diff --git a/.vscode/extensions.json b/.vscode/extensions.json
new file mode 100644
index 0000000..a8f8f16
--- /dev/null
+++ b/.vscode/extensions.json
@@ -0,0 +1,22 @@
+{
+  "recommendations": [
+    "aaron-bond.better-comments",
+    "antfu.iconify",
+    "dbaeumer.vscode-eslint",
+    "editorconfig.editorconfig",
+    "github.copilot",
+    "github.copilot-chat",
+    "github.vscode-github-actions",
+    "ms-azuretools.vscode-docker",
+    "mtxr.sqltools",
+    "mtxr.sqltools-driver-pg",
+    "pflannery.vscode-versionlens",
+    "ritwickdey.liveserver",
+    "tamasfe.even-better-toml",
+    "visualstudioexptteam.intellicode-api-usage-examples",
+    "visualstudioexptteam.vscodeintellicode",
+    "vue.volar",
+    "vunguyentuan.vscode-css-variables",
+    "yoavbls.pretty-ts-errors"
+  ]
+}
diff --git a/app/composables/use-equipment-search.ts b/app/composables/use-equipment-search.ts
index 18647da..4a00934 100644
--- a/app/composables/use-equipment-search.ts
+++ b/app/composables/use-equipment-search.ts
@@ -4,7 +4,7 @@ import type { EquipmentItem } from '~/components/equipment/EquipmentTable.vue';
 interface EquipmentData {
   readonly id: string;
   readonly name: string | null;
-  readonly weight: number | null;
+  readonly weight: number;
   readonly createdAt: string;
 }
 
diff --git a/app/middleware/0.user.global.ts b/app/middleware/0.user.global.ts
index dfbb362..1939e76 100644
--- a/app/middleware/0.user.global.ts
+++ b/app/middleware/0.user.global.ts
@@ -1,4 +1,8 @@
-export default defineNuxtRouteMiddleware(async () => {
+export default defineNuxtRouteMiddleware(async (to) => {
+  if (shouldSkipAuth(to)) {
+    return
+  }
+
   if (import.meta.server) {
     const { getUser, user } = useUserStore()
 
diff --git a/app/middleware/1.auth.global.ts b/app/middleware/1.auth.global.ts
index ee8ae2f..134059e 100644
--- a/app/middleware/1.auth.global.ts
+++ b/app/middleware/1.auth.global.ts
@@ -1,6 +1,10 @@
 import { startPagePath } from '~~/constants';
 
 export default defineNuxtRouteMiddleware(async (to) => {
+  if (shouldSkipAuth(to)) {
+    return
+  }
+
   const { isAuthenticated } = useUserStore()
 
   if (isAuthenticated.value && to.path === '/login') {
diff --git a/app/models/oauth.ts b/app/models/oauth.ts
new file mode 100644
index 0000000..77c3128
--- /dev/null
+++ b/app/models/oauth.ts
@@ -0,0 +1 @@
+export type OAuthProvider = 'twitch'
diff --git a/app/models/twitch.ts b/app/models/twitch.ts
new file mode 100644
index 0000000..bbe76e6
--- /dev/null
+++ b/app/models/twitch.ts
@@ -0,0 +1,25 @@
+export interface TwitchUser {
+  readonly id: string;
+  readonly login: string;
+  readonly display_name: string;
+  readonly type: '' | 'staff' | 'admin' | 'global_mod';
+  readonly broadcaster_type: '' | 'affiliate' | 'partner';
+  readonly description: string;
+  readonly profile_image_url: string;
+  readonly offline_image_url: string;
+  readonly created_at: string;
+  // "user:read:email" scope required
+  readonly email?: string;
+}
+
+export interface TwitchOAuthTokenResponse {
+  readonly access_token: string;
+  readonly expires_in: number;
+  readonly refresh_token: string;
+  readonly token_type: string;
+  readonly scope?: string[];
+}
+
+export interface TwitchUsersResponse {
+  readonly data: TwitchUser[];
+}
diff --git a/app/pages/auth/twitch.vue b/app/pages/auth/twitch.vue
new file mode 100644
index 0000000..6b843e1
--- /dev/null
+++ b/app/pages/auth/twitch.vue
@@ -0,0 +1,109 @@
+<template>
+  <div :class="$style.component">
+    <div :class="$style.content">
+      <div :class="$style.progress">
+        <div
+          v-if="isFailed"
+          :class="$style.icon"
+        >
+          💀
+        </div>
+
+        <CircleSpinner
+          v-else
+        />
+      </div>
+
+      <div v-if="isFailed">
+        Failed to connect <strong>Twitch</strong>
+      </div>
+
+      <div v-else>
+        Connecting <strong>Twitch</strong>...
+      </div>
+
+      <PerdLink
+        v-if="isFailed"
+        to="/"
+      >
+        Return to Home
+      </PerdLink>
+    </div>
+  </div>
+</template>
+
+<script lang="ts" setup>
+  import { startPagePath } from '~~/constants'
+  import CircleSpinner from '~/components/CircleSpinner.vue'
+import PerdLink from '~/components/PerdLink.vue';
+
+  definePageMeta({
+    layout: false,
+    skipAuth: true
+  })
+
+  const isFailed = useState(() => false)
+  const route = useRoute()
+  const { user } = useUserStore()
+
+  async function handleConnect() {
+    try {
+      const result = await $fetch('/api/oauth/twitch', {
+        method: 'POST',
+
+        body: JSON.stringify({
+          code: route.query.code
+        })
+      })
+
+      if (result === undefined) {
+        throw new Error('Failed to connect Twitch')
+      }
+
+      user.value.userId = result.userId
+      user.value.isAdmin = result.isAdmin
+      user.value.hasData = true
+
+      await navigateTo(startPagePath, {
+        replace: true
+      })
+    } catch (error) {
+      isFailed.value = true
+    }
+  }
+
+  onBeforeMount(() => {
+    handleConnect()
+  })
+</script>
+
+<style module>
+  .component {
+    width: 100vw;
+    height: 100vh;
+    display: flex;
+    overflow: hidden;
+    padding: var(--spacing-24);
+  }
+
+  .content {
+    display: grid;
+    row-gap: var(--spacing-16);
+    margin: auto;
+    justify-items: center;
+    text-align: center;
+    text-wrap: balance;
+  }
+
+  .progress {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    width: 48px;
+    height: 48px;
+  }
+
+  .icon {
+    font-size: 32px;
+  }
+</style>
diff --git a/app/pages/login.vue b/app/pages/login.vue
index 05066c9..f9ca8d8 100644
--- a/app/pages/login.vue
+++ b/app/pages/login.vue
@@ -1,17 +1,21 @@
 <template>
   <div :class="$style.component">
-    <PerdButton @click="handleSignInClick">
-      Sign in anonymously
+    <PerdButton @click="signUp">
+      Sign up anonymously
     </PerdButton>
 
