Legacy Auth

These endpoints remain available for existing integrations. See Neon Auth for current documentation.

API Reference / Legacy Auth / Create Auth Provider SDK keys

Generates SDK or API Keys for the auth provider. These might be called different things depending on the auth provider you're using, but are generally used for setting up the frontend and backend SDKs.

• project_id (string, required) The Neon project ID. Returned as id from GET /projects.
• auth_provider (string, required) Authentication provider integrated with this Neon Auth configuration. better_auth integrates with Better Auth (the current, recommended provider). stack integrates with Stack Auth (deprecated). mock is a simulated provider for local development and testing only. Possible values: mock, stack, better_auth

• auth_provider (string, optional) Authentication provider integrated with this Neon Auth configuration. better_auth integrates with Better Auth (the current, recommended provider). stack integrates with Stack Auth (deprecated). mock is a simulated provider for local development and testing only. Possible values: mock, stack, better_auth
• auth_provider_project_id (string, optional) Project ID assigned by the auth provider for this integration.
• pub_client_key (string, optional) Publishable SDK key from the auth provider. Populated only for Stack Auth (deprecated); empty for Better Auth.
• secret_server_key (string, optional) Secret server-side SDK key from the auth provider. Populated only for Stack Auth (deprecated); empty for Better Auth. Treat as a credential.
• jwks_url (string, optional) URL of the provider's JWKS endpoint used to verify JWTs.
• schema_name (string, optional) Postgres schema containing the auth integration tables. Defaults to neon_auth.
• table_name (string, optional) Postgres table in the integration schema where synced user records are stored.
• base_url (string, optional) Base URL of the Neon Auth service for this integration. Set as the NEON_AUTH_BASE_URL environment variable in your application.

curl "https://console.neon.tech/api/v2/projects/auth/keys" \
  -X POST \
  -H "Authorization: Bearer $NEON_API_KEY"

import { createNeonClient, raw } from '@neon/sdk';

const neon = createNeonClient({ apiKey: process.env.NEON_API_KEY });
const { data } = await raw.createNeonAuthProviderSdkKeys({
  client: neon.client
});

Console path: Projects → Auth → Configuration

default General Error.

The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received.

• If no response is returned from the API, a network error or timeout likely occurred.
• In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results.

The following HTTP methods are considered non-idempotent: POST, PATCH, DELETE, and PUT. Retrying these methods is generally not safe. The following methods are considered idempotent: GET, HEAD, and OPTIONS. Retrying these methods is safe in the event of a network error or timeout.

Any request that returns a 503 Service Unavailable response is always safe to retry.

Any request that returns a 423 Locked response is safe to retry. 423 Locked indicates that the resource is temporarily locked, for example, due to another operation in progress.

• request_id (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an X-Request-ID header in the request. If not provided, the value will be generated automatically.

• code (string, required) Machine-readable code classifying the error type. See message for a human-readable explanation. Default: ``

• message (string, required) Error message

API Reference / Legacy Auth / Transfer Neon-managed auth project to your own account

Transfers ownership of your Neon-managed auth project to your own auth provider account.

• project_id (string, required) The Neon project ID. Returned as id from GET /projects.
• auth_provider (string, required) Authentication provider integrated with this Neon Auth configuration. better_auth integrates with Better Auth (the current, recommended provider). stack integrates with Stack Auth (deprecated). mock is a simulated provider for local development and testing only. Possible values: mock, stack, better_auth

• url (string, optional) URL for completing the process of ownership transfer

curl "https://console.neon.tech/api/v2/projects/auth/transfer_ownership" \
  -X POST \
  -H "Authorization: Bearer $NEON_API_KEY"

import { createNeonClient, raw } from '@neon/sdk';

const neon = createNeonClient({ apiKey: process.env.NEON_API_KEY });
const { data } = await raw.transferNeonAuthProviderProject({
  client: neon.client
});

Console path: Projects → Auth → Configuration

default General Error.

The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received.

• If no response is returned from the API, a network error or timeout likely occurred.
• In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results.

The following HTTP methods are considered non-idempotent: POST, PATCH, DELETE, and PUT. Retrying these methods is generally not safe. The following methods are considered idempotent: GET, HEAD, and OPTIONS. Retrying these methods is safe in the event of a network error or timeout.

Any request that returns a 503 Service Unavailable response is always safe to retry.

Any request that returns a 423 Locked response is safe to retry. 423 Locked indicates that the resource is temporarily locked, for example, due to another operation in progress.

