Covers the full surface — 40+ OAuth providers (Google, GitHub, Discord, Apple, Microsoft, and more), 20+ plugins (2FA, magic links, passkeys, organizations/multi-tenant, enterprise SSO/SAML, SCIM provisioning, Stripe/Polar billing, JWT/Bearer, API keys), and database adapters (Prisma, Drizzle, MongoDB, raw SQL). Also covers migration paths from Auth.js, Clerk, Auth0, Supabase, and WorkOS. While Better Auth itself is framework-agnostic, this skill's architecture guidance (proxy.ts, App Router API route) is Next.js-specific — for Prisma schema/query details see prisma-7.
Better Auth - Complete Authentication
TypeScript-first authentication library with 40+ OAuth providers and 20+ plugins.
Agent Workflow (MANDATORY)
Before ANY implementation, use TeamCreate to spawn 3 agents:
- explore-codebase - Analyze existing auth setup and patterns
- research-expert - Verify latest Better Auth docs via Context7/Exa
- mcp__context7__query-docs - Check providers/plugins availability
After implementation, run sniper for validation.
Overview
When to Use
- Implementing authentication in TypeScript/JavaScript applications
- Need OAuth providers (Google, GitHub, Discord, Apple, Microsoft, etc.)
- Adding 2FA, magic links, passkeys, or phone authentication
- Enterprise SSO with SAML, SCIM provisioning, or organizations
- Integrating payments with Stripe or Polar subscriptions
- Web3 authentication with Sign-In with Ethereum (SIWE)
- Migrating from Auth.js, Clerk, Auth0, Supabase, or WorkOS
Why Better Auth
| Feature |
Benefit |
| Framework agnostic |
Next.js, SvelteKit, Nuxt, Remix, Astro, Expo, NestJS |
| Plugin architecture |
Add only the features you need (20+ plugins) |
| Full TypeScript |
End-to-end type safety, inference included |
| Self-hosted |
Your data stays on your infrastructure |
| Database flexible |
Prisma, Drizzle, MongoDB, PostgreSQL, MySQL, SQLite |
| Enterprise ready |
SSO, SCIM, organizations, audit logs |
Coverage
OAuth Providers (40+)
Google, GitHub, Discord, Apple, Microsoft, Slack, Spotify, Twitter/X, Facebook, LinkedIn, GitLab, Bitbucket, Dropbox, Twitch, Reddit, TikTok, and 25+ more documented in providers/.
Plugins (20+)
| Plugin |
Purpose |
| 2FA |
TOTP authenticator, backup codes |
| Magic Link |
Passwordless email login |
| Passkey |
WebAuthn biometric authentication |
| Organization |
Multi-tenant, roles, invitations |
| SSO |
Enterprise SAML/OIDC single sign-on |
| SCIM |
Directory sync, user provisioning |
| Stripe |
Subscription billing integration |
| API Key |
Machine-to-machine authentication |
| JWT/Bearer |
Token-based API authentication |
Database Adapters
Prisma, Drizzle, MongoDB, raw SQL (PostgreSQL, MySQL, SQLite), and community adapters.
SOLID Architecture (Next.js 16)
Components organized in modules/auth/ following separation of concerns:
- Services:
betterAuth configuration and initialization
- Hooks:
createAuthClient for client-side auth state
- API Route:
app/api/auth/[...all]/route.ts handler
- Proxy:
proxy.ts for route protection (replaces middleware)
Reference Guide
| Need |
Reference |
| Initial setup |
installation.md, server-config.md |
| Client usage |
client.md, session.md |
| OAuth providers |
providers/overview.md, individual provider docs |
| Add plugins |
plugins/overview.md, individual plugin docs |
| Database setup |
adapters/prisma.md, adapters/drizzle.md |
| Enterprise SSO |
plugins/sso.md, guides/saml-okta.md |
| Payments |
plugins/stripe.md, plugins/polar.md |
| Migration |
guides/clerk-migration.md, other migration guides |
| Complete examples |
examples/ for full implementations |
Best Practices
- Plugins on demand - Only add plugins you actually need
- Type-safe client - Use generated types from server config
- Session caching - Enable session caching for performance
- Rate limiting - Configure rate limits for auth endpoints
- Secure cookies - Use secure, httpOnly, sameSite cookies
- Database indexes - Add indexes on user lookup fields
Concepts
Core concepts explained in concepts/:
- Sessions - Token management, refresh, revocation
- Database - Schema design, migrations, adapters
- Plugins - Extension system, composition
- OAuth - Provider configuration, callbacks
- Security - CSRF, rate limiting, password hashing
- Cookies - Session storage, cross-domain
