HelpBlogCommunity🍌 PromptsNEWRulesWorkflowsAgent SkillsMCPsAdvertise
ENEnglishESEspaΓ±olZHδΈ­ζ–‡JAζ—₯本θͺžDEDeutschPTPortuguΓͺsRUРусский
Back to Security & Vulnerability Analysis

create-auth-skill

authenticationsecuritytypescriptjavascriptbetter authuser managementssopasskey
⭐ 198πŸ•’ 2026-03-02Source β†—

Install this skill

npx skills add better-auth/skills

Works across Claude Code, Cursor, Codex, Copilot & Antigravity

Better Auth provides a modular, framework-agnostic authentication library for TypeScript applications. It manages user sessions, identity management, and security protocols by separating server-side logic from client-side state. The architecture relies on core packages paired with optional plugins for specialized needs like passkeys, organizational structures, or enterprise SSO. By centralizing authentication config in an auth.ts file and utilizing framework-specific handlers, the library abstracts complex tasks such as database adapter mapping and token management. It supports major database ORMs including Prisma, Drizzle, and direct SQL drivers, ensuring compatibility with most modern tech stacks. Whether you are bootstrapping a fresh project or migrating an existing backend, this tool offers a standardized approach to handling logins, password resets, and user authentication schemas through an automated migration CLI.

When to Use This Skill

  • β€’Building a new SaaS platform requiring multi-tenant organization support
  • β€’Adding secure user authentication to a Next.js or Hono application
  • β€’Implementing passkey-based passwordless login flow
  • β€’Migrating from legacy auth systems to a type-safe TypeScript solution

How to Invoke This Skill

Example prompts that trigger this skill in Claude Code, Cursor, or Antigravity:

  • β€œsetup better-auth for my next.js project
  • β€œadd social login to my app using better-auth
  • β€œhow do i configure better-auth with drizzle orm
  • β€œadd 2fa to my existing better-auth implementation
  • β€œgenerate auth schema for better-auth

Pro Tips

  • πŸ’‘Always begin by consulting the official Better Auth documentation (better-auth.com/docs) for the latest syntax and best practices, especially when dealing with specific framework integrations.
  • πŸ’‘When migrating existing authentication, plan for incremental adoption. Focus on one part of the auth flow at a time (e.g., login, then registration, then session management) to minimize disruption.
  • πŸ’‘Utilize the Better Auth CLI commands for migrations and generation (`npm run better-auth migrate`, `npm run better-auth generate`) to ensure your database schema and configuration files are correctly synchronized.

What this skill does

  • β€’Supports multiple database adapters including Prisma, Drizzle, and native SQL clients
  • β€’Plugin-based architecture for 2FA, SSO, passkeys, and organization management
  • β€’Standardized client-side hooks for React, Vue, Svelte, and Solid
  • β€’Automated schema generation and migration CLI tools
  • β€’Built-in support for social OAuth providers and email-based authentication

When not to use it

  • βœ•Projects requiring deep integration with non-TypeScript/JavaScript backends
  • βœ•Environments where zero-dependency or pure-manual authentication logic is mandated
  • βœ•Simple static sites that do not require server-side session management

Example workflow

  1. Install the core better-auth package and required database adapter
  2. Define the authentication config inside auth.ts
  3. Initialize the server-side route handler for your specific framework
  4. Run the CLI migration command to sync your database schema
  5. Configure the auth-client in your frontend and hook into session status

Prerequisites

  • –A TypeScript project environment
  • –An active database connection string
  • –Basic understanding of your framework's routing structure

Pitfalls & limitations

  • !Forgetting to re-run the CLI migration tool after adding new plugins
  • !Misconfiguring the BETTER_AUTH_URL environment variable across different deployment stages
  • !Incompatibility issues if using unsupported or custom legacy database adapters

FAQ

Can I use Better Auth with Hono or other non-Next.js frameworks?
Yes, Better Auth is framework-agnostic. It provides specific handlers for Hono, Express, SvelteKit, and others, or can be used via its client package in vanilla environments.
Do I need to manually write SQL for the auth tables?
No, the Better Auth CLI generates the necessary schema files based on your configuration, which can then be applied via your preferred ORM.
How does Better Auth handle secret management?
It requires a 32-character secret set as the BETTER_AUTH_SECRET environment variable, which serves as the salt for session hashing.

How it compares

Unlike manual implementations that require writing custom session state and password hashing, Better Auth provides an abstracted, type-safe standard that syncs with ORMs automatically.

Source & trust

⭐ 198 starsπŸ•’ Updated 2026-03-02
πŸ“„ Full skill instructions β€” original source: better-auth/skills
# Create Auth Skill

Guide for adding authentication to TypeScript/JavaScript applications using Better Auth.

