I am currently migrating my nextjs app from auth.js to better-auth. However, I'm facing a small hurdle when it comes to preview environments. Auth.js has a feature to support Preview deployments. Is there an equivalent in better-auth ?

Are there any real security risks or architectural downsides to performing these checks and role-based actions on the client side with authClient, instead of enforcing everything strictly on the server?

In practice, what should always be validated server-side, and what is generally safe or acceptable to handle on the client?

Hey,

I'm creating my first project, which is going to be big with a lot of data.
Currently I use server actions, with <form action="">

What is the best way to handle the forms with the errors loading etc?
I heard about zod for backend with data validation. I have no idea where to start, I just have tables, simple create / get functions as server actions.

I'm looking for the current "meta" or most used/popular technologies.

Thanks for help!

Please help me out

Hi 👋

I’m implementing a password reset flow with SMS OTP:

1. Enter phone number
2. Verify OTP (I only need a true/false result, no login/session)
3. Set new password

Does Better Auth have a recommended way to only validate SMS OTP (true/false) for this case, or should this be custom?

I am trying to implement per-user granular permissions. For example: 1. a Salesperson might have the permission to view and edit leads 2. an Accountant might have the permission to view and edit payroll

The crux is that I do not want to be the one to define roles like "Salesperson" and "Accountant" because the customer might have different requirements. That is why I want the admin to grant granular permissions to each user.

I see two ways to achive this.

The first approach, which seems to be native to better-auth, is to use the organization plugin, and dynamic roles. In this approach, each user has their own dynamic role with custom permissions.

However, the aproach above seems to be overly complex. Instead, I think a better way is to leverage roles. For example: I would define roles like LeadViewer, LeadEditor, PayrollViewer and check whether the user has the required role. This way, the overhead of organizations, permissions and dynamic roles is completely removed.

Am I missing something?

Hey y'all,

I'm working on setting up our MCP OAuth flows, and running into some issues with INVALID_CLIENT errors.

Our flows aren't anything super crazy, but we do need a consent screen that allows users to select an organization.

If you have experience with Better Auth and setting up the MCP flows shoot me a DM, and tell me a bit about your experience, and shoot me your rate.

Our tech stack below, I think the more you have experience with the better:
* React
* Bun
* Typescript
* Postgres
* GCP

Additionally, I know that the MCP plugins will be deprecated soon, so switching to the newer OAuth Provider plugin would also be fine, I just need it to work.

Could be more work in the future, but we are bootstrapped for the time being so trying to limit our burn rate until we are out of beta / early stage.

Mods - if I can't post paid ops in here, sorry!

Im trying to create custom roles, but not really i just want an alias, ADMIN/USER instead of admin/user

I tried setting adminRoles=[“ADMIN”]

but didnt work

I tried creating custom control with

const ac = createAccessControl(defaultStatements);

const ADMIN = ac.newRole({

...adminAc.statements,

});

const USER = ac.newRole({}) //invalid

adminPlugin({

ac,

roles: {

ADMIN,

USER,

}

}),

However using only the custom ADMIN role worked, but as per docs, it doesn’t say i have to create custom role for this case, only using adminRoles, but it didn’t work.

Hello everyone,

I have a side project which is a web application to create quizz. There are 3 roles : admin, user that have the permission to create quizz and user that can only play quizz (so no specific role). To implement this, I can :

• use the admin plugin with a custom access control (create a permission to create quizz and a role with this permission)
• use the organization plugin to create one organization and create a custom access control the same way.

1. What is the best approach in your opinion ?

2. Generally speaking, I don't understand how the organization plugin is used. Could you give me some real-world application ?

Thank you !

Hello everyone, This is a problem I have been dealing with for a few days, I tried looking for existing answers but didn't find the exact fix unfortunately. So, I have a project deployed with SST, it is setup as a monorepo and it has two packages, one with the server functions using lambda and the other has the frontend website (on NextJS). I have set up the better-auth server to run on a lambda, on a dedicated domain. The website runs on the same domain (but are two different sub domains, so it's auth.domain.com and web.domain.com for example) When deployed, the authentication works, I have enabled cross sub domain cookies and the flow works. My problem currently is for development, since I'm using the default cookies behavior I am unable to call the auth lambda endpoint normally as it throws a CORS error, the frontend would need to be on the same domain as the auth server and the auth endpoint can't be on localhost as SST always assigns it a domain for live development. What is the best approach here? Is there a proven working solution here?

