If a demo user is requested, it seeds one via insert_row on the users table.
3. After it returns, run manage_oauth action: get to confirm and print the redirect URLs the user must register with each provider.
4. Append one line to docs/butterbase/04-build-log.md:

<ISO timestamp> auth manage_oauth ok

1. Tick - [x] auth in 00-state.md, set current_stage: to the next unchecked stage.
2. Return to journey orchestrator (or ask "Continue to the next stage? (yes/no)").

Outputs

• Configured OAuth providers.
• Optional seed user.
• One line in 04-build-log.md.

Anti-patterns

• ❌ Echoing OAuth client secrets back to the user.
• ❌ Forgetting to give the user the provider-side redirect URL — auth will silently fail without it.