1---2name: better-auth-23description: Use when implementing Next.js authentication with Better Auth — OAuth, 2FA, magic links, SSO, Stripe billing, or session management.4---56<objective>7Implements Better Auth, a TypeScript-first authentication library, in a Next.js 16 App Router project: server config, client (`createAuthClient`), session management, and the `app/api/auth/[...all]/route.ts` handler, plus `proxy.ts` for route protection (replacing middleware).89Covers the full surface — 40+ OAuth providers (Google, GitHub, Discord, Apple, Microsoft, and more), 20+ plugins (2FA, magic links, passkeys, organizations/multi-tenant, enterprise SSO/SAML, SCIM provisioning, Stripe/Polar billing, JWT/Bearer, API keys), and database adapters (Prisma, Drizzle, MongoDB, raw SQL). Also covers migration paths from Auth.js, Clerk, Auth0, Supabase, and WorkOS. While Better Auth itself is framework-agnostic, this skill's architecture guidance (proxy.ts, App Router API route) is Next.js-specific — for Prisma schema/query details see prisma-7.10</objective>1112# Better Auth - Complete Authentication1314TypeScript-first authentication library with 40+ OAuth providers and 20+ plugins.1516## Agent Workflow (MANDATORY)1718Before ANY implementation, use `TeamCreate` to spawn 3 agents:19201. **explore-codebase** - Analyze existing auth setup and patterns212. **research-expert** - Verify latest Better Auth docs via Context7/Exa223. **mcp__context7__query-docs** - Check providers/plugins availability2324After implementation, run **sniper** for validation.2526---2728## Overview2930### When to Use3132- Implementing authentication in TypeScript/JavaScript applications33- Need OAuth providers (Google, GitHub, Discord, Apple, Microsoft, etc.)34- Adding 2FA, magic links, passkeys, or phone authentication35- Enterprise SSO with SAML, SCIM provisioning, or organizations36- Integrating payments with Stripe or Polar subscriptions37- Web3 authentication with Sign-In with Ethereum (SIWE)38- Migrating from Auth.js, Clerk, Auth0, Supabase, or WorkOS3940### Why Better Auth4142| Feature | Benefit |43|---------|---------|44| Framework agnostic | Next.js, SvelteKit, Nuxt, Remix, Astro, Expo, NestJS |45| Plugin architecture | Add only the features you need (20+ plugins) |46| Full TypeScript | End-to-end type safety, inference included |47| Self-hosted | Your data stays on your infrastructure |48| Database flexible | Prisma, Drizzle, MongoDB, PostgreSQL, MySQL, SQLite |49| Enterprise ready | SSO, SCIM, organizations, audit logs |5051---5253## Coverage5455### OAuth Providers (40+)5657Google, GitHub, Discord, Apple, Microsoft, Slack, Spotify, Twitter/X, Facebook, LinkedIn, GitLab, Bitbucket, Dropbox, Twitch, Reddit, TikTok, and 25+ more documented in [providers/](references/providers/).5859### Plugins (20+)6061| Plugin | Purpose |62|--------|---------|63| 2FA | TOTP authenticator, backup codes |64| Magic Link | Passwordless email login |65| Passkey | WebAuthn biometric authentication |66| Organization | Multi-tenant, roles, invitations |67| SSO | Enterprise SAML/OIDC single sign-on |68| SCIM | Directory sync, user provisioning |69| Stripe | Subscription billing integration |70| API Key | Machine-to-machine authentication |71| JWT/Bearer | Token-based API authentication |7273### Database Adapters7475Prisma, Drizzle, MongoDB, raw SQL (PostgreSQL, MySQL, SQLite), and community adapters.7677---7879## SOLID Architecture (Next.js 16)8081Components organized in `modules/auth/` following separation of concerns:8283- **Services**: `betterAuth` configuration and initialization84- **Hooks**: `createAuthClient` for client-side auth state85- **API Route**: `app/api/auth/[...all]/route.ts` handler86- **Proxy**: `proxy.ts` for route protection (replaces middleware)8788---8990## Reference Guide9192| Need | Reference |93|------|-----------|94| Initial setup | [installation.md](references/installation.md), [server-config.md](references/server-config.md) |95| Client usage | [client.md](references/client.md), [session.md](references/session.md) |96| OAuth providers | [providers/overview.md](references/providers/overview.md), individual provider docs |97| Add plugins | [plugins/overview.md](references/plugins/overview.md), individual plugin docs |98| Database setup | [adapters/prisma.md](references/adapters/prisma.md), [adapters/drizzle.md](references/adapters/drizzle.md) |99| Enterprise SSO | [plugins/sso.md](references/plugins/sso.md), [guides/saml-okta.md](references/guides/saml-okta.md) |100| Payments | [plugins/stripe.md](references/plugins/stripe.md), [plugins/polar.md](references/plugins/polar.md) |101| Migration | [guides/clerk-migration.md](references/guides/clerk-migration.md), other migration guides |102| Complete examples | [examples/](references/examples/) for full implementations |103104---105106## Best Practices1071081. **Plugins on demand** - Only add plugins you actually need1092. **Type-safe client** - Use generated types from server config1103. **Session caching** - Enable session caching for performance1114. **Rate limiting** - Configure rate limits for auth endpoints1125. **Secure cookies** - Use secure, httpOnly, sameSite cookies1136. **Database indexes** - Add indexes on user lookup fields114115---116117## Concepts118119Core concepts explained in [concepts/](references/concepts/):120121- **Sessions** - Token management, refresh, revocation122- **Database** - Schema design, migrations, adapters123- **Plugins** - Extension system, composition124- **OAuth** - Provider configuration, callbacks125- **Security** - CSRF, rate limiting, password hashing126- **Cookies** - Session storage, cross-domain
fusengine