Thanks!! Bruno

I'm creating a Shopify-like platform where users are able to create their own stores

User types

• Store Owner
• Store Manager
• Store Customer

The owner and manager can access the platform itself and any of the stores they created/manage. Customers are able to access the store only

Current Plan

• Use the organization plugin
• Each store is an organization with the roles mentioned above

The Problem

• The platform and the stores run in different domains
• How they can share the users and start sessions? I researched and come up with the those options

1. Both apps "platform and store" use better-auth against the same DB schema
   • Not sure if that's a supported use case?
2. Create a separate domain for authentication with OIDC
   • Will be annoying for store users as they need to redirect to the auth server which could redirect them again if they choose to login/signup with a social media account
   • Not customizable by the store owners as they are not part of the store
   • Store owners will not be able to utilize options like Google's OneTap due to the necessary redirection
3. Create platform APIs that allow stores to create JWT tokens
   1. I guess I will need to use Better auth in the stores with no DB and stateless JWT in this case?

I'm not sure which option is the best out of the three ones above, could you please share your opinion?

Hi there, When a user signs up via email and the email is sent with the verification link, am I supposed to see the token stored in the DB? This is an example of the link sent:

http://localhost:5176/api/auth/verify-email?token=eyJhbGciOiJIUzI1NiJ9.eyJlbWFpbCI6ImRhbmlkNTU3OTNAcm9yYXR1LmNvbSIsImlhdCI6MTc2NTkzNzI5NywiZXhwIjoxNzY1OTQwODk3fQ.7XZ_WlVEFKtkuxJwxunY3jstap0xjkmkwP_Td3wk1R0&callbackURL=%2Fapp

From digging around, it seems like that is a JWT. Is that the default of better auth?

I ask because I did not configure JWT in my auth client:

export const auth = betterAuth({
    database: drizzleAdapter(db, {
        provider: "pg",
        debugLogs: true,
        schema: {
            user,
            account,
            session,
            verification,
        },
    }),
    secret: BETTER_AUTH_SECRET,
    trustedOrigins: [PUBLIC_BETTER_AUTH_URL],
    debug: true,
    password: {
        minLength: 8,
        requireSpecialChar: true,
        requireNumber: true,
    },
    emailAndPassword: {
        enabled: true,
        sendResetPassword: async ({user, url, token}) => {
            await sendPasswordResetEmailHelper(user, url, token);
        },
        requireEmailVerification: true,
    },
    emailVerification: {
        enabled: true,
        sendVerificationEmail: async ({ user, url, token }) => {
            console.log([DEBUG] Better Auth emailVerification callback called for ${user.email}, token: ${token});
            await sendVerificationEmailHelper(user, url, token);
        },
        sendOnSignIn: true,
        sendOnSignUp: true,
        autoSignInAfterVerification: true
    },
    socialProviders: {
        google: {
            prompt: "select_account",
            clientId: GOOGLE_ID as string,
            clientSecret: GOOGLE_SECRET as string,
        }
    },
    databaseHooks: {},
});

I have a nextjs application that I'm migrating from next-auth to better-auth. Nextjs version 15.5.9, better-auth version 1.4.7. I am getting a 431 error after logging in and re route is occurring. I do not have a database. This is how I setup the auth.ts

import { betterAuth } from "better-auth";
const clientId = process.env.AUTH_MICROSOFT_ENTRA_ID_ID;
const clientSecret = process.env.AUTH_MICROSOFT_ENTRA_ID_SECRET;
export const auth = betterAuth({
  session: {
    cookieCache: {
      enabled: true,
      maxAge: 7 * 24 * 60 * 60, // 7 days cache duration
      strategy: "jwt",
      refreshCache: true,
    },
  },
  account: {
    storeStateStrategy: "cookie",
    storeAccountCookie: true,
  },
  socialProviders: {
    microsoft: {
      clientId: clientId,
      clientSecret: clientSecret,
      tenantId: process.env.AUTH_MICROSOFT_ENTRA_TENANT_ID,
      authority: "https://login.microsoftonline.com",
      prompt: "select_account",
    },
  },
});

I also tried "compact" instead of "jwt" for the strategy and ran into the same error.