• request_id (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an X-Request-ID header in the request. If not provided, the value will be generated automatically.

• code (string, required) Machine-readable code classifying the error type. See message for a human-readable explanation. Default: ``

• message (string, required) Error message

API Reference / Legacy Auth / Add an OAuth provider

Deprecated. Use /projects/{project_id}/branches/{branch_id}/auth/oauth_providers instead. Removal scheduled for March 1, 2026.

• project_id (string, path, required) The Neon project ID

• id (string, required) OAuth provider to configure for Neon Auth. Known values: google, github, microsoft, vercel.

  Possible values: google, github, microsoft, vercel

• client_id (string, optional) The client ID issued by the OAuth provider for your application. Used to identify the application during the OAuth flow.

• client_secret (string, optional) OAuth client secret for the provider.

• microsoft_tenant_id (string, optional) Tenant ID for the Microsoft OAuth provider. Only relevant when the OAuth provider is Microsoft; omit or leave blank for other providers.

• id (string, optional) The OAuth provider's ID. Possible values: google, github, microsoft, vercel
• type (string, optional) OAuth provider key type. standard uses your own OAuth credentials. shared uses Neon-managed keys intended for development only; they display Neon branding on the OAuth consent screen and must not be used in production. Possible values: standard, shared
• client_id (string, optional) Public identifier for the OAuth application, issued by the provider when the application is registered.
• client_secret (string, optional) OAuth client secret for the provider.

curl "https://console.neon.tech/api/v2/projects/$PROJECT_ID/auth/oauth_providers" \
  -X POST \
  -H "Authorization: Bearer $NEON_API_KEY"

import { createNeonClient, raw } from '@neon/sdk';

const neon = createNeonClient({ apiKey: process.env.NEON_API_KEY });
const { data } = await raw.addNeonAuthOauthProvider({
  client: neon.client,
  path: {
    project_id: process.env.PROJECT_ID
  }
});

default General Error.

The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received.

• If no response is returned from the API, a network error or timeout likely occurred.
• In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results.

The following HTTP methods are considered non-idempotent: POST, PATCH, DELETE, and PUT. Retrying these methods is generally not safe. The following methods are considered idempotent: GET, HEAD, and OPTIONS. Retrying these methods is safe in the event of a network error or timeout.

Any request that returns a 503 Service Unavailable response is always safe to retry.

Any request that returns a 423 Locked response is safe to retry. 423 Locked indicates that the resource is temporarily locked, for example, due to another operation in progress.

• request_id (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an X-Request-ID header in the request. If not provided, the value will be generated automatically.

• code (string, required) Machine-readable code classifying the error type. See message for a human-readable explanation. Default: ``

• message (string, required) Error message

API Reference / Legacy Auth / Add trusted redirect URI domain

Deprecated. Use /projects/{project_id}/branches/{branch_id}/auth/domains instead. Removal scheduled for March 1, 2026.

• project_id (string, path, required) The Neon project ID

• domain (string, required, format: uri) URI to add to the redirect URI allowlist for the auth provider.
• auth_provider (string, required) Authentication provider integrated with this Neon Auth configuration. better_auth integrates with Better Auth (the current, recommended provider). stack integrates with Stack Auth (deprecated). mock is a simulated provider for local development and testing only. Possible values: mock, stack, better_auth

Added the domain to the redirect_uri whitelist

curl "https://console.neon.tech/api/v2/projects/$PROJECT_ID/auth/domains" \
  -X POST \
  -H "Authorization: Bearer $NEON_API_KEY"

import { createNeonClient, raw } from '@neon/sdk';

const neon = createNeonClient({ apiKey: process.env.NEON_API_KEY });
const { data } = await raw.addNeonAuthDomainToRedirectUriWhitelist({
  client: neon.client,
  path: {
    project_id: process.env.PROJECT_ID
  }
});

default General Error.

The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received.

• If no response is returned from the API, a network error or timeout likely occurred.
• In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results.

The following HTTP methods are considered non-idempotent: POST, PATCH, DELETE, and PUT. Retrying these methods is generally not safe. The following methods are considered idempotent: GET, HEAD, and OPTIONS. Retrying these methods is safe in the event of a network error or timeout.

Any request that returns a 503 Service Unavailable response is always safe to retry.

Any request that returns a 423 Locked response is safe to retry. 423 Locked indicates that the resource is temporarily locked, for example, due to another operation in progress.

