`signIn`: Allow or Deny a User
Return true to continue, false to deny, or a URL to redirect. Provider parameters differ. For Google, the profile commonly includes email_verified; do not assume every provider has that property. Check account status against a trusted source when required.
Sign-in policy
callbacks: {
async signIn({ user, account, profile }) {
if (account?.provider === "google") {
return Boolean(user?.email && profile?.email_verified);
}
return Boolean(user?.email);
},
},💡 Adapt the policy to your actual provider and identity-verification requirements.