What is Better Auth?

Better Auth is a framework-agnostic authentication and authorization library for TypeScript. Instead of a hosted login service, it runs inside your own application or as a standalone auth server, stores users and sessions in your own database, and adds features through plugins such as two-factor authentication, passkeys, organizations, API keys, single sign-on and an OAuth 2.1 provider. The introduction describes the goal as covering the features teams usually have to build themselves, so the auth code stays in your repository.

The company behind it is Better Auth Inc., according to the site footer, and the founder's blog post about the Vercel announcement traces the project back to 2024. The home page carries the notice that Better Auth is joining Vercel, and that post says the framework stays open source and framework and platform agnostic. The repository is public at github.com/better-auth/better-auth and the code is licensed under MIT.

Distribution is through npm: npm install better-auth installs the core package, and optional packages such as @better-auth/sso, @better-auth/scim, @better-auth/oauth-provider, @better-auth/mcp, @better-auth/stripe, @better-auth/passkey, @better-auth/expo and @better-auth/electron live in the same monorepo. The installation guide asks for a secret of at least 32 characters in BETTER_AUTH_SECRET, a base URL and a database. A CLI (npx auth@latest) can generate or migrate the schema, run checks, create an admin user and initialize a project. Optional managed services, called Better Auth Infrastructure, add a dashboard, audit logs, security detection and email or SMS delivery for self-hosted instances.

The latest stable release is v1.7.18, published November 5, 2026, a bug-fix release for session revocation with secondary storage and for the test helper. It belongs to the 1.7 line announced in Better Auth 1.7, which expanded OAuth and OpenID Connect, MCP authorization, SCIM groups and device authorization and carried several breaking changes with a migration guide. A 1.8 beta is in progress in the repository. The library is not a hosted identity provider with its own admin console unless you add the optional dashboard, and it targets TypeScript and JavaScript runtimes rather than other languages.

Inside the application

Better Auth screenshots

Explore the interface. Open a screenshot to view it at full size.

View full size ↗

Better Auth screenshot 1

Official documentation figure of the generated API reference for a Better Auth instance, listing the default sign-in, session, password and account endpoints.

View full size ↗

Better Auth home page

The official Better Auth home page, with the install command and feature overview. Captured from better-auth.com.

View full size ↗

Better Auth documentation introduction

The official documentation introduction, showing the section structure of the docs and the framework feature cards. Captured from better-auth.com/docs.

View full size ↗

Better Auth Infrastructure pricing

The official pricing page for the optional Better Auth Infrastructure services. The framework itself is free. Captured from better-auth.com/pricing.

Source: official Better Auth project page.