• request_id (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an X-Request-ID header in the request. If not provided, the value will be generated automatically.

• code (string, required) Machine-readable code classifying the error type. See message for a human-readable explanation. Default: ``

• message (string, required) Error message

API Reference / Legacy Auth / Create Neon Auth integration

Deprecated. Use /projects/{project_id}/branches/{branch_id}/auth instead. Removal scheduled for March 1, 2026. Use this endpoint if the frontend integration flow can't be used.

• auth_provider (string, required) Authentication provider integrated with this Neon Auth configuration. better_auth integrates with Better Auth (the current, recommended provider). stack integrates with Stack Auth (deprecated). mock is a simulated provider for local development and testing only. Possible values: mock, stack, better_auth
• project_id (string, required) The Neon project ID. Returned as id from GET /projects.
• branch_id (string, required) The Neon branch ID. Returned as id from GET /projects/{project_id}/branches.
• database_name (string, optional) Name of the database to associate with the Neon Auth integration. When omitted, the integration uses the project's default database.
• role_name (string, optional, deprecated) Deprecated. The database role for the auth integration. Omit this field; it is ignored.

• auth_provider (string, optional) Authentication provider integrated with this Neon Auth configuration. better_auth integrates with Better Auth (the current, recommended provider). stack integrates with Stack Auth (deprecated). mock is a simulated provider for local development and testing only. Possible values: mock, stack, better_auth
• auth_provider_project_id (string, optional) Project ID assigned by the auth provider for this integration.
• pub_client_key (string, optional) Publishable SDK key from the auth provider. Populated only for Stack Auth (deprecated); empty for Better Auth.
• secret_server_key (string, optional) Secret server-side SDK key from the auth provider. Populated only for Stack Auth (deprecated); empty for Better Auth. Treat as a credential.
• jwks_url (string, optional) URL of the provider's JWKS endpoint used to verify JWTs.
• schema_name (string, optional) Postgres schema containing the auth integration tables. Defaults to neon_auth.
• table_name (string, optional) Postgres table in the integration schema where synced user records are stored.
• base_url (string, optional) Base URL of the Neon Auth service for this integration. Set as the NEON_AUTH_BASE_URL environment variable in your application.

curl "https://console.neon.tech/api/v2/projects/auth/create" \
  -X POST \
  -H "Authorization: Bearer $NEON_API_KEY"

import { createNeonClient, raw } from '@neon/sdk';

const neon = createNeonClient({ apiKey: process.env.NEON_API_KEY });
const { data } = await raw.createNeonAuthIntegration({
  client: neon.client
});

default General Error.

The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received.

• If no response is returned from the API, a network error or timeout likely occurred.
• In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results.

The following HTTP methods are considered non-idempotent: POST, PATCH, DELETE, and PUT. Retrying these methods is generally not safe. The following methods are considered idempotent: GET, HEAD, and OPTIONS. Retrying these methods is safe in the event of a network error or timeout.

Any request that returns a 503 Service Unavailable response is always safe to retry.

Any request that returns a 423 Locked response is safe to retry. 423 Locked indicates that the resource is temporarily locked, for example, due to another operation in progress.

• request_id (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an X-Request-ID header in the request. If not provided, the value will be generated automatically.

• code (string, required) Machine-readable code classifying the error type. See message for a human-readable explanation. Default: ``

• message (string, required) Error message

API Reference / Legacy Auth / Create new auth user

Deprecated. Use /projects/{project_id}/branches/{branch_id}/auth/users instead. Removal scheduled for March 1, 2026. The user will be created in your neon_auth.users_sync table and automatically propagated to your auth project, whether Neon-managed or provider-owned.

• project_id (string, required) The Neon project ID. Returned as id from GET /projects.
• auth_provider (string, required) Authentication provider integrated with this Neon Auth configuration. better_auth integrates with Better Auth (the current, recommended provider). stack integrates with Stack Auth (deprecated). mock is a simulated provider for local development and testing only. Possible values: mock, stack, better_auth
• email (string, required, format: email) Email address of the new user.
• name (string, optional) Display name for the new user. When omitted, the created user has no display name.

• id (string, optional) ID of newly created user

curl "https://console.neon.tech/api/v2/projects/auth/user" \
  -X POST \
  -H "Authorization: Bearer $NEON_API_KEY"

import { createNeonClient, raw } from '@neon/sdk';

const neon = createNeonClient({ apiKey: process.env.NEON_API_KEY });
const { data } = await raw.createNeonAuthNewUser({
  client: neon.client
});

default General Error.