-    <PerdButton @click="handleSignInAdminClick">
-      Sign in as admin
-    </PerdButton>
+    <PerdLink
+      to="/api/oauth/twitch"
+      external
+    >
+      Sign in with Twitch
+    </PerdLink>
   </div>
 </template>
 
 <script lang="ts" setup>
   import PerdButton from '~/components/PerdButton.vue';
+  import PerdLink from '~/components/PerdLink.vue';
 
   definePageMeta({
     layout: 'page'
@@ -20,23 +24,15 @@
   const { user } = useUserStore()
   const route = useRoute()
 
-  async function signIn(isAdmin: boolean) {
+  async function signUp() {
     const response = await $fetch('/api/auth/create-session', {
-      method: 'POST',
-
-      body: {
-        isAdmin
-      }
+      method: 'POST'
     })
 
     if (typeof response.userId === 'string') {
       user.value.userId = response.userId
     }
 
-    if (response.isAdmin === true) {
-      user.value.isAdmin = true
-    }
-
     const redirectPath =
       typeof route.query.redirectTo === 'string'
         ? route.query.redirectTo
@@ -46,20 +42,13 @@
       replace: true
     })
   }
-
-  async function handleSignInClick() {
-    await signIn(false)
-  }
-
-  async function handleSignInAdminClick() {
-    await signIn(true)
-  }
 </script>
 
 <style module>
   .component {
-    display: flex;
+    display: grid;
     justify-content: center;
+    text-align: center;
     gap: var(--spacing-16);
     padding-top: var(--spacing-32);
   }
diff --git a/app/utils/fetch.ts b/app/utils/fetch.ts
deleted file mode 100644
index c5d5e22..0000000
--- a/app/utils/fetch.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-import { appendResponseHeader, H3Event } from 'h3'
-import { sessionCookieName } from '~~/constants'
-
-interface FetchOptions {
-  headers: HeadersInit;
-}
-
-export async function fetchWithCookies(event: H3Event, url: string, options?: FetchOptions) {
-  const response = await $fetch.raw(url, {
-    headers: options?.headers
-  })
-
-  const rawCookie = response.headers.get('set-cookie') || ''
-  const cookies = rawCookie.split(',')
-
-  const sessionCookie = cookies.find(
-    cookie => cookie.split('=')[0] === sessionCookieName
-  )
-
-  if (sessionCookie !== undefined) {
-    appendResponseHeader(event, 'set-cookie', sessionCookie)
-  }
-
-  return response._data
-}
diff --git a/app/utils/router.ts b/app/utils/router.ts
new file mode 100644
index 0000000..97c4646
--- /dev/null
+++ b/app/utils/router.ts
@@ -0,0 +1,5 @@
+import type { RouteLocationNormalized } from 'vue-router'
+
+export function shouldSkipAuth(to: RouteLocationNormalized) {
+  return to.meta.skipAuth === true
+}
diff --git a/constants.ts b/constants.ts
index 0a54786..9f88e0f 100644
--- a/constants.ts
+++ b/constants.ts
@@ -4,7 +4,9 @@ export const sessionSecret = 'e2353edd-0a91-4d60-bf3a-715fab5f6c00'
 export const startPagePath = '/'
 
 export const publicApiPaths = [
-  '/auth/create-session'
+  '/auth/create-session',
+  '/oauth',
+  '/oauth/twitch'
 ]
 
 export const limits = {
diff --git a/docker-compose.yml b/docker-compose.yml
index e2962f3..131dd61 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -6,11 +6,44 @@ services:
       POSTGRES_PASSWORD: perd
       POSTGRES_USER: perd
       POSTGRES_DB: perd
-    command: postgres -c max_connections=1000
+    command: -c max_connections=1000
+    restart: unless-stopped
     ports:
       - "5432:5432"
     volumes:
       - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: [ 'CMD-SHELL', 'pg_isready -U perd' ]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  # https://github.com/neondatabase/neon/issues/4989
+  # https://github.com/neondatabase/serverless/issues/33#issuecomment-1634853042
+  # https://github.com/TimoWilhelm/local-neon-http-proxy/tree/main
+  # https://readme.localtest.me/
+  neon-proxy:
+    image: ghcr.io/timowilhelm/local-neon-http-proxy:main
+    environment:
+      - PG_CONNECTION_STRING=postgres://perd:perd@postgres:5432/perd
+    restart: unless-stopped
+    ports:
+      - '4444:4444'
+    depends_on:
+      postgres:
+        condition: service_healthy
+
+  neon-wsproxy:
+    image: ghcr.io/neondatabase/wsproxy:latest
+    environment:
+      APPEND_PORT: postgres:5432
+      ALLOW_ADDR_REGEX: .*
+      LOG_TRAFFIC: true
+    ports:
+      - "5433:80"
+    depends_on:
+      postgres:
+        condition: service_healthy
 
 volumes:
   postgres_data:
diff --git a/nuxt.config.ts b/nuxt.config.ts
index 19c5f09..ffa7c43 100644
--- a/nuxt.config.ts
+++ b/nuxt.config.ts
@@ -9,6 +9,10 @@ export default defineNuxtConfig({
     viewTransition: true
   },
 
