Better Auth

Better Auth is a framework-agnostic TypeScript authentication library designed to live inside your application codebase with a plugin-based, composable architecture that scales from weekend projects to enterprise deployments. The library is trusted by OpenAI, Databricks, and Strapi, with over 874 community contributors on GitHub. Core authentication includes email and password credential login with session management, email verification, password reset flows, and rate limiting built in. Social sign-on supports over 38 providers including Google, GitHub, Apple, Discord, Microsoft, LinkedIn, GitLab, and Spotify through the OAuth 2.0 and OIDC protocols. The plugin ecosystem extends to passkeys and WebAuthn, magic links, one-time passwords, API key generation and rotation, JWT issuance, bearer token authentication, anonymous-to-authenticated session upgrade, and multi-session management across devices. The organization plugin provides multi-tenancy with teams, roles, invitations, fine-grained access control, and member management. Enterprise plugins add SAML 2.0 single sign-on, SCIM directory sync, and OIDC provider capabilities. Better Auth pioneered the Agent Auth Protocol for securing AI agents and MCP servers, with token exchange, agent delegation, and scoped permissions. The Sentinel security module provides real-time threat detection including bot detection, brute force protection, breached password checking against the Have I Been Pwned database, impossible travel detection, geo-blocking, disposable email filtering, and free trial abuse prevention. Framework support covers Next.js, Nuxt, SvelteKit, Astro, Hono, Express, SolidStart, and over 20 additional frameworks through adapter packages. The CLI tool initializes projects with the npx auth init command.