The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received.

• If no response is returned from the API, a network error or timeout likely occurred.
• In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results.

The following HTTP methods are considered non-idempotent: POST, PATCH, DELETE, and PUT. Retrying these methods is generally not safe. The following methods are considered idempotent: GET, HEAD, and OPTIONS. Retrying these methods is safe in the event of a network error or timeout.

Any request that returns a 503 Service Unavailable response is always safe to retry.

Any request that returns a 423 Locked response is safe to retry. 423 Locked indicates that the resource is temporarily locked, for example, due to another operation in progress.

• request_id (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an X-Request-ID header in the request. If not provided, the value will be generated automatically.

• code (string, required) Machine-readable code classifying the error type. See message for a human-readable explanation. Default: ``

• message (string, required) Error message

API Reference / Legacy Auth / Delete auth user

Deprecated. Use /projects/{project_id}/branches/{branch_id}/auth/users/{auth_user_id} instead. Removal scheduled for March 1, 2026.

• project_id (string, path, required) The Neon project ID
• auth_user_id (string, path, required) The Neon user ID

curl "https://console.neon.tech/api/v2/projects/$PROJECT_ID/auth/users/$AUTH_USER_ID" \
  -X DELETE \
  -H "Authorization: Bearer $NEON_API_KEY"

import { createNeonClient, raw } from '@neon/sdk';

const neon = createNeonClient({ apiKey: process.env.NEON_API_KEY });
const { data } = await raw.deleteNeonAuthUser({
  client: neon.client,
  path: {
    project_id: process.env.PROJECT_ID,
    auth_user_id: process.env.AUTH_USER_ID
  }
});

Console path: Projects → Auth → Users

default General Error.

The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received.

• If no response is returned from the API, a network error or timeout likely occurred.
• In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results.

The following HTTP methods are considered non-idempotent: POST, PATCH, DELETE, and PUT. Retrying these methods is generally not safe. The following methods are considered idempotent: GET, HEAD, and OPTIONS. Retrying these methods is safe in the event of a network error or timeout.

Any request that returns a 503 Service Unavailable response is always safe to retry.

Any request that returns a 423 Locked response is safe to retry. 423 Locked indicates that the resource is temporarily locked, for example, due to another operation in progress.

• request_id (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an X-Request-ID header in the request. If not provided, the value will be generated automatically.

• code (string, required) Machine-readable code classifying the error type. See message for a human-readable explanation. Default: ``

• message (string, required) Error message

API Reference / Legacy Auth / Delete integration with auth provider

Deprecated. Use /projects/{project_id}/branches/{branch_id}/auth instead. Removal scheduled for March 1, 2026.

• project_id (string, path, required) The Neon project ID
• auth_provider (string, path, required) The authentication provider name

• delete_data (boolean, optional) If true, deletes the neon_auth schema from the database Default: false

Delete the integration with the authentication provider

curl "https://console.neon.tech/api/v2/projects/$PROJECT_ID/auth/integration/$AUTH_PROVIDER" \
  -X DELETE \
  -H "Authorization: Bearer $NEON_API_KEY"

import { createNeonClient, raw } from '@neon/sdk';

const neon = createNeonClient({ apiKey: process.env.NEON_API_KEY });
const { data } = await raw.deleteNeonAuthIntegration({
  client: neon.client,
  path: {
    project_id: process.env.PROJECT_ID,
    auth_provider: process.env.AUTH_PROVIDER
  }
});

default General Error.

The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received.

• If no response is returned from the API, a network error or timeout likely occurred.
• In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results.

The following HTTP methods are considered non-idempotent: POST, PATCH, DELETE, and PUT. Retrying these methods is generally not safe. The following methods are considered idempotent: GET, HEAD, and OPTIONS. Retrying these methods is safe in the event of a network error or timeout.

Any request that returns a 503 Service Unavailable response is always safe to retry.

Any request that returns a 423 Locked response is safe to retry. 423 Locked indicates that the resource is temporarily locked, for example, due to another operation in progress.

• request_id (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an X-Request-ID header in the request. If not provided, the value will be generated automatically.

• code (string, required) Machine-readable code classifying the error type. See message for a human-readable explanation. Default: ``

• message (string, required) Error message

API Reference / Legacy Auth / Delete OAuth provider

Deprecated. Use /projects/{project_id}/branches/{branch_id}/auth/oauth_providers/{oauth_provider_id} instead. Removal scheduled for March 1, 2026.