+  typescript: {
+    strict: true
+  },
+
   devtools: {
     enabled: true
   },
diff --git a/package-lock.json b/package-lock.json
index f97fd05..8175708 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -19,13 +19,15 @@
         "@neondatabase/serverless": "0.9.4",
         "@nuxt/fonts": "0.7.2",
         "@nuxt/icon": "1.4.10",
+        "@types/ws": "8.5.12",
         "@vueuse/core": "11.0.3",
+        "consola": "3.2.3",
         "drizzle-kit": "0.24.1",
-        "postgres": "3.4.4",
         "sass": "1.77.8",
         "ufo": "1.5.4",
         "valibot": "0.39.0",
-        "wrangler": "3.72.2"
+        "wrangler": "3.72.2",
+        "ws": "8.18.0"
       }
     },
     "node_modules/@ampproject/remapping": {
@@ -3092,6 +3094,16 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@types/ws": {
+      "version": "8.5.12",
+      "resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.5.12.tgz",
+      "integrity": "sha512-3tPRkv1EtkDpzlgyKyI8pGsGZAGPEaXeu0DOj5DI25Ja91bdAYddYHbADRYVrZMRbfW+1l5YwXVDKohDJNQxkQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
     "node_modules/@unhead/dom": {
       "version": "1.10.0",
       "resolved": "https://registry.npmjs.org/@unhead/dom/-/dom-1.10.0.tgz",
@@ -9226,8 +9238,9 @@
       "version": "3.4.4",
       "resolved": "https://registry.npmjs.org/postgres/-/postgres-3.4.4.tgz",
       "integrity": "sha512-IbyN+9KslkqcXa8AO9fxpk97PA4pzewvpi2B3Dwy9u4zpV32QicaEdgmF3eSQUzdRk7ttDHQejNgAEr4XoeH4A==",
-      "devOptional": true,
       "license": "Unlicense",
+      "optional": true,
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
diff --git a/package.json b/package.json
index d38eb4e..d4e4f03 100644
--- a/package.json
+++ b/package.json
@@ -26,12 +26,14 @@
     "@neondatabase/serverless": "0.9.4",
     "@nuxt/fonts": "0.7.2",
     "@nuxt/icon": "1.4.10",
+    "@types/ws": "8.5.12",
     "@vueuse/core": "11.0.3",
+    "consola": "3.2.3",
     "drizzle-kit": "0.24.1",
-    "postgres": "3.4.4",
     "sass": "1.77.8",
     "ufo": "1.5.4",
     "valibot": "0.39.0",
-    "wrangler": "3.72.2"
+    "wrangler": "3.72.2",
+    "ws": "8.18.0"
   }
 }
diff --git a/server/api/auth/create-session.post.ts b/server/api/auth/create-session.post.ts
index 9a28ac8..4fad0c1 100644
--- a/server/api/auth/create-session.post.ts
+++ b/server/api/auth/create-session.post.ts
@@ -1,12 +1,12 @@
 export default defineEventHandler(async (event) => {
   const { db } = event.context
-  const body = await readBody(event)
-  const isRequestAdmin = body?.isAdmin === true
 
-  const [{ userId, isAdmin }] = await db
+  // TODO (#101): check if user is already logged in
+
+  const [{ userId }] = await db
     .insert(tables.users)
     .values({
-      isAdmin: isRequestAdmin
+      isAdmin: false
     })
     .returning({
       userId: tables.users.id,
@@ -22,7 +22,6 @@ export default defineEventHandler(async (event) => {
   })
 
   return {
-    userId,
-    isAdmin
+    userId
   }
 })
diff --git a/server/api/auth/logout.post.ts b/server/api/auth/logout.post.ts
index 5fabd43..cf069c5 100644
--- a/server/api/auth/logout.post.ts
+++ b/server/api/auth/logout.post.ts
@@ -1,9 +1,7 @@
-import { sessionCookieName } from "~~/constants"
-
 export default defineEventHandler(async (event) => {
-  setCookie(event, sessionCookieName, '', {
-    expires: new Date(0)
-  })
+  const session = await useAppSession(event)
+
+  session.clear()
 
