Better Auth

Better Auth is a framework-agnostic authentication and authorization framework for TypeScript that ships a complete feature set out of the box instead of leaving you to assemble one from scratch. It handles email/password, social and OAuth2 sign-in, sessions, and account management with type-safe server and client APIs.

A first-class plugin ecosystem extends the core with advanced capabilities such as two-factor authentication, passkeys, organizations and multi-tenancy, magic links, SSO, an OIDC provider, and more, so you can add sophisticated auth flows with minimal code while keeping full control over your database and application stack.

What You Get

• A type-safe betterAuth() server instance with email/password, session, and OAuth2 social sign-in built in
• A matching type-safe client (createAuthClient) with framework bindings for React, Vue, Svelte, Solid, and vanilla JS
• A rich plugin system covering 2FA, passkeys, organizations, magic links, SSO, OIDC provider, admin, and more
• Database adapters for Drizzle, Prisma, Kysely, MongoDB, and in-memory storage, plus a schema/migration generator
• Framework integrations for Next.js, SvelteKit, SolidStart, TanStack Start, Node, and Expo

Common Use Cases

• Adding email/password and social login to a Next.js, SvelteKit, or Solid application
• Standing up multi-tenant SaaS auth with organizations, roles, and invitations
• Enforcing strong security with two-factor authentication, passkeys, and rate limiting
• Running your own OIDC/OAuth provider or SSO for internal services

Under The Hood

Architecture - The published better-auth package is the aggregation layer of a pnpm/turbo monorepo: packages/better-auth/src/index.ts re-exports a @better-auth/core runtime and pulls in workspace adapters (Drizzle, Prisma, Kysely, Mongo, memory) and telemetry. The betterAuth() factory in src/auth/full.ts builds a context (src/context/init.ts) that wires the configured database adapter, session and cookie handling (src/cookies, src/db), the OAuth2 flow engine (src/oauth2), and an endpoint dispatcher (src/api) that converts plugin-declared routes into a single mountable request handler. Roughly thirty first-party plugins under src/plugins (2FA, passkey, organization, magic-link, OIDC provider, admin, SSO) hook into that context, and matching client plugins under src/client produce a type-inferred createAuthClient with bindings for React, Vue, Svelte, Solid, and vanilla JS.

Tech Stack - Written almost entirely in TypeScript (~99.98%) and built with tsdown/turbo. Core runtime dependencies are deliberately lean: zod v4 for schema validation, jose for JWT/JWKS, @noble/hashes and @noble/ciphers for cryptography, better-call for typed endpoints, @better-fetch/fetch for the client transport, nanostores for client session state, and kysely/defu utilities. Database drivers and host frameworks (Next.js, SvelteKit, Solid, TanStack Start, Prisma, Drizzle, pg, mysql2, mongodb, react, vue, svelte) are all peer dependencies, keeping the core framework-agnostic and unopinionated about the surrounding stack.

Code Quality - The codebase is thoroughly tested, with roughly 97 *.test.ts files colocated alongside source in the main package (plus dedicated test/ and e2e/ suites at the repo root running under Vitest). Code is organized by concern into small, single-responsibility modules, formatted and linted with Biome, spell-checked with cspell, dependency-pruned with knip, and gated by lefthook git hooks. Changesets drives versioning and the project ships an AGENTS.md contributor guide, indicating a mature, disciplined engineering process.

API Design - The developer experience is a core selling point: a single betterAuth({...}) call configures the server and the client type is inferred from it, so enabling a plugin or extra field automatically surfaces on the typed client with no manual duplication. Plugins are added declaratively to an array, framework integration is a one-line handler mount, and a schema/migration generator scaffolds the required tables. The main tradeoff is breadth over minimalism — the large surface of plugins, adapters, and configuration options means a moderate learning curve to discover the right pieces, but everyday flows require little boilerplate.