Authentication
Understand the identity provider and the boundaries around it.
Sign-in methods
Better Auth provides verified email/password sign-in, passkeys, email OTP and two-factor authentication. GitHub social sign-in is configured only when the required GitHub credentials are present. Turnstile is optional and stays off when its keys are unset.
An identity provider
The generated application is an OAuth 2.0 / OIDC identity provider. It issues tokens to your clients through an authorization flow. Interactive login and consent preserve the signed authorization query so the server can validate and resume the request.
/sign-in
/oauth/consent
/api/auth/oauth2/authorizeAuth configuration
Configure the application origin, Better Auth URL, a fresh auth secret and email sender. Keep server-only secrets out of VITE_-prefixed variables and browser bundles. Development mail is logged if provider credentials are absent.
APP_ORIGIN
BETTER_AUTH_URL
BETTER_AUTH_SECRET
EMAIL_FROMServer-side guards
Authenticated and administrative actions are authorized on the server. Sensitive Better Auth HTTP paths are disabled where they would bypass application guards; the application calls those capabilities through guarded server functions. Client-side navigation alone is not an authorization boundary.
Generated auth schema
The Better Auth schema is generated from the auth configuration. When changing auth plugins or fields, regenerate the schema and create the corresponding database migration. Handwritten platform tables remain separate from the generated auth tables.