-  return {}
+  sendNoContent(event)
 })
diff --git a/server/api/oauth/twitch/index.get.ts b/server/api/oauth/twitch/index.get.ts
new file mode 100644
index 0000000..d7612ab
--- /dev/null
+++ b/server/api/oauth/twitch/index.get.ts
@@ -0,0 +1,30 @@
+import { consola } from 'consola'
+
+export default defineEventHandler(async (event) => {
+  // TODO (#102): Check if the user is already logged in and linked their account
+  // https://www.youtube.com/watch?v=dQw4w9WgXcQ
+
+  const { OAUTH_TWITCH_CLIENT_ID } = process.env
+
+  if (OAUTH_TWITCH_CLIENT_ID === undefined) {
+    consola.error('OAUTH_TWITCH_CLIENT_ID is not defined')
+
+    throw createError({
+      statusCode: 500,
+      message: 'Internal server error',
+    })
+  }
+
+  const authUrl = new URL('https://id.twitch.tv/oauth2/authorize')
+  const redirectUri = getTwitchRedirectUri(event)
+
+  // TODO (#103): Add `state` to prevent CSRF attacks
+  // https://dev.twitch.tv/docs/authentication/getting-tokens-oauth/#use-the-authorization-code-to-get-a-token
+  authUrl.searchParams.append('response_type', 'code')
+  authUrl.searchParams.append('client_id', OAUTH_TWITCH_CLIENT_ID)
+  authUrl.searchParams.append('redirect_uri', redirectUri)
+
+  const twitchAuthUrl = authUrl.toString()
+
+  sendRedirect(event, twitchAuthUrl)
+})
diff --git a/server/api/oauth/twitch/index.post.ts b/server/api/oauth/twitch/index.post.ts
new file mode 100644
index 0000000..5eb1ceb
--- /dev/null
+++ b/server/api/oauth/twitch/index.post.ts
@@ -0,0 +1,45 @@
+import * as v from 'valibot'
+
+const bodySchema = v.object({
+  code: v.pipe(v.string(), v.nonEmpty())
+})
+function validateBody(body: unknown) {
+  return v.parse(bodySchema, body)
+}
+
+export default defineEventHandler(async (event) => {
+  const { code } = await readValidatedBody(event, validateBody)
+  const token = await getTwitchOAuthToken(event, code)
+  const { id: twitchAccountId } = await getTwitchUserInfo(token)
+  const currentUser = await getSessionUser(event)
+
+  // Not logged in
+  if (currentUser.userId === null) {
+    const foundUser = await getUserByOAuthAccount(event, 'twitch', twitchAccountId)
+
+    // Twith account not linked to any user
+    if (foundUser.userId === null) {
+      // Create a new user with the OAuth account
+      const newUser = await createOAuthUser('twitch', twitchAccountId)
+
+      await updateAppSession(event, newUser)
+
+      return newUser
+    }
+
+    // User already linked their Twitch account
+    await updateAppSession(event, {
+      userId: foundUser.userId,
+      isAdmin: foundUser.isAdmin
+    })
+
+    return foundUser
+  }
+
+  // TODO (#104): Link the Twitch account to the current user
+
+  throw createError({
+    message: 'Not implemented',
+    statusCode: 501
+  })
+})
diff --git a/server/api/user/index.get.ts b/server/api/user/index.get.ts
index 32931ea..8e5b37e 100644
--- a/server/api/user/index.get.ts
+++ b/server/api/user/index.get.ts
@@ -1,35 +1,3 @@
-import { eq } from 'drizzle-orm'
-
 export default defineEventHandler(async (event) => {
-  const defaultUser = {
-    userId: null,
-    isAdmin: false
-  }
-
-  const session = await useAppSession(event)
-  const { userId } = session.data
-
-  if (userId === undefined) {
-    return defaultUser
-  }
-
-  // Check if the user in database
-  const users = await event.context.db.query.users
-    .findFirst({
-      columns: {
-        id: true,
-        isAdmin: true
-      },
-
-      where: eq(tables.users.id, userId)
-    })
-
-  if (users?.id === undefined) {
-    return defaultUser
-  }
-
-  return {
-    userId: users.id,
-    isAdmin: users.isAdmin
-  }
+  return await getSessionUser(event)
 })
diff --git a/server/database/migrations/0002_thin_jimmy_woo.sql b/server/database/migrations/0002_thin_jimmy_woo.sql
new file mode 100644
index 0000000..38e3fd4
--- /dev/null
+++ b/server/database/migrations/0002_thin_jimmy_woo.sql
@@ -0,0 +1,28 @@
+CREATE TABLE IF NOT EXISTS "oauthAccounts" (
+	"id" "ulid" PRIMARY KEY DEFAULT gen_ulid() NOT NULL,
+	"userId" "ulid" NOT NULL,
+	"providerId" "ulid" NOT NULL,
+	"accountId" varchar NOT NULL,
+	"createdAt" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "oauthAccounts_providerId_accountId_unique" UNIQUE("providerId","accountId")
+);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS "oauthProviders" (
+	"id" "ulid" PRIMARY KEY DEFAULT gen_ulid() NOT NULL,
+	"type" varchar(32) NOT NULL,
+	"name" varchar(255) NOT NULL,
+	"createdAt" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "oauthProviders_type_unique" UNIQUE("type")
+);
+--> statement-breakpoint
+DO $$ BEGIN
+ ALTER TABLE "oauthAccounts" ADD CONSTRAINT "oauthAccounts_userId_users_id_fk" FOREIGN KEY ("userId") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE cascade;
+EXCEPTION
+ WHEN duplicate_object THEN null;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+ ALTER TABLE "oauthAccounts" ADD CONSTRAINT "oauthAccounts_providerId_oauthProviders_id_fk" FOREIGN KEY ("providerId") REFERENCES "public"."oauthProviders"("id") ON DELETE cascade ON UPDATE cascade;
+EXCEPTION
+ WHEN duplicate_object THEN null;
+END $$;
diff --git a/server/database/migrations/meta/0002_snapshot.json b/server/database/migrations/meta/0002_snapshot.json
new file mode 100644
index 0000000..15ff34e
--- /dev/null
+++ b/server/database/migrations/meta/0002_snapshot.json
@@ -0,0 +1,406 @@
+{
+  "id": "9e2102ae-52eb-4dff-b112-83e4759eded4",
+  "prevId": "753077c6-adb2-4a1c-b4d4-34de92430719",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.checklistItems": {
+      "name": "checklistItems",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "ulid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_ulid()"
+        },
+        "checklistId": {
+          "name": "checklistId",
+          "type": "ulid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "equipmentId": {
+          "name": "equipmentId",
+          "type": "ulid",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "checklistItems_checklistId_checklists_id_fk": {
+          "name": "checklistItems_checklistId_checklists_id_fk",
+          "tableFrom": "checklistItems",
+          "tableTo": "checklists",
+          "columnsFrom": [
+            "checklistId"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "cascade"
+        },
+        "checklistItems_equipmentId_equipment_id_fk": {
+          "name": "checklistItems_equipmentId_equipment_id_fk",
+          "tableFrom": "checklistItems",
+          "tableTo": "equipment",
+          "columnsFrom": [
