better-auth

| BETTERAUTHSECRET | Encryption secret (min 32 chars). Generate: openssl rand -base64 32 | | BETTERAUTHURL | Base URL (e.g., https://example.com) |

Only define baseURL/secret in config if env vars are NOT set. CLI looks for auth.ts in: ./, ./lib, ./utils, or ./src.

| appName | Optional display name | | baseURL | Only if BETTERAUTHURL not set | | basePath | Default /api/auth. Set / for root. | | secret | Only if BETTERAUTHSECRET not set | | database | Required unless using stateless mode (v1.4+) | | secondaryStorage | Redis/KV for sessions and rate limits | | emailAndPassword | { enabled: true } to activate |

Self-hosted TypeScript auth framework with social auth, 2FA, passkeys, organizations, RBAC, and 15+ plugins. Supports Drizzle/Prisma/Kysely adapters. Self-hosted alternative to Clerk/Auth.js. Use when: configuring auth, adding plugins, social OAuth, multi-tenant SaaS, organizations with teams and RBAC, two-factor authentication (TOTP/OTP/backup codes), email verification, password reset flows, session management, rate limiting, CSRF and cookie security, Expo/mobile, D1 adapter errors, TanStack Start integration, additionalFields bugs, admin plugin, migrating from NextAuth, migrating from Clerk, migrating from Supabase Auth, or troubleshooting auth issues. Source: oakoss/agent-skills.