Auth config

Providers, URLs, limits, hooks — secrets never shown