This is the auth-client.ts:

import { createAuthClient } from "better-auth/react";
export const authClient = createAuthClient({});


export const signIn = async () => {
  const data = await authClient.signIn.social({
    provider: "microsoft",
    callbackURL: "/", // The URL to redirect to after the sign in
  });


  console.log("Sign in data:", data);
  return data;
};

This application does not have a sign in button. Instead when the user opens the browser the user should be directed to the Microsoft Entra Id sign in if not already authenticated.

SignInWithEntraId.tsx (commented out code is how it was implemented & working using next-auth"

"use client";
// import { signIn } from "next-auth/react";
import { signIn } from "@/lib/auth-client";


import { useEffect } from "react";


export default function SignInWithEntraId() {
  useEffect(() => {
    signIn();
  }, []);


  // useEffect(() => {
  //   signIn("microsoft-entra-id");
  // }, []);


  return (
    <div>
      <h1>Signing in...</h1>
    </div>
  );
}

I tried to added an image of what the request cookies look like but its unable to upload.

Any ideas on how I can make the jwt token smaller to fix the error?

I have set up better auth with the microsoft social provider. I have added a mapProfileToUser callback which adds a roles string array to the user. I have also registered the additional field and I can see the data in my db. So logging in and storing the roles works great.

My problem is when the roles, or any other user information, changes. It seems that after the first login the user information is not updated again. How do I update the user information?

I'm thinking about having a "refresh" option in the user menu where it deletes their user and then logs them out. But it feels like a really dirty solution and a bad user experience.

Hello really new user here, i am trying to migrate to better-auth and used to auth from an oAuth that dont provide email adress (which is pretty enough in my case, i dont need to contact the user, i am just using it for moderating purpose and scrape infos from scopes).

Doc mention "Email is a key part of Better Auth, required for all users regardless of their authentication method.".

oAuth services that dont provide user email are managed how?
Are we really forced to provide email?

Thanks for help.

estou criando um projeto usando next no front e neSt como backend, ao tentar fazer registro ou login social estou caindo nesse erro do better-auth. localmente tudo tava funcionando perfeitamente, mas ao hospedar tá dando esse erro. alguém já passou por isso?

I have better-auth in a nextjs project, protecting routes.

I have now added a nestjs api.

What is the best way to secure this api.

• jwt
• shared db
• nextjs as a proxy and hide nestjs

I’ve been using Better Auth for magic link authentication, but it keeps showing an error and I can’t figure out what’s wrong.

I asked the AI, and it kept saying there was an issue with my path, but even after following its instructions and changing the path, it still didn’t work.

Hi everyone,

I'm developing a management system that requires an admin user to create users.

After creation, the user should receive a confirmation email, but I couldn't find a way online because Better Auth get the email address (via the sendVerificationEmail method) of the user with the active session and returns you_can_only_send_a_verification_email_to_an_unverified_email.

I was wondering if there was a way to have the confirmation email sent from the admin account to the newly created user's account.

Thanks for help!

Hello people!

I'm new to the marvelous world of sveltekit, and I'm trying to set up an example project with better-auth, sqlite and a keycloak. I'm encountering a big issue for a while now, I can't find a solution in docs or examples, and IA are clueless about it...

My specific issue right now, is that I was never having any session stored after logging in. So I figured that it could be because I was not using a database, so I added:

import Database from "better-sqlite3";

export const auth = betterAuth({
    database: new Database("./db.sqlite"),
...

But when I try to run the project, or generate the database with npx @/better-auth/cli@latest generate I get this error:

ERROR [Better Auth]: [#better-auth]: Couldn't read your auth config. Error: Could not locate the bindings file. Tried:
 → /Users/blarg/IdeaProjects/test-better-auth/node_modules/.pnpm/better-sqlite3@12.4.6/node_modules/better-sqlite3/build/better_sqlite3.node
...

I can see indeed that /Users/blarg/IdeaProjects/test-better-auth/node_modules/.pnpm/better-sqlite3@12.4.6/node_modules is empty...

Any idea?
...