+            "equipmentId"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "cascade"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "checklistItems_checklistId_equipmentId_unique": {
+          "name": "checklistItems_checklistId_equipmentId_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "checklistId",
+            "equipmentId"
+          ]
+        }
+      }
+    },
+    "public.checklists": {
+      "name": "checklists",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "ulid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_ulid()"
+        },
+        "userId": {
+          "name": "userId",
+          "type": "ulid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(32)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "createdAt": {
+          "name": "createdAt",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "createdAtIndex": {
+          "name": "createdAtIndex",
+          "columns": [
+            {
+              "expression": "createdAt",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "checklists_userId_users_id_fk": {
+          "name": "checklists_userId_users_id_fk",
+          "tableFrom": "checklists",
+          "tableTo": "users",
+          "columnsFrom": [
+            "userId"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "cascade"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {}
+    },
+    "public.equipment": {
+      "name": "equipment",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "ulid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_ulid()"
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "weight": {
+          "name": "weight",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "createdAt": {
+          "name": "createdAt",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {}
+    },
+    "public.oauthAccounts": {
+      "name": "oauthAccounts",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "ulid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_ulid()"
+        },
+        "userId": {
+          "name": "userId",
+          "type": "ulid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "providerId": {
+          "name": "providerId",
+          "type": "ulid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "accountId": {
+          "name": "accountId",
+          "type": "varchar",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "createdAt": {
+          "name": "createdAt",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "oauthAccounts_userId_users_id_fk": {
+          "name": "oauthAccounts_userId_users_id_fk",
+          "tableFrom": "oauthAccounts",
+          "tableTo": "users",
+          "columnsFrom": [
+            "userId"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "cascade"
+        },
+        "oauthAccounts_providerId_oauthProviders_id_fk": {
+          "name": "oauthAccounts_providerId_oauthProviders_id_fk",
+          "tableFrom": "oauthAccounts",
+          "tableTo": "oauthProviders",
+          "columnsFrom": [
+            "providerId"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "cascade"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "oauthAccounts_providerId_accountId_unique": {
+          "name": "oauthAccounts_providerId_accountId_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "providerId",
+            "accountId"
+          ]
+        }
+      }
+    },
+    "public.oauthProviders": {
+      "name": "oauthProviders",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "ulid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_ulid()"
+        },
+        "type": {
+          "name": "type",
+          "type": "varchar(32)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "createdAt": {
+          "name": "createdAt",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "oauthProviders_type_unique": {
+          "name": "oauthProviders_type_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "type"
+          ]
+        }
+      }
+    },
+    "public.userEquipment": {
+      "name": "userEquipment",
+      "schema": "",
+      "columns": {
+        "userId": {
+          "name": "userId",
+          "type": "ulid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "equipmentId": {
+          "name": "equipmentId",
+          "type": "ulid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "createdAt": {
+          "name": "createdAt",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "userEquipment_userId_users_id_fk": {
+          "name": "userEquipment_userId_users_id_fk",
+          "tableFrom": "userEquipment",
+          "tableTo": "users",
+          "columnsFrom": [
+            "userId"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "cascade"
+        },
+        "userEquipment_equipmentId_equipment_id_fk": {
+          "name": "userEquipment_equipmentId_equipment_id_fk",
+          "tableFrom": "userEquipment",
+          "tableTo": "equipment",
+          "columnsFrom": [
+            "equipmentId"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "cascade"
+        }
+      },
+      "compositePrimaryKeys": {
+        "userEquipment_userId_equipmentId_pk": {
+          "name": "userEquipment_userId_equipmentId_pk",
+          "columns": [
+            "userId",
+            "equipmentId"
+          ]
+        }
+      },
+      "uniqueConstraints": {}
+    },
+    "public.users": {
+      "name": "users",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "ulid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_ulid()"
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(32)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "createdAt": {
+          "name": "createdAt",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "isAdmin": {
+          "name": "isAdmin",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {}
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
\ No newline at end of file
diff --git a/server/database/migrations/meta/_journal.json b/server/database/migrations/meta/_journal.json
index 1b9d173..35c2086 100644
--- a/server/database/migrations/meta/_journal.json
+++ b/server/database/migrations/meta/_journal.json
@@ -15,6 +15,13 @@
       "when": 1724101985802,
       "tag": "0001_magenta_mordo",
       "breakpoints": true
+    },
+    {
+      "idx": 2,
+      "version": "7",
+      "when": 1724876180185,
+      "tag": "0002_thin_jimmy_woo",
+      "breakpoints": true
     }
   ]
 }
\ No newline at end of file
diff --git a/server/database/schema.ts b/server/database/schema.ts
index 9953e2b..d1f9627 100644
--- a/server/database/schema.ts
+++ b/server/database/schema.ts
@@ -15,6 +15,8 @@ import {
 
