What it is
Better Auth is a framework-agnostic authentication and authorization framework written in TypeScript. It targets the broader JavaScript/TypeScript ecosystem and is designed to integrate with any backend or frontend framework, including Next.js, Express, SvelteKit, and others. It provides a unified API surface for core identity workflows such as sign-up, sign-in, session management, and passwordless flows.
It solves the fragmented state of authentication libraries in the TypeScript ecosystem, where developers often must combine multiple tools or write boilerplate code to support features beyond basic username/password login. Better Auth consolidates these patterns into a single, extensible package with built-in support for OAuth, OIDC, SSO, and multi-tenancy—reducing the need for custom implementations or reliance on external hosted services.
Key capabilities
- Supports OAuth 2.0 and OpenID Connect providers (e.g., Google, GitHub, Stripe) via configurable adapters
- Built-in multi-tenant session and role-based access control (RBAC) with plugin support
- Two-factor authentication (2FA) using TOTP or email/SMS one-time codes
- Passwordless authentication via magic links or one-time codes
- Session management with token rotation, revocation, and persistence to custom databases
- Plugin system for adding features like SSO, audit logging, and rate limiting without core changes
- Framework-agnostic API routes and client SDKs for seamless integration in any stack
Who uses it and how
- Full-stack TypeScript developers building SaaS products with multi-tenant requirements and need role-based access control
- Teams migrating from hosted auth providers (e.g., Auth0, Cognito) to self-hosted solutions requiring full data control
- Startups and mid-sized companies using Next.js or Express who want to avoid vendor lock-in while maintaining feature parity with commercial offerings
Getting started
Install via npm install better-auth or pnpm add better-auth, then initialize with createAuthClient() and configure providers/databases in a few lines of code. A Docker image is not listed; deployment relies on standard Node.js hosting with a supported database (e.g., PostgreSQL, MySQL, SQLite).
When to use it — and when not to
Better Auth replaces self-hosted alternatives like Authelia or custom JWT stacks but does not natively provide hosted infrastructure, email delivery, or compliance certifications—those must be added separately. It requires operating a database for user storage and session persistence, and SMTP or third-party SMS/email services for notifications. It is unsuitable for teams needing out-of-the-box SOC2 or HIPAA compliance, or those without backend engineering capacity to manage auth state and migrations.
project readme (upstream, from github) — read inline
Discord
·
Website
·
Issues
Better Auth
Better Auth is a framework-agnostic authentication (and authorization) framework for TypeScript. It provides a comprehensive set of features out of the box and includes a plugin ecosystem that simplifies adding advanced functionalities with minimal code in a short amount of time. Whether you need 2FA, multi-tenant support, or other complex features, it lets you focus on building your actual application instead of reinventing the wheel.
Why Better Auth
Authentication in the TypeScript ecosystem is a half-solved problem. Other open-source libraries often require a lot of additional code for anything beyond basic authentication. Rather than just pushing third-party services as the solution, I believe we can do better as a community—hence, Better Auth.
Contribution
Better Auth is a free and open source project licensed under the MIT License. You are free to do whatever you want with it.
You could help continuing its development by:
Security
If you discover a security vulnerability within Better Auth, please report it via GitHub Security Advisories.
All reports will be promptly addressed, and you'll be credited accordingly.
