better-auth

name	better-auth
description	Implement Better Auth (better-auth.com) — the framework-agnostic TypeScript authentication library — across ANY stack: Next.js, SvelteKit, Nuxt, SolidStart, Remix/React Router, Astro, TanStack Start, Express, Hono, Elysia, Fastify, or raw Node. Covers the betterAuth() server instance, database adapters (Drizzle, Prisma, Kysely/raw pg·mysql·sqlite, MongoDB), the CLI (generate/migrate), the client SDK (React, Vue, Svelte, Solid, vanilla), email/password + social/OAuth login (Google, GitHub, Apple…), account linking, sessions, and plugins (2FA, magic link, email OTP, passkey, username, organization multi-tenancy, admin, API keys, JWT/bearer, RBAC via access control). Use whenever the user adds, configures, scaffolds, or debugs Better Auth, sign-in/sign-up, sessions, OAuth, 2FA, multi-tenant orgs, or role-based permissions in a TS/JS app — even if they only say 'better auth', 'add login', or 'auth'. Ships a preflight, a scaffolder, and a setup doctor.
license	MIT
compatibility	Better Auth v1.x (verified runnable against v1.6.19, mid-2026). Needs Node 18+ (Web Crypto) / Bun / Deno and a TypeScript project. One database: Postgres, MySQL, or SQLite via Drizzle/Prisma/Kysely-or-raw-driver, or MongoDB. Works with any of the listed web frameworks. Bundled scripts need Node 18+ and bash; the scaffolder emits a runnable Next.js, Express, SvelteKit, or Hono starter (the Express/Hono demos' npm scripts use Node 20.6+'s --env-file).
inputs	[{"name":"BETTER_AUTH_SECRET","description":"Random secret used to sign/encrypt/hash sessions and tokens. REQUIRED — Better Auth throws on boot in production if unset. Generate with `openssl rand -base64 32` or `npx @better-auth/cli@latest secret`. Read from process.env if not passed as `secret` in config.","required":true},{"name":"BETTER_AUTH_URL","description":"Base URL of the app, e.g. http://localhost:3000 (prod: https://yourapp.com). Used for cookies, OAuth redirects, and trusted-origin checks. Optional in dev (inferred), REQUIRED in production. Equivalent to the `baseURL` config option.","required":false},{"name":"DATABASE_URL","description":"Connection string for your database (Postgres/MySQL/SQLite/Mongo). Name varies by host (POSTGRES_URL, TURSO_DATABASE_URL, MONGODB_URI…). Needed by the adapter and the CLI. SQLite may be a file path instead.","required":false}]
metadata	{"author":"github.com/kryptobaseddev","version":"1.0.0","last_updated":"2026-06-15 18:20:00","category":"auth"}
allowed-tools	Bash Read Write Edit Glob Grep WebFetch

Better Auth — cross-stack authentication for TypeScript

Better Auth is a framework-agnostic auth library: one betterAuth() server instance owns the logic, a tiny per-framework adapter mounts it as HTTP routes, and a typed client SDK talks to those routes. The same core works in Next.js, SvelteKit, Nuxt, Solid, Remix, Astro, TanStack Start, Express, Hono, Elysia, Fastify, or raw Node — only the mount and the client import change.

This skill keeps the cross-cutting rules here and pushes the per-framework, per-adapter, and per-plugin detail into references/. Read the relevant reference before writing integration code — the import paths and method names are load-bearing and easy to get subtly wrong.

The mental model (4 moving parts)

.env  →  auth.ts (server instance)  →  mount handler (/api/auth/*)  →  auth-client.ts (client SDK)
secret      betterAuth({db, ...})        toNextJsHandler / auth.handler     createAuthClient({...})

1. Server instance (auth.ts/lib/auth.ts): betterAuth({ database, emailAndPassword, socialProviders, plugins }). One file, the source of truth.
2. Database: an adapter (Drizzle/Prisma/Mongo) or a raw driver (built-in Kysely). Then generate the schema and migrate.
3. Mount: expose auth.handler at the catch-all route /api/auth/* using your framework's adapter.
4. Client: createAuthClient from the subpath for your front-end framework; call signIn/signUp/useSession.

Facts that prevent broken work

Read this first — each row is a real failure integrators hit.

Fact	Consequence
BETTER_AUTH_SECRET is mandatory in prod	Boot throws without it. Generate openssl rand -base64 32. Also set BETTER_AUTH_URL (baseURL) or cookies/redirects break in prod.
The route MUST be a catch-all at /api/auth/*	A single non-catch-all route (e.g. /api/auth/route.ts) silently 404s sub-paths like /api/auth/sign-in/email. Use , , , or per framework.