**For code examples and syntax, see [better-auth.com/docs](https://better-auth.com/docs).**

---

## Decision Tree

Is this a new/empty project?
β”œβ”€ YES β†’ New project setup
β”‚   1. Identify framework
β”‚   2. Choose database
β”‚   3. Install better-auth
β”‚   4. Create auth.ts + auth-client.ts
β”‚   5. Set up route handler
β”‚   6. Run CLI migrate/generate
β”‚   7. Add features via plugins
β”‚
└─ NO β†’ Does project have existing auth?
    β”œβ”€ YES β†’ Migration/enhancement
    β”‚   β€’ Audit current auth for gaps
    β”‚   β€’ Plan incremental migration
    β”‚   β€’ See migration guides in docs
    β”‚
    └─ NO β†’ Add auth to existing project
        1. Analyze project structure
        2. Install better-auth
        3. Create auth config
        4. Add route handler
        5. Run schema migrations
        6. Integrate into existing pages


---

## Installation

**Core:** npm install better-auth

**Scoped packages (as needed):**
| Package | Use case |
|---------|----------|
| @better-auth/passkey | WebAuthn/Passkey auth |
| @better-auth/sso | SAML/OIDC enterprise SSO |
| @better-auth/stripe | Stripe payments |
| @better-auth/scim | SCIM user provisioning |
| @better-auth/expo | React Native/Expo |

---

## Environment Variables

BETTER_AUTH_SECRET=<32+ chars, generate with: openssl rand -base64 32>
BETTER_AUTH_URL=http://localhost:3000
DATABASE_URL=<your database connection string>


Add OAuth secrets as needed: GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, GOOGLE_CLIENT_ID, etc.

---

## Server Config (auth.ts)

**Location:** lib/auth.ts or src/lib/auth.ts

**Minimal config needs:**
- database - Connection or adapter
- emailAndPassword: { enabled: true } - For email/password auth

**Standard config adds:**
- socialProviders - OAuth providers (google, github, etc.)
- emailVerification.sendVerificationEmail - Email verification handler
- emailAndPassword.sendResetPassword - Password reset handler

**Full config adds:**
- plugins - Array of feature plugins
- session - Expiry, cookie cache settings
- account.accountLinking - Multi-provider linking
- rateLimit - Rate limiting config

**Export types:** export type Session = typeof auth.$Infer.Session

---

## Client Config (auth-client.ts)

**Import by framework:**
| Framework | Import |
|-----------|--------|
| React/Next.js | better-auth/react |
| Vue | better-auth/vue |
| Svelte | better-auth/svelte |
| Solid | better-auth/solid |
| Vanilla JS | better-auth/client |

**Client plugins** go in createAuthClient({ plugins: [...] }).

**Common exports:** signIn, signUp, signOut, useSession, getSession

---

## Route Handler Setup

| Framework | File | Handler |
|-----------|------|---------|
| Next.js App Router | app/api/auth/[...all]/route.ts | toNextJsHandler(auth) β†’ export { GET, POST } |
| Next.js Pages | pages/api/auth/[...all].ts | toNextJsHandler(auth) β†’ default export |
| Express | Any file | app.all("/api/auth/*", toNodeHandler(auth)) |
| SvelteKit | src/hooks.server.ts | svelteKitHandler(auth) |
| SolidStart | Route file | solidStartHandler(auth) |
| Hono | Route file | auth.handler(c.req.raw) |

**Next.js Server Components:** Add nextCookies() plugin to auth config.

---

## Database Migrations

| Adapter | Command |
|---------|---------|
| Built-in Kysely | npx @better-auth/cli@latest migrate (applies directly) |
| Prisma | npx @better-auth/cli@latest generate --output prisma/schema.prisma then npx prisma migrate dev |
| Drizzle | npx @better-auth/cli@latest generate --output src/db/auth-schema.ts then npx drizzle-kit push |

**Re-run after adding plugins.**

---

## Database Adapters

| Database | Setup |
|----------|-------|
| SQLite | Pass better-sqlite3 or bun:sqlite instance directly |
| PostgreSQL | Pass pg.Pool instance directly |
| MySQL | Pass mysql2 pool directly |
| Prisma | prismaAdapter(prisma, { provider: "postgresql" }) from better-auth/adapters/prisma |
| Drizzle | drizzleAdapter(db, { provider: "pg" }) from better-auth/adapters/drizzle |
| MongoDB | mongodbAdapter(db) from better-auth/adapters/mongodb |

---

## Common Plugins

| Plugin | Server Import | Client Import | Purpose |
|--------|---------------|---------------|---------|
| twoFactor | better-auth/plugins | twoFactorClient | 2FA with TOTP/OTP |
| organization | better-auth/plugins | organizationClient | Teams/orgs |
| admin | better-auth/plugins | adminClient | User management |
| bearer | better-auth/plugins | - | API token auth |
| openAPI | better-auth/plugins | - | API docs |
| passkey | @better-auth/passkey | passkeyClient | WebAuthn |
| sso | @better-auth/sso | - | Enterprise SSO |

**Plugin pattern:** Server plugin + client plugin + run migrations.

---

## Auth UI Implementation

**Sign in flow:**
1. signIn.email({ email, password }) or signIn.social({ provider, callbackURL })
2. Handle error in response
3. Redirect on success

