Better Auth

BA

Better Auth

Join the community to ask questions about Better Auth and get answers from other members.

Join

bug-reports

help

Error on Signup with OTP

//auth.ts ```ts import { betterAuth, BetterAuthOptions } from "better-auth"; import { prismaAdapter } from "better-auth/adapters/prisma"; import { admin, emailOTP, openAPI, twoFactor } from "better-auth/plugins";...

Issue with Session Revocation and Middleware in Next.js

I’m trying to revoke a user session in a Next.js app using middleware, but I’m running into a problem. After calling revoke-sessions and redirecting the user (which triggers the middleware again), get-session still returns a session—even though it’s supposed to be revoked. This causes an infinite redirect loop (too many redirects). Is it possible to properly delete or invalidate sessions from within the middleware? Or is there a better way to handle session revocation and redirection flow?...
No description

Nextjs middleware not working

In this i am using the getSessionCookies() but the sessionCookie returns as null i am using the cookiePrefix also ...
No description

First Sign In

What's the best hook to catch first sign in of a user ?

Expo Google login

I'm using better-auth with Expo for Google social login. In the socialProviders config, I see that Google requires both clientId and clientSecret, but as far as I understand, when using the Android client (for mobile), Google doesn't provide a clientSecret. If I try to leave it as undefined, I get a type error. ...
Solution:
Oh wait, if you’re authenticating in the expo app, you should get idToken and you should use id token auth instead.

Authentication with Express backend + Next.js frontend

This is my first time using Better Auth, so forgive me if this is obvious 😅 I have an existing backend built with Express, which has Better Auth setup and running. We are creating a new Next.js frontend, on a separate server, which needs to authenticate against this backend. ...
Solution:

Plugin to extend organization plugin

Hello everyone 👋 I'm building a plugin to extend organizations by making sub-organizations. The idea is that I want to extend organization schema to include sub-organizations to make it one-to-many (one organization to many sub-organization) how can I achieve such thing? I'm thinking of auth.ts:...

annotations forbetterAuth and createAuthClient

It was clean but I think I fuc-ked up typescript by updating it? both betterAuth and createAuthClient throw annotations errors. The inferred type of 'betterAuthClient' cannot be named without a reference to '@/node_modules/better-auth/dist/shared/better-auth.BAfIsot3'. This is likely not portable. A type annotation is necessary.ts(2742)...
Solution:
Just dealing with this myself, you can: 1. if your project is not a library, set declaration and declarationMap to false in your tsconfig 2. if it is a library, you're probably exporting a function that needs it's return type annotated. Good thread with some solutions here: https://github.com/pnpm/pnpm/issues/6089...
No description

Rate Limit doesn't work for /send-verification-email

I am trying to configure rate limiting in Next.js, but for some reason it doesn't work. I tried in both dev and prod environments, with the following config: `rateLimit: { enabled: true, customRules: {...
Solution:
Okay apparently calling auth.api.sendVerificationEmail from server bypasses the rate limitations, it only works when request is coming from the client using authClient.sendVerificationEmail

Cannot set additionalField when calling signUp.email

I'm trying to pass a referredBy field during user registration using signUp.email, but TypeScript is rejecting it with the following error: "Object literal may only specify known properties, and 'referredBy' does not exist in type " 1. I've properly configured referredBy in my auth.ts configuration:...
Solution:
I had plugins indented

Importing TWO_FACTOR_ERROR_CODES – Is It Possible?

Hello, is it possible to import TWO_FACTOR_ERROR_CODES from the file plugins/two-factor/error-code.ts? Github link...
Solution:
Not right now, but I just made a PR to fix this. https://github.com/better-auth/better-auth/pull/2102...

Discord auth scopes

Hii can i configure the scopes i want while authorizing the user using better auth?
Solution:
To give you an example:

Different frontend and backend URL with social logins

Hi, my backend is hosted on api.mydomain.com while my frontend is hosted on mydomain.com. Everytime I try to login through google social sign-in I get redirected to api.mydomain.com instead. How can I make better-auth work in this scenario?...
Solution:
I just had to provide a callbackURL during signIn.social

Apple authentificaiton

Hey i'm kinda new to better auth and i did create pretty easily auth with credentials and google, i have a apple developper license and i'm looking to create an authentication but i'm stuck : i'm using nextjs on this app : i created the app id xx.xx.appname with Sign In with Apple but no setup...
Solution:
you will need to generate the apple client secret yourself, you can set up a script to do just that eg ```typescript const jwt = require("jsonwebtoken"); // Create JWT...

Next.js + elysia.js cookie session issue

"This cookie was blocked because it had the "SameSite=Lax" attribute and the request was made from a different site and was not initiated by a top-level navigation." the cookies getting blocked by saying this error above. my frontend is next js in local enviornment and the backend is in elysia js in deployed version ...
No description

Error sign up Invalid `db[getModelName(model)].create()` invocation in

I use prisma with MongoDB as its database and when signing up there is an error like in the picture. How do I fix it?
No description

2FA email login with `auth.api`: Ensure verification is completed?

Hey! When using auth.api.signInEmail to sign in to a user with 2FA (TOTP) enabled, how do I ensure that the 2FA verification has been completed for that session? I can always say that after signing in, the user is redirected to the 2FA verification flow, but I don't see any immediate Better-Auth-native way of blocking the user from simply changing the URL and go to a different page again and thus avoid 2FA. Should the result of the auth.api.verifyTOTP perhaps be stored in the Session table for easy look-up to ensure that the user has indeed successfully completed the verification? Or am I completely missing something here, for instance that the user shouldn't actually be logged (i.e., no Session is created) in unless they complete 2FA? Possible quirk: I don't use the client-side authClient, I have all interactions on server-side using auth.api.{method} and I've done all necessary migrations and TOTP enabling/disabling from user profile works as expected. I use fullstack SvelteKit with interactions via form actions....

Better Auth + Hono + Nextjs ( JStack ) Cookies

I've configured Everything for better auth to work with jstack but the Cookies dosen't set on login. As the images showing the cookies are empty. I've logged in using Magic Link.How can I fix the issues with the cookies ```import { createAuthClient } from "better-auth/react"; import { magicLinkClient, adminClient } from "better-auth/client/plugins";...

Auth service for a microservice

How would build auth service in a microservice using better-auth as the auth service for a the api getaway. I intend to use honojs. How would you go about this? ...
Solution:
Yeah as I said , by the end of the day it is an backend services built with wb frameworks like honojs to handle server side stuff which better auth is part of it so you should treat it as a backend with auth but make sure to include all the necessary info for you from your auth backend to your api gateway to ensure the communication and also make sure to include the origin you trust with a better auth config

cloudflare error

Hello - I have a sveltekit application which is hosted on cloudflare pages. I am using google social login, and it works fine in development. but in prod, it gives me 500 error right after I click on google account...