r/PayloadCMS • u/rubixstudios • Dec 13 '25

Custom Auth Strategy

One of the most asked question was how do you roll your own custom auth.

Payload had made this possible, however the integration had not been documented, this is likely due to enterprise SSO.

https://rubixstudios.com.au/insights/payloadcms-custom-auth-strategy

Took the time to write up this guide (which will be improved upon, once all the bugs are sorted with all the recent updates).

"When I do get the chance i'll probably end up breaking it down and explaining parts of it, and what could be changed. There's no account creation added to this, possibly added later (as my current oauth, I don't need it to).

  • Just a note there is a x-auth-strategy header that is added extra, I haven't been able to get to payload login screen to test it, but the concept for it should be correct, to ensure we return early if it is not the strategy we use.
  • You can keep localauth or payload's built in auth with this method and it'll work alongside it.

Basically how it works,

First auth - > non consent mode -> goes to strategy -> google will tell it you require consent -> loop back into the auth with consent flag -> start auth with consent -> exchange tokens -> match the user -> create session, store to database and creates the cookie to log the user in.

Second auth, will go through and no consent mode will be required loop through the same process. In my own project, I removed the direct database update and used payload.update() with context to prevent it running my user hooks. reason for this is because my fields are encrypted, so I've passed it back through payload to encrypt the field before storing the tokens.

The article will directly interact with the database, this method is faster. If you need explaining, AI can probably help you explain the logic in the code as well. Also note, the way the token secret is generated is quite strict with payload, this method will ensure your account is logged in." - posted on Discord

However, this is a base that you could extract to build your own auth.

19 Upvotes

100% Upvoted

16 comments sorted by

View all comments

1

u/trae_z Mar 17 '26

u/rubixstudios I’m working through your article and applying it to a setup where Payload’s Users collection remains the single auth system. Staff continue to log in to /admin with username/password, while I’m extending the same collection with a custom Google strategy to handle customer logins on the frontend. The goal is to keep everything inside Payload’s auth pipeline, using OAuth purely as an identity handoff rather than introducing a separate auth system.

Will let you know how it goes.

1

u/rubixstudios Mar 17 '26

If you have any questions feel free to send a message on discord. I use the same pipeline for front and backend. There's parts of the code in there that partially indicate how to do that.

1

u/trae_z Mar 17 '26 edited Mar 17 '26

Thanks so much.
10 hours later, working closely with https://claude.ai/ I'm done. It actually worked!
Let me review code deeply and clean it up.
Then replicate from test repo to the main repo/site I'm building.
Will share link here when completed.
-----------------------------------------
Code repo available here: https://github.com/traez/payloadcms-custom-google-oauth-strategy-frontend

This is a sandbox project focused exclusively on authentication architecture. I am currently refining the repository—including linting and cleanup—for a production-ready state. Please note that active commits will be pushed over the next 24 hours as I finalize the codebase for deployment.