• project_id (string, path, required) The Neon project ID
• oauth_provider_id (string, path, required) The OAuth provider ID

Deleted the OAuth provider from the project

curl "https://console.neon.tech/api/v2/projects/$PROJECT_ID/auth/oauth_providers/$OAUTH_PROVIDER_ID" \
  -X DELETE \
  -H "Authorization: Bearer $NEON_API_KEY"

import { createNeonClient, raw } from '@neon/sdk';

const neon = createNeonClient({ apiKey: process.env.NEON_API_KEY });
const { data } = await raw.deleteNeonAuthOauthProvider({
  client: neon.client,
  path: {
    project_id: process.env.PROJECT_ID,
    oauth_provider_id: process.env.OAUTH_PROVIDER_ID
  }
});

default General Error.

The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received.

• If no response is returned from the API, a network error or timeout likely occurred.
• In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results.

The following HTTP methods are considered non-idempotent: POST, PATCH, DELETE, and PUT. Retrying these methods is generally not safe. The following methods are considered idempotent: GET, HEAD, and OPTIONS. Retrying these methods is safe in the event of a network error or timeout.

Any request that returns a 503 Service Unavailable response is always safe to retry.

Any request that returns a 423 Locked response is safe to retry. 423 Locked indicates that the resource is temporarily locked, for example, due to another operation in progress.

• request_id (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an X-Request-ID header in the request. If not provided, the value will be generated automatically.

• code (string, required) Machine-readable code classifying the error type. See message for a human-readable explanation. Default: ``

• message (string, required) Error message

API Reference / Legacy Auth / Delete trusted redirect URI domain

Deprecated. Use /projects/{project_id}/branches/{branch_id}/auth/domains instead. Removal scheduled for March 1, 2026.

• project_id (string, path, required) The Neon project ID

• auth_provider (string, required) Authentication provider integrated with this Neon Auth configuration. better_auth integrates with Better Auth (the current, recommended provider). stack integrates with Stack Auth (deprecated). mock is a simulated provider for local development and testing only. Possible values: mock, stack, better_auth
• domains (array, required) Domain names to remove from the redirect URI whitelist for the specified auth provider.
  • domain (string, required, format: uri) URI to remove from the redirect URI whitelist.

Deleted the domain from the redirect_uri whitelist

curl "https://console.neon.tech/api/v2/projects/$PROJECT_ID/auth/domains" \
  -X DELETE \
  -H "Authorization: Bearer $NEON_API_KEY"

import { createNeonClient, raw } from '@neon/sdk';

const neon = createNeonClient({ apiKey: process.env.NEON_API_KEY });
const { data } = await raw.deleteNeonAuthDomainFromRedirectUriWhitelist({
  client: neon.client,
  path: {
    project_id: process.env.PROJECT_ID
  }
});

default General Error.

The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received.

• If no response is returned from the API, a network error or timeout likely occurred.
• In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results.

The following HTTP methods are considered non-idempotent: POST, PATCH, DELETE, and PUT. Retrying these methods is generally not safe. The following methods are considered idempotent: GET, HEAD, and OPTIONS. Retrying these methods is safe in the event of a network error or timeout.

Any request that returns a 503 Service Unavailable response is always safe to retry.

Any request that returns a 423 Locked response is safe to retry. 423 Locked indicates that the resource is temporarily locked, for example, due to another operation in progress.

• request_id (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an X-Request-ID header in the request. If not provided, the value will be generated automatically.

• code (string, required) Machine-readable code classifying the error type. See message for a human-readable explanation. Default: ``

• message (string, required) Error message

API Reference / Legacy Auth / List active integrations with auth providers

Deprecated. Use /projects/{project_id}/branches/{branch_id}/auth instead. Removal scheduled for March 1, 2026.

