Add support for email retrieval on sign in for X/ Twitter Oauth 2.0

[alfredsadjei]

Goals

1. Allow for user email retrieval on sign in using the Twitter provider

Non-Goals

No response

Background

Currently Auth.js does not support email retrieval on sign in for Twitter/X OAuth 2.0. Given that this feature is now supported by X API V2, it would be great to have this supported by Auth.js as well.

Proposal

Given that the profile callback on the OAuth2Config<Profile> interface accepts both the entire profile retrieved by the OAuth provider as well as the retrieved token set, by modifying the twitter provider's auth scope ;

...
    authorization: "https://x.com/i/oauth2/authorize?scope=users.read tweet.read users.email offline.access",
...

we are able to simply fetch the user email (as described by x devs) and attach the resulting email data to the returned user object.

...
    async profile(profile, tokens) {
      const x_api_v2_email = await retrieveEmailForXApiV2(tokens.access_token)
      return {
        id: profile.data.id,
        name: profile.data.name,
        email: x_api_v2_email ?? null,
        image: profile.data.profile_image_url,
      }
    },

packages/core/src/lib/utils/providers.ts

export async function retrieveEmailForXApiV2(
  accessToken: string | undefined
): Promise<any | undefined> {
  if (!accessToken) return undefined
  const response = await fetch(
    "https://api.twitter.com/2/users/me?user.fields=confirmed_email",
    {
      headers: {
        Authorization: `Bearer ${accessToken}`,
      },
    }
  )
  const { data } = await response.json()
  return data.confirmed_email
}

Yes, I would be willing to contribute with a PR.

[Enrico2]

This works:

providers: [
    Google({ allowDangerousEmailAccountLinking: true }),
    Twitter({
      // Opt into OAuth 2.0 so we can request the newer scopes
      allowDangerousEmailAccountLinking: true,
      // Request the email-capable scope in addition to basic read + offline
      authorization: 'https://x.com/i/oauth2/authorize?scope=users.read%20tweet.read%20offline.access%20users.email',
      // Ask the v2 userinfo endpoint to include the confirmed email
      userinfo: 'https://api.x.com/2/users/me?user.fields=confirmed_email,profile_image_url,verified',
      // Map the provider profile to NextAuth's user shape, pulling email from confirmed_email when present
      profile(profile) {
        const data = profile.data as typeof profile.data & { confirmed_email: string | null }
        return {
          id: data.id,
          name: data.name,
          email: data.confirmed_email ?? null,
          image: data.profile_image_url ?? null,
        }
      },
    }),
  ]