Key capabilities

Install and configure with the CLI npm install better-auth (or pnpm, yarn, bun) adds the package, and npx auth@latest init scaffolds a project. You export a betterAuth({...}) instance from auth.ts, mount its handler in your framework and create a client for the front end. Keep the secret in an environment variable and rotate it with BETTER_AUTH_SECRETS when needed.
Framework integrations Documented integrations cover Next.js, Nuxt, SvelteKit, Astro, SolidStart, TanStack Start, React Router v7, Waku, Hono, Express, Fastify, Elysia, NestJS, Nitro, Encore, Effect and Convex, plus Expo, Electron and Lynx for apps. The client has bindings for React, Vue, Svelte and others, with types inferred from your server configuration.
Email and password Built-in sign-up, sign-in, email verification, password reset and password change, with options to require verified emails and to sign users in after verification. You supply the function that sends the email, so any mail provider works.
Social sign-in Provider guides exist for more than 30 services, including Google, GitHub, Apple, Microsoft, Discord, GitLab, Slack, LinkedIn, Twitter (X), Cognito and Vercel, and the Generic OAuth plugin connects any other OpenID Connect or OAuth provider. Accounts can be linked to an existing user and scopes can be requested per provider.
Two-factor authentication The two-factor plugin offers TOTP and one-time passwords by email or SMS with backup codes. Since 1.7 you can enroll OTP-only, and the enable call returns a method field you must check, which is one of the documented breaking changes.
Passkeys, magic links and one-time codes Separate plugins add WebAuthn passkeys, magic links, email OTP, phone number login, username login, anonymous sessions, one-time tokens, Google One Tap and Sign in with Ethereum. Each plugin adds its own endpoints and, where needed, database tables.
Organizations and access control The organization plugin adds teams, members, invitations, roles and permissions for multi-tenant apps. The admin plugin adds user banning, impersonation and role management, and the multi-session plugin keeps several signed-in accounts in one browser.
Enterprise SSO and SCIM The SSO plugin connects each organization to its own OIDC or SAML 2.0 provider, with domain verification through a DNS TXT record. The SCIM plugin provisions users and groups from a directory and maps groups to application roles. In 1.7, SCIM was decoupled from the organization plugin, and provisioning state cannot migrate in place.
OAuth 2.1 and OpenID Connect provider The OAuth provider plugin turns your app into an identity provider that other apps sign in with, with consent screens, client registration, scopes, resource definitions and back-channel logout. It is the basis for the MCP and device authorization features, and it requires schema migration when upgrading from earlier versions.
Auth for AI agents and MCP The @better-auth/mcp package makes your server an OAuth provider for MCP clients, and the Agent Auth plugin covers agent identity, registration and capability-based authorization. Separately, a hosted documentation MCP server at mcp.better-auth.com and a skills pack help coding assistants write correct Better Auth code.
API keys and tokens The API key plugin issues keys with permissions and rate limits, the bearer plugin accepts tokens instead of cookies, and the JWT plugin issues tokens for services that cannot read the session. Hashing sensitive tokens is flagged as a recommended setting in the dashboard insights.
Database adapters and secondary storage Built-in Kysely support covers SQLite, PostgreSQL, MySQL and MS SQL, with adapters for Drizzle, Prisma and MongoDB. The CLI can generate the schema for your ORM or run migrations for the built-in adapter, and secondary storage such as Redis can hold sessions and rate-limit counters.
Sessions, cookies and rate limiting Sessions have configurable expiry and freshness, cookie prefixes and attributes, and cross-subdomain sharing. A built-in rate limiter with custom rules protects sensitive endpoints, and a captcha plugin and Have I Been Pwned password check add abuse protection.
Hooks and plugin authoring Before and after hooks change endpoint behavior, and database hooks run on create or update. You can write your own plugin with endpoints, schema, hooks and client code, and community plugins and adapters are listed in the docs.
Billing plugins Plugins connect Stripe, Polar, Chargebee, Creem, Dodo Payments, Autumn and Commet to user and organization records for subscriptions and checkouts. Each depends on the payment vendor's account and terms.
OpenAPI reference The Open API plugin serves a generated reference for the endpoints of your own instance, including the plugins you enabled, at a path under the auth base URL. It is useful for non-TypeScript clients and for checking exactly which routes are exposed.
Better Auth Infrastructure dashboard Optional hosted services add a dashboard for users, sessions and organizations, audit logs with log drain to a SIEM on higher plans, the Sentinel security plugin for bot detection, brute force, breached passwords and geo blocking, and managed email and SMS. Plans are described on the pricing page.

Where Better Auth fits

Add login to a new full-stack app

Run the CLI, enable emailAndPassword and one or two social providers, generate the schema for your ORM and apply the migration. Write a sign-up, sign-in, sign-out and password reset test, and check the session cookie flags and the trustedOrigins setting before you deploy to a custom domain.

Build a multi-tenant SaaS with roles

Add the organization plugin, define roles and permissions, and gate server actions with the permission check. Test that a member of one organization cannot read another organization's records, and that invitation links expire as configured. Decide early whether users can belong to several organizations.

Sell to enterprises with SSO and directory sync

Add the SSO plugin per organization, register a customer's OIDC or SAML provider and verify its email domain by DNS. Add SCIM for provisioning and map groups to roles. Follow the 1.7 upgrade guide carefully if you used the older SCIM plugin, because a full directory reprovision is required.

Make your app an identity provider

Use the OAuth provider plugin to let partner apps or MCP clients sign in with your accounts. Define scopes and protected resources, build the consent screen and verify tokens in the API that serves the resource. Test token expiry, revocation and back-channel logout between two apps.

Secure an API with keys or tokens

Enable the API key plugin for machine access, set per-key permissions and rate limits, and enable hashed storage. For services that cannot read sessions, use the JWT plugin and publish its keys. Rotate a key in staging to confirm that clients fail closed.

Move from a hosted auth service or Auth.js

Map your existing user, account and session tables to Better Auth's core schema using custom model names, import users with password hashes only if the algorithm is supported, and run both systems in parallel for a short period. Check email uniqueness and social account linking before cutover.