• project_id (string, path, required) The Neon project ID

• data (array, optional) Neon Auth integrations configured for the project.
  • auth_provider (string, required) Authentication provider integrated with this Neon Auth configuration. better_auth integrates with Better Auth (the current, recommended provider). stack integrates with Stack Auth (deprecated). mock is a simulated provider for local development and testing only. Possible values: mock, stack, better_auth
  • auth_provider_project_id (string, required) Project identifier assigned by the auth provider for this integration.
  • branch_id (string, required) The Neon branch ID. Returned as id from GET /projects/{project_id}/branches.
  • db_name (string, required) Name of the database used by the Neon Auth integration.
  • created_at (string, required, format: date-time) Timestamp when the Neon Auth integration was created, in RFC 3339 format (UTC).
  • owned_by (string, required) Owner of the auth provider project. neon means the project is created and managed by Neon on your behalf. user means the project was created in your own auth provider account and is self-managed. Possible values: user, neon
  • transfer_status (string, optional) Ownership transfer state for the auth provider project. initiated means a transfer was requested but not completed. finished means it completed successfully. Possible values: initiated, finished
  • jwks_url (string, required) URL of the provider's JWKS endpoint used to verify JWTs.
  • base_url (string, optional) Base URL of the Neon Auth service endpoint for this integration. Injected into the project environment as NEON_AUTH_BASE_URL.
  • name (string, optional) Application name shown in auth emails and communications. Defaults to the project name.

curl "https://console.neon.tech/api/v2/projects/$PROJECT_ID/auth/integrations" \
  -H "Authorization: Bearer $NEON_API_KEY"

import { createNeonClient, raw } from '@neon/sdk';

const neon = createNeonClient({ apiKey: process.env.NEON_API_KEY });
const { data } = await raw.listNeonAuthIntegrations({
  client: neon.client,
  path: {
    project_id: process.env.PROJECT_ID
  }
});

Console path: Projects → Auth → Configuration

default General Error.

The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received.

• If no response is returned from the API, a network error or timeout likely occurred.
• In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results.

The following HTTP methods are considered non-idempotent: POST, PATCH, DELETE, and PUT. Retrying these methods is generally not safe. The following methods are considered idempotent: GET, HEAD, and OPTIONS. Retrying these methods is safe in the event of a network error or timeout.

Any request that returns a 503 Service Unavailable response is always safe to retry.

Any request that returns a 423 Locked response is safe to retry. 423 Locked indicates that the resource is temporarily locked, for example, due to another operation in progress.

• request_id (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an X-Request-ID header in the request. If not provided, the value will be generated automatically.

• code (string, required) Machine-readable code classifying the error type. See message for a human-readable explanation. Default: ``

• message (string, required) Error message

API Reference / Legacy Auth / List OAuth providers

Deprecated. Use /projects/{project_id}/branches/{branch_id}/auth/oauth_providers instead. Removal scheduled for March 1, 2026.

• project_id (string, path, required) The Neon project ID

• providers (array, optional) OAuth providers configured for Neon Auth on the project.
  • id (string, required) The OAuth provider's ID. Possible values: google, github, microsoft, vercel
  • type (string, required) OAuth provider key type. standard uses your own OAuth credentials. shared uses Neon-managed keys intended for development only; they display Neon branding on the OAuth consent screen and must not be used in production. Possible values: standard, shared
  • client_id (string, optional) Public identifier for the OAuth application, issued by the provider when the application is registered.
  • client_secret (string, optional) OAuth client secret for the provider.

curl "https://console.neon.tech/api/v2/projects/$PROJECT_ID/auth/oauth_providers" \
  -H "Authorization: Bearer $NEON_API_KEY"

import { createNeonClient, raw } from '@neon/sdk';

const neon = createNeonClient({ apiKey: process.env.NEON_API_KEY });
const { data } = await raw.listNeonAuthOauthProviders({
  client: neon.client,
  path: {
    project_id: process.env.PROJECT_ID
  }
});

default General Error.

The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received.

• If no response is returned from the API, a network error or timeout likely occurred.
• In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results.

The following HTTP methods are considered non-idempotent: POST, PATCH, DELETE, and PUT. Retrying these methods is generally not safe. The following methods are considered idempotent: GET, HEAD, and OPTIONS. Retrying these methods is safe in the event of a network error or timeout.

Any request that returns a 503 Service Unavailable response is always safe to retry.

Any request that returns a 423 Locked response is safe to retry. 423 Locked indicates that the resource is temporarily locked, for example, due to another operation in progress.

• request_id (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an X-Request-ID header in the request. If not provided, the value will be generated automatically.

• code (string, required) Machine-readable code classifying the error type. See message for a human-readable explanation. Default: ``

• message (string, required) Error message

API Reference / Legacy Auth / List trusted redirect URI domains

Deprecated. Use /projects/{project_id}/branches/{branch_id}/auth/domains instead. Removal scheduled for March 1, 2026.

