OAuth Sign-Up Control#

Better Auth provides two complementary mechanisms to prevent new account creation during OAuth and Google One Tap flows while still allowing existing users to sign in. The check happens inside handleOAuthUserInfo() — the shared function invoked by both the standard OAuth callback and the One Tap plugin — immediately before the new-user registration branch 1.

disableSignUp — Hard Block on New Registrations#

Set disableSignUp: true on any provider in socialProviders to permanently reject OAuth sign-up for that provider. Existing users can still sign in; only the "no user found → create user" path is blocked.

socialProviders: {
  google: {
    clientId: "...",
    clientSecret: "...",
    disableSignUp: true,
  },
}

How it works: The callback handler at /callback/:id passes provider.options?.disableSignUp directly to handleOAuthUserInfo as the disableSignUp flag 2. Inside that function, when isRegister = true (no existing user found) and disableSignUp is truthy, the function returns { error: "signup disabled", data: null } 3. The callback handler then redirects to the error URL with the signup_disabled error code 4.

Note on stateless mode: The official docs flag a known issue — disableSignUp does not work correctly with stateless mode. The recommended workaround is a databaseHooks.user.create.before hook that throws an APIError to reject the creation 5.

disableImplicitSignUp — Opt-In Registration#

disableImplicitSignUp: true is a softer control: it blocks sign-up unless the client explicitly passes requestSignUp: true when initiating the flow 6.

socialProviders: {
  google: {
    clientId: "...",
    clientSecret: "...",
    disableImplicitSignUp: true,
  },
}

How it works: The parsed OAuth state carries a requestSignUp flag 7. The disableSignUp value passed to handleOAuthUserInfo is computed as (provider.disableImplicitSignUp && !requestSignUp) || provider.options?.disableSignUp 2. So when disableImplicitSignUp is set, sign-up is only blocked when the client has not explicitly requested it — allowing application-level UI to gate new registrations (e.g., an invite flow) while reusing the same OAuth provider config.

Client-side usage:

await authClient.signIn.social({
  provider: "google",
  requestSignUp: true, // omit this to block registration
});

One Tap: disableSignup#

The Google One Tap plugin exposes its own option — note the lowercase p: disableSignup (not disableSignUp). It maps directly onto the same disableSignUp parameter passed to handleOAuthUserInfo 8, so the enforcement path is identical.

import { oneTap } from "better-auth/plugins";

export const auth = betterAuth({
  plugins: [
    oneTap({ disableSignup: true }),
  ],
});

Unlike disableImplicitSignUp, the One Tap option has no requestSignUp escape hatch — it is a hard block.

Decision Summary#

Key Source Files#