better-auth

name	better-auth
description	Better Auth — framework-agnostic TypeScript authentication. Email/password, OAuth/social login, sessions, JWT, 2FA, magic link, email OTP, organizations/teams, RBAC, passkeys. Use when: better-auth, betterAuth, authClient, auth.api, createAuthClient, signUp.email, signIn.email, signIn.social, signIn.magicLink, getSession, useSession, twoFactor, magicLink, emailOTP, organization plugin, trustedOrigins, baseURL, BETTER_AUTH_SECRET, NextAuth alternative, Auth.js migration, Prisma/Drizzle/Kysely auth adapter, cookie sessions, OAuth callback, social provider, sign-in, login, OAuth flow, JWT issuance. SKIP: Auth0/Clerk/Supabase Auth platforms, Lucia (sunset), Passport.js (legacy Express middleware), NextAuth/Auth.js usage (different lib).
stacks	["better-auth","typescript","nodejs-backend"]
tags	["auth","security","sessions","oauth","rbac","2fa"]
packages	["better-auth","@better-auth/cli"]
manifests	["auth.ts","auth.config.ts","lib/auth.ts","lib/auth-client.ts"]
source	vechkasov-global-skills
risk	high-stakes

🎯 Version Requirements (May 2026)

Primary pins:

• Better Auth: 1.6.x
• TypeScript: 6.0.x

Source of truth: STACK_VERSIONS.md — verified 2026-05-16

Usage

Loaded automatically when the description matches the task. Pattern 2 — open only the references you need; do not read every file.

Use this skill when

• Standing up a fresh Better Auth install — betterAuth() config, BETTER_AUTH_SECRET, baseURL, trustedOrigins, mounting the request handler
• Wiring a framework adapter — Next.js App Router (toNextJsHandler), Hono (auth.handler(c.req.raw)), Fastify, Express (toNodeHandler), Nuxt, SvelteKit, Cloudflare Workers
• Choosing or configuring a database adapter — Prisma (prismaAdapter), Drizzle (drizzleAdapter), built-in Kysely (new Pool(...)), MongoDB (mongodbAdapter), Redis secondary storage
• Enabling email + password sign-up/sign-in — emailAndPassword.enabled, requireEmailVerification, sendVerificationEmail, password reset (requestPasswordReset / resetPassword)
• Adding social/OAuth providers — Google, GitHub, Discord, Apple, Microsoft, Twitter — including custom scopes and callback URLs
• Configuring sessions — expiresIn, updateAge, cookieCache, server-side auth.api.getSession({ headers }), client authClient.useSession()
• Adding plugins — twoFactor() (TOTP + backup codes), magicLink(), emailOTP(), organization(), jwt(), admin(), username(), passkey()
• Hardening security — trustedOrigins wildcards, CSRF Origin checks, rate limiting, IP source headers, secure cookies, cross-subdomain cookies
• Migrating from NextAuth/Auth.js, Auth0, Lucia, or Passport to Better Auth
• Diagnosing common failures — cookie not set, CORS rejection, callback URL mismatch, schema drift, "session not found"