• project_id (string, path, required) The Neon project ID

• domains (array, optional) Domains permitted as redirect URI targets in the whitelist.
  • domain (string, required) Allowed redirect URI domain for the auth provider.
  • auth_provider (string, required) Authentication provider integrated with this Neon Auth configuration. better_auth integrates with Better Auth (the current, recommended provider). stack integrates with Stack Auth (deprecated). mock is a simulated provider for local development and testing only. Possible values: mock, stack, better_auth

curl "https://console.neon.tech/api/v2/projects/$PROJECT_ID/auth/domains" \
  -H "Authorization: Bearer $NEON_API_KEY"

import { createNeonClient, raw } from '@neon/sdk';

const neon = createNeonClient({ apiKey: process.env.NEON_API_KEY });
const { data } = await raw.listNeonAuthRedirectUriWhitelistDomains({
  client: neon.client,
  path: {
    project_id: process.env.PROJECT_ID
  }
});

default General Error.

The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received.

• If no response is returned from the API, a network error or timeout likely occurred.
• In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results.

The following HTTP methods are considered non-idempotent: POST, PATCH, DELETE, and PUT. Retrying these methods is generally not safe. The following methods are considered idempotent: GET, HEAD, and OPTIONS. Retrying these methods is safe in the event of a network error or timeout.

Any request that returns a 503 Service Unavailable response is always safe to retry.

Any request that returns a 423 Locked response is safe to retry. 423 Locked indicates that the resource is temporarily locked, for example, due to another operation in progress.

• request_id (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an X-Request-ID header in the request. If not provided, the value will be generated automatically.

• code (string, required) Machine-readable code classifying the error type. See message for a human-readable explanation. Default: ``

• message (string, required) Error message

API Reference / Legacy Auth / Retrieve email server configuration

Deprecated. Use /projects/{project_id}/branches/{branch_id}/auth/email_provider instead. Removal scheduled for March 1, 2026.

• project_id (string, path, required) The Neon project ID

• host (string, optional) Hostname of the email server.
• port (integer, optional) TCP port of the SMTP server. Common values: 25 (SMTP), 465 (SMTPS), 587 (submission).
• username (string, optional) Username for authenticating with the SMTP server.
• password (string, optional) On GET, returned redacted (empty) for ordinary callers, while callers with project-credential read permission receive the stored password — do not assume this field is empty. Update (PATCH) responses always return it redacted (empty) regardless of permission. Provide a value on update to set or rotate the password.
• sender_email (string, optional) Email address used as the From address on outgoing auth emails.
• sender_name (string, optional) Display name shown as the sender in outgoing emails.

curl "https://console.neon.tech/api/v2/projects/$PROJECT_ID/auth/email_server" \
  -H "Authorization: Bearer $NEON_API_KEY"

import { createNeonClient, raw } from '@neon/sdk';

const neon = createNeonClient({ apiKey: process.env.NEON_API_KEY });
const { data } = await raw.getNeonAuthEmailServer({
  client: neon.client,
  path: {
    project_id: process.env.PROJECT_ID
  }
});

default General Error.

The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received.

• If no response is returned from the API, a network error or timeout likely occurred.
• In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results.

The following HTTP methods are considered non-idempotent: POST, PATCH, DELETE, and PUT. Retrying these methods is generally not safe. The following methods are considered idempotent: GET, HEAD, and OPTIONS. Retrying these methods is safe in the event of a network error or timeout.

Any request that returns a 503 Service Unavailable response is always safe to retry.

Any request that returns a 423 Locked response is safe to retry. 423 Locked indicates that the resource is temporarily locked, for example, due to another operation in progress.

• request_id (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an X-Request-ID header in the request. If not provided, the value will be generated automatically.

• code (string, required) Machine-readable code classifying the error type. See message for a human-readable explanation. Default: ``

• message (string, required) Error message

API Reference / Legacy Auth / Update email server configuration

Deprecated. Use /projects/{project_id}/branches/{branch_id}/auth/email_provider instead. Removal scheduled for March 1, 2026.

• project_id (string, path, required) The Neon project ID

• host (string, optional) Hostname of the email server.
• port (integer, optional) TCP port of the SMTP server. Common values: 25 (SMTP), 465 (SMTPS), 587 (submission).
• username (string, optional) Username for authenticating with the SMTP server.
• password (string, optional) Password for authenticating with the SMTP server.
• sender_email (string, optional) Email address used as the From address on outgoing auth emails.
• sender_name (string, optional) Display name shown as the sender in outgoing emails.