 /**
  * Custom types
+ *
+ * These are custom types that are not supported by the default drizzle-orm
  */
 
 // Neon ulid type
@@ -27,6 +29,8 @@ const ulid = customType<{ data: string }>({
 
 /**
  * Users table
+ *
+ * This table is used to store user information
  */
 
 export const users = pgTable('users', {
@@ -53,8 +57,89 @@ export const users = pgTable('users', {
     .default(false)
 })
 
+/**
+ * OAuth providers table
+ *
+ * This table is used to store OAuth providers
+ * For example, Twitch, Google, Facebook, etc.
+ */
+
+export const oauthProviders = pgTable('oauthProviders', {
+  id:
+    ulid('id')
+    .notNull()
+    .default(sql`gen_ulid()`)
+    .primaryKey(),
+
+  type:
+    varchar('type', {
+      length: 32
+    })
+    .notNull()
+    .unique(),
+
+  name:
+    varchar('name', {
+      length: 255
+    })
+    .notNull(),
+
+  createdAt:
+    timestamp('createdAt', {
+      withTimezone: true
+    })
+    .notNull()
+    .defaultNow()
+})
+
+/**
+ * OAuth accounts table
+ *
+ * This table is used to store OAuth accounts linked to the user
+ * For example, if the user logs in with Twitch, we store the Twitch account ID here
+ */
+
+export const oauthAccounts = pgTable('oauthAccounts', {
+  id:
+    ulid('id')
+    .notNull()
+    .default(sql`gen_ulid()`)
+    .primaryKey(),
+
+  userId:
+    ulid('userId')
+    .notNull()
+    .references(() => users.id, {
+      onDelete: 'cascade',
+      onUpdate: 'cascade'
+    }),
+
+  providerId:
+    ulid('providerId')
+    .notNull()
+    .references(() => oauthProviders.id, {
+      onDelete: 'cascade',
+      onUpdate: 'cascade'
+    }),
+
+  accountId:
+    varchar('accountId')
+    .notNull(),
+
+  createdAt:
+    timestamp('createdAt', {
+      withTimezone: true
+    })
+    .notNull()
+    .defaultNow()
+}, (table) => ({
+  uniqueProviderIdAccountId: unique().on(table.providerId, table.accountId)
+}))
+
 /**
  * Equipment table
+ *
+ * This table is used to store equipment items
  */
 
 export const equipment = pgTable('equipment', {
@@ -84,6 +169,8 @@ export const equipment = pgTable('equipment', {
 
 /**
  * User's equipment table
+ *
+ * This table is used to store the user's equipment
  */
 
 export const userEquipment = pgTable('userEquipment', {
@@ -117,6 +204,8 @@ export const userEquipment = pgTable('userEquipment', {
 
 /**
  * User's checklists table
+ *
+ * This table is used to store the user's checklists
  */
 
 export const checklists = pgTable('checklists', {
@@ -154,6 +243,8 @@ export const checklists = pgTable('checklists', {
 
 /**
  * Checklist items table
+ *
+ * This table is used to store the checklist items
  */
 
 export const checklistItems = pgTable('checklistItems', {
@@ -188,7 +279,12 @@ export const checklistItems = pgTable('checklistItems', {
 
 export const usersRelations = relations(users, ({ many }) => ({
   userEquipment: many(userEquipment),
-  checklists: many(checklists)
+  checklists: many(checklists),
+  oauthAccounts: many(oauthAccounts)
+}))
+
+export const oauthProvidersRelations = relations(oauthProviders, ({ many }) => ({
+  oauthAccounts: many(oauthAccounts)
 }))
 
 export const equipmentRelations = relations(equipment, ({ many }) => ({
@@ -196,6 +292,18 @@ export const equipmentRelations = relations(equipment, ({ many }) => ({
   checklistItems: many(checklistItems)
 }))
 
+export const oauthAccountsRelations = relations(oauthAccounts, ({ one }) => ({
+  user: one(users, {
+    fields: [oauthAccounts.userId],
+    references: [users.id]
+  }),
+
+  provider: one(oauthProviders, {
+    fields: [oauthAccounts.providerId],
+    references: [oauthProviders.id]
+  })
+}))
+
 export const userEquipmentRelations = relations(userEquipment, ({ one }) => ({
   user: one(users, {
     fields: [userEquipment.userId],
diff --git a/server/middleware/api-session-check.ts b/server/middleware/api-session-check.ts
index 2d27b27..174926e 100644
--- a/server/middleware/api-session-check.ts
+++ b/server/middleware/api-session-check.ts
@@ -4,12 +4,13 @@ import { publicApiPaths } from '~~/constants'
 const apiBase = '/api'
 
 export default defineEventHandler(async (event) => {
-  const session = await useAppSession(event)
-  const { userId } = session.data
   const url = getRequestURL(event)
   const isApiPath = url.pathname.startsWith(apiBase)
 
   if (isApiPath) {
+    const session = await getAppSession(event)
+    const { userId } = session.data
+
     const isPublic = publicApiPaths.some((path) => {
       const apiPath = withBase(path, apiBase)
 
diff --git a/server/middleware/database.ts b/server/middleware/database.ts
index 1a42929..946d454 100644
--- a/server/middleware/database.ts
+++ b/server/middleware/database.ts
@@ -1,9 +1,8 @@
-import { NeonHttpDatabase } from 'drizzle-orm/neon-http'
-import { PostgresJsDatabase } from 'drizzle-orm/postgres-js'
+import type { NeonHttpDatabase } from 'drizzle-orm/neon-http'
 
 export default defineEventHandler(async ({ context }) => {
   if (context.db === undefined) {
-    const drizzleDb = await createDrizzle()
+    const drizzleDb = createDrizzle()
 
     context.db = drizzleDb
   }
@@ -11,6 +10,6 @@ export default defineEventHandler(async ({ context }) => {
 
 declare module 'h3' {
   interface H3EventContext {
-    db: NeonHttpDatabase<typeof tables> | PostgresJsDatabase<typeof tables>
+    db: NeonHttpDatabase<typeof tables>
   }
 }
diff --git a/server/utils/database.ts b/server/utils/database.ts
index d44573e..e988ea0 100644
--- a/server/utils/database.ts
+++ b/server/utils/database.ts
@@ -1,40 +1,57 @@
-import { type PostgresJsDatabase } from 'drizzle-orm/postgres-js'
-import { drizzle as drizzleNeon, NeonHttpDatabase } from 'drizzle-orm/neon-http'
-import { neon } from '@neondatabase/serverless'
+import { drizzle as drizzleNeon } from 'drizzle-orm/neon-http'
+import { drizzle as drizzleServerless } from 'drizzle-orm/neon-serverless'
+import { neon, neonConfig, Pool } from '@neondatabase/serverless'
+import ws from 'ws'
 import * as schema from '../database/schema'
 