**Session check (client):** useSession() hook returns { data: session, isPending }

**Session check (server):** auth.api.getSession({ headers: await headers() })

**Protected routes:** Check session, redirect to /sign-in if null.

---

## Security Checklist

- [ ] BETTER_AUTH_SECRET set (32+ chars)
- [ ] advanced.useSecureCookies: true in production
- [ ] trustedOrigins configured
- [ ] Rate limits enabled
- [ ] Email verification enabled
- [ ] Password reset implemented
- [ ] 2FA for sensitive apps
- [ ] CSRF protection NOT disabled
- [ ] account.accountLinking reviewed

---

## Troubleshooting

| Issue | Fix |
|-------|-----|
| "Secret not set" | Add BETTER_AUTH_SECRET env var |
| "Invalid Origin" | Add domain to trustedOrigins |
| Cookies not setting | Check baseURL matches domain; enable secure cookies in prod |
| OAuth callback errors | Verify redirect URIs in provider dashboard |
| Type errors after adding plugin | Re-run CLI generate/migrate |

---

## Resources

- [Docs](https://better-auth.com/docs)
- [Examples](https://github.com/better-auth/examples)
- [Plugins](https://better-auth.com/docs/concepts/plugins)
- [CLI](https://better-auth.com/docs/concepts/cli)
- [Migration Guides](https://better-auth.com/docs/guides)

How to Use This Skill Unit

Option A: Project-Specific (Recommended)

  1. Click "Download" above
  2. In your project, create the directory: .agent/skills/create-auth/
  3. Save the file as SKILL.md
  4. The agent will automatically discover the skill based on its description.

Option B: Global Installation (All Agents)

Save the file to these locations to make it available across all projects:

  • Claude Code: ~/.claude/skills/better-auth/skills/create-auth/SKILL.md
  • Cursor: ~/.cursor/skills/better-auth/skills/create-auth/SKILL.md
  • Antigravity: ~/.gemini/antigravity/skills/better-auth/skills/create-auth/SKILL.md

πŸš€ Install with CLI:
npx skills add better-auth/skills

Read the Master Guide: Mastering Agent Skills β†’

Recommended Rules

View more rules β†’

Python Security Best Practices

PythonSecurityCryptography
You are an expert in Python security and secure coding practices. Key Principles: - Never trust user input - Use principle of least privilege - Keep ...

Web Security Best Practices Expert

SecurityWeb DevelopmentOWASP
You are an expert in web security and secure coding practices. Key Principles: - Follow OWASP Top 10 guidelines - Implement defense in depth - Valida...

Next.js Authentication & Authorization Expert

Next.jsAuthenticationSecurity
You are an expert in Next.js authentication and authorization. Key Principles: - Use Auth.js (NextAuth.js) for authentication - Implement server-side...

Recommended Workflows

View more workflows β†’

Security Hardening Checklist

SecurityHeadersCSP
--- description: Essential security headers, CSP, and rate limiting --- 1. **Security Headers (`next.config.js`)**: - Add these headers to prevent...

Supabase Row Level Security (RLS)

SupabaseDatabaseSecurity
--- description: Define secure database policies to protect user data --- 1. **Enable RLS**: - Always enable RLS on every table you create. ```...

Generate TypeScript Types from API

TypeScriptAPICodegen
--- description: Auto-generate type-safe API client from OpenAPI/Swagger spec --- 1. **Get Your API Schema**: - Most APIs expose OpenAPI spec at `...

Recommended MCP Servers

View more MCP servers β†’
PDFActionInspector

PDFActionInspector

Official

A Model Context Protocol server for extracting and analyzing JavaScript Actions from PDF files. Provides comprehensive security analysis to detect malicious PDF behaviors, hidden scripts, and potential security threats through AI-assisted risk assessment.

A

AWS Cognito

Community

An MCP server that connects to AWS Cognito for authentication and user management.

N

NPM Plus

Community

AI-powered JavaScript package management with security scanning, bundle analysis, and intelligent dependency management for MCP-compatible editors.

Take It Further

Maximize your productivity with these powerful resources

πŸ“‹

Define Your Standards

Set up coding standards to ensure this workflow produces consistent, high-quality results.

Browse Rules Library
πŸ“–

Master Workflows

Learn how to create custom workflows, use Turbo Mode, and build your automation library.

Complete Guide

How to use this Skill in Claude Code & Cursor

For Claude Code (CLI)

To use this skill in Claude Code, copy the rule content into your project's custom instructions or follow our Add-Skill CLI guide. This ensures Claude follows your standards during every code generation.

For Cursor & Windsurf

For Cursor or Windsurf, individual skills are best used in the "Rules for AI" section. This specific unit helps the agent avoid security & vulnerability analysis issues, leading to cleaner, more efficient code.

Why the skill format matters: the standardized Agent Skills format lets your AI agent load detailed instructions only when they are relevant, keeping your prompt clean while improving results.

Source & attribution

This skill is categorized under Security & Vulnerability Analysis and is published by Better Auth, maintained in better-auth/skills.

← Browse All Agent Skills
Sponsored AI assistant. Recommendations may be paid.