• host (string, optional) Hostname of the email server.
• port (integer, optional) TCP port of the SMTP server. Common values: 25 (SMTP), 465 (SMTPS), 587 (submission).
• username (string, optional) Username for authenticating with the SMTP server.
• password (string, optional) On GET, returned redacted (empty) for ordinary callers, while callers with project-credential read permission receive the stored password — do not assume this field is empty. Update (PATCH) responses always return it redacted (empty) regardless of permission. Provide a value on update to set or rotate the password.
• sender_email (string, optional) Email address used as the From address on outgoing auth emails.
• sender_name (string, optional) Display name shown as the sender in outgoing emails.

curl "https://console.neon.tech/api/v2/projects/$PROJECT_ID/auth/email_server" \
  -X PATCH \
  -H "Authorization: Bearer $NEON_API_KEY"

import { createNeonClient, raw } from '@neon/sdk';

const neon = createNeonClient({ apiKey: process.env.NEON_API_KEY });
const { data } = await raw.updateNeonAuthEmailServer({
  client: neon.client,
  path: {
    project_id: process.env.PROJECT_ID
  }
});

default General Error.

The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received.

• If no response is returned from the API, a network error or timeout likely occurred.
• In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results.

The following HTTP methods are considered non-idempotent: POST, PATCH, DELETE, and PUT. Retrying these methods is generally not safe. The following methods are considered idempotent: GET, HEAD, and OPTIONS. Retrying these methods is safe in the event of a network error or timeout.

Any request that returns a 503 Service Unavailable response is always safe to retry.

Any request that returns a 423 Locked response is safe to retry. 423 Locked indicates that the resource is temporarily locked, for example, due to another operation in progress.

• request_id (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an X-Request-ID header in the request. If not provided, the value will be generated automatically.

• code (string, required) Machine-readable code classifying the error type. See message for a human-readable explanation. Default: ``

• message (string, required) Error message

API Reference / Legacy Auth / Update OAuth provider

Deprecated. Use /projects/{project_id}/branches/{branch_id}/auth/oauth_providers/{oauth_provider_id} instead. Removal scheduled for March 1, 2026.

• project_id (string, path, required) The Neon project ID
• oauth_provider_id (string, path, required) The OAuth provider ID

• client_id (string, optional) The OAuth client ID registered with the provider. Omit to keep the currently configured value.
• client_secret (string, optional) OAuth client secret for the provider. Omit to leave the existing secret unchanged.
• microsoft_tenant_id (string, optional) The tenant ID scoping the Microsoft OAuth provider. Supply this field when the provider type is microsoft; it has no effect for other provider types.

• id (string, optional) The OAuth provider's ID. Possible values: google, github, microsoft, vercel
• type (string, optional) OAuth provider key type. standard uses your own OAuth credentials. shared uses Neon-managed keys intended for development only; they display Neon branding on the OAuth consent screen and must not be used in production. Possible values: standard, shared
• client_id (string, optional) Public identifier for the OAuth application, issued by the provider when the application is registered.
• client_secret (string, optional) OAuth client secret for the provider.

curl "https://console.neon.tech/api/v2/projects/$PROJECT_ID/auth/oauth_providers/$OAUTH_PROVIDER_ID" \
  -X PATCH \
  -H "Authorization: Bearer $NEON_API_KEY"

import { createNeonClient, raw } from '@neon/sdk';

const neon = createNeonClient({ apiKey: process.env.NEON_API_KEY });
const { data } = await raw.updateNeonAuthOauthProvider({
  client: neon.client,
  path: {
    project_id: process.env.PROJECT_ID,
    oauth_provider_id: process.env.OAUTH_PROVIDER_ID
  }
});

default General Error.

The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received.

• If no response is returned from the API, a network error or timeout likely occurred.
• In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results.

The following HTTP methods are considered non-idempotent: POST, PATCH, DELETE, and PUT. Retrying these methods is generally not safe. The following methods are considered idempotent: GET, HEAD, and OPTIONS. Retrying these methods is safe in the event of a network error or timeout.

Any request that returns a 503 Service Unavailable response is always safe to retry.

Any request that returns a 423 Locked response is safe to retry. 423 Locked indicates that the resource is temporarily locked, for example, due to another operation in progress.

• request_id (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an X-Request-ID header in the request. If not provided, the value will be generated automatically.

• code (string, required) Machine-readable code classifying the error type. See message for a human-readable explanation. Default: ``

• message (string, required) Error message