+
 export const tables = schema
 
-export async function createDrizzle() {
+export function createDrizzle() {
   if (process.env.DATABASE_URL === undefined) {
     throw new Error('DATABASE_URL is not defined')
   }
 
-  let drizzleDb :  NeonHttpDatabase<typeof tables> | PostgresJsDatabase<typeof tables>
-
-  if (import.meta.dev) {
-    const imports = await Promise.all([
-      import('postgres'),
-      import('drizzle-orm/postgres-js')
-    ])
-
-    const postgres = imports[0].default
-    const { drizzle: drizzlePostgres } = imports[1]
-    const db = postgres(process.env.DATABASE_URL)
-
-    drizzleDb = drizzlePostgres(db, {
-      schema,
-      logger: true
-    })
-  } else {
-    const db = neon(process.env.DATABASE_URL)
-
-    drizzleDb = drizzleNeon(db, {
-      schema,
-      logger: true
-    })
+  if (import.meta.dev === true) {
+    // Check docker-compose.yml for the details
+    neonConfig.fetchEndpoint = 'http://db.localtest.me:4444/sql'
   }
 
+  const db = neon(process.env.DATABASE_URL)
+
+  const drizzleDb = drizzleNeon(db, {
+    schema,
+    logger: true
+  })
+
+  return drizzleDb
+}
+
+/**
+ * Create a Drizzle database instance with WebSocket support.
+ * It requires for transactional operations.
+ *
+ * @see {@link https://orm.drizzle.team/docs/get-started-postgresql#neon-postgres}
+ * @see {@link https://github.com/neondatabase/serverless?tab=readme-ov-file#sessions-transactions-and-node-postgres-compatibility}
+ */
+export function createDrizzleWebsocket() {
+  neonConfig.webSocketConstructor = ws
+
+  if (import.meta.dev === true) {
+    neonConfig.wsProxy = (host) => `${host}:5433/v1`
+    neonConfig.useSecureWebSocket = false;
+    neonConfig.pipelineTLS = false;
+    neonConfig.pipelineConnect = false;
+  }
+
+  const pool = new Pool({
+    connectionString: process.env.DATABASE_URL
+  })
+
+  const drizzleDb = drizzleServerless(pool, {
+    schema,
+    logger: true
+  })
 
   return drizzleDb
 }
diff --git a/server/utils/providers/twitch.ts b/server/utils/providers/twitch.ts
new file mode 100644
index 0000000..ab9e52e
--- /dev/null
+++ b/server/utils/providers/twitch.ts
@@ -0,0 +1,101 @@
+import { H3Event } from 'h3'
+import consola from 'consola'
+import { joinURL } from 'ufo'
+
+import {
+  TwitchOAuthTokenResponse,
+  TwitchUser,
+  TwitchUsersResponse
+} from '~/models/twitch'
+
+export function getTwitchRedirectUri(event: H3Event) : string {
+  const url = getRequestURL(event)
+  const redirectUri = joinURL(url.origin, '/auth/twitch')
+
+  return redirectUri
+}
+
+export async function getTwitchOAuthToken(event: H3Event, code: string) : Promise<string> {
+  const {
+    OAUTH_TWITCH_CLIENT_ID,
+    OAUTH_TWITCH_CLIENT_SECRET
+  } = process.env
+
+  if (OAUTH_TWITCH_CLIENT_ID === undefined) {
+    consola.error('OAUTH_TWITCH_CLIENT_ID is not defined')
+
+    throw createError({
+      statusCode: 500,
+      message: 'Internal server error',
+    })
+  }
+
+  if (OAUTH_TWITCH_CLIENT_SECRET === undefined) {
+    consola.error('OAUTH_TWITCH_CLIENT_SECRET is not defined')
+
+    throw createError({
+      statusCode: 500,
+      message: 'Internal server error',
+    })
+  }
+
+  try {
+    const redirectUri = getTwitchRedirectUri(event)
+
+    const tokenResponse = await $fetch<TwitchOAuthTokenResponse>('https://id.twitch.tv/oauth2/token', {
+      method: 'POST',
+
+      body: {
+        client_id: OAUTH_TWITCH_CLIENT_ID,
+        client_secret: OAUTH_TWITCH_CLIENT_SECRET,
+        code,
+        grant_type: 'authorization_code',
+        redirect_uri: redirectUri
+      }
+    })
+
+    return tokenResponse.access_token
+  } catch (error) {
+    consola.error(error)
+
+    throw createError({
+      statusCode: 400,
+      message: 'Failed to obtain OAuth token',
+    })
+  }
+}
+
+export async function getTwitchUserInfo(accessToken: string) : Promise<TwitchUser> {
+  const { OAUTH_TWITCH_CLIENT_ID } = process.env
+
+  if (OAUTH_TWITCH_CLIENT_ID === undefined) {
+    console.error('OAUTH_TWITCH_CLIENT_ID is not defined')
+
+    throw createError({
+      statusCode: 500,
+      message: 'Internal server error',
+    })
+  }
+
+  try {
+    const users = await $fetch<TwitchUsersResponse>('https://api.twitch.tv/helix/users', {
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        'Client-ID': OAUTH_TWITCH_CLIENT_ID
+      }
+    })
+
+    if (users.data[0] === undefined) {
+      throw new Error('No user data found')
+    }
+
+    return users.data[0]
+  } catch (error) {
+    consola.error(error)
+
+    throw createError({
+      statusCode: 400,
+      message: 'Failed to get user info',
+    })
+  }
+}
diff --git a/server/utils/session.ts b/server/utils/session.ts
index 0773fd0..9138997 100644
--- a/server/utils/session.ts
+++ b/server/utils/session.ts
@@ -1,20 +1,32 @@
-import type { H3Event, EventHandlerRequest } from 'h3'
+import type { H3Event, EventHandlerRequest, SessionConfig } from 'h3'
 import { sessionCookieName, sessionSecret } from '~~/constants';
 
-interface SessionData {
+export interface SessionData {
   userId?: string;
   isAdmin?: boolean;
   lastAdminCheck?: string;
 }
 
+const sessionConfig : SessionConfig = {
+  // TODO (#105): use environment variables
+  password: sessionSecret,
+  name: sessionCookieName,
+
+  cookie: {
+    sameSite: 'strict',
+    httpOnly: true,
+    secure: true
+  }
+}
+
 export async function useAppSession(event: H3Event<EventHandlerRequest>) {
-  return useSession<SessionData>(event, {
-    // TODO: use environment variables
-    password: sessionSecret,
-    name: sessionCookieName,
+  return useSession<SessionData>(event, sessionConfig)
+}
+
+export async function getAppSession(event: H3Event<EventHandlerRequest>) {
+  return getSession<SessionData>(event, sessionConfig)
+}
 
-    cookie: {
-      sameSite: 'strict'
-    }
-  })
+export async function updateAppSession(event: H3Event<EventHandlerRequest>, data: SessionData) {
+  return updateSession(event, sessionConfig, data)
 }
diff --git a/server/utils/user.ts b/server/utils/user.ts
new file mode 100644
index 0000000..2bca78f
--- /dev/null
+++ b/server/utils/user.ts
@@ -0,0 +1,133 @@
+import type { H3Event } from 'h3'
+import { and, eq } from 'drizzle-orm'
+import { OAuthProvider } from '~/models/oauth';
+
+interface ReturnUser {
+  readonly userId: string | null;
+  readonly isAdmin: boolean;
+}
+
+const defaultUser : ReturnUser = {
+  userId: null,
+  isAdmin: false
+}
+
+export async function getSessionUser(event: H3Event) : Promise<ReturnUser> {
+  const session = await useAppSession(event)
+  const { userId } = session.data
+
+  if (userId === undefined) {
+    return defaultUser
+  }
+
+  // Check if the user in database
+  const users = await event.context.db.query.users
+    .findFirst({
+      columns: {
+        id: true,
+        isAdmin: true
+      },
+
+      where: eq(tables.users.id, userId)
+    })
+
+  if (users?.id === undefined) {
+    return defaultUser
+  }
+
+  return {
+    userId: users.id,
+    isAdmin: users.isAdmin
+  }
+}
+
+export async function getUserByOAuthAccount(
+  event: H3Event,
+  provider: OAuthProvider,
+  accountId: string
+) : Promise<ReturnUser> {
+  const { db } = event.context
+
+  const [foundUser] = await db
+    .select({
+      userId: tables.oauthAccounts.userId,
+      isAdmin: tables.users.isAdmin
+    })
+    .from(tables.oauthAccounts)
+    .innerJoin(
+      tables.oauthProviders,
+
+      and(
+        eq(tables.oauthProviders.id, tables.oauthAccounts.providerId),
+        eq(tables.oauthProviders.type, provider),
+        eq(tables.oauthAccounts.accountId, accountId)
+      )
+    )
+    .innerJoin(
+      tables.users,
+      eq(tables.users.id, tables.oauthAccounts.userId)
+    )
+
+  return foundUser ?? defaultUser
+}
+
+export async function createOAuthUser(
+  provider: OAuthProvider,
+  accountId: string
+) {
+  const db = createDrizzleWebsocket()
+
+  const newUser = await db.transaction(async (transaction) => {
+    const providerData = await transaction.query.oauthProviders.findFirst({
+      columns: {
+        id: true
+      },
+
+      where: eq(tables.oauthProviders.type, provider)
+    })
+
+    if (providerData === undefined) {
+      throw createError({
+        message: `OAuth provider ${provider} not found`,
+        statusCode: 404
+      })
+    }
+
+    // Create a new user
+    const [{ userId, isAdmin }] = await transaction
+      .insert(tables.users)
+      .values({
+        isAdmin: false
+      })
+      .returning({
+        userId: tables.users.id,
+        isAdmin: tables.users.isAdmin
+      })
+
+    if (userId === undefined) {
+      throw createError({
+        message: 'Failed to create user',
+        statusCode: 500
+      })
+    }
+
+    // Link the user to the OAuth provider
+    await transaction
+      .insert(tables.oauthAccounts)
+      .values({
+        userId,
+        accountId,
+        providerId: providerData.id
+      })
+
+    return {
+      userId,
+      isAdmin
+    }
+  })
+
+  return {
+    userId: newUser.userId,
+    isAdmin: newUser.isAdmin
+  }
+}
diff --git a/types/index.d.ts b/types/index.d.ts
new file mode 100644
index 0000000..1e8ab40
--- /dev/null
+++ b/types/index.d.ts
@@ -0,0 +1,7 @@
+declare module '#app' {
+  interface PageMeta {
+    skipAuth?: boolean;
+  }
+}
+
+export {}
diff --git a/wrangler.toml b/wrangler.toml
index 34ca91e..458c436 100644
--- a/wrangler.toml
+++ b/wrangler.toml
@@ -5,3 +5,6 @@ upload_source_maps = true
 
 [dev]
 port = 8888
+
+[vars]
+OAUTH_TWITCH_CLIENT_ID = "58vwcqcpjpf7iz530v11z3sovtgfc5"