Better Auth
TypeScript-first authentication framework with plugins for passkeys, MFA, organizations, and SSO.
About
Better Auth is an open-source authentication framework for TypeScript applications. Instead of a hosted service, it ships as a library you run in your own backend, with adapters for Next.js, React, Express, Hono, SvelteKit, and other frameworks, plus database adapters for Postgres, MySQL, SQLite, and MongoDB. The plugin architecture covers email and password, magic links, email OTP, social OAuth sign-in, passkeys, two-factor authentication, admin tooling, multi-tenant organizations, and enterprise SSO via OIDC and SAML.
The project grew fast through 2025, passing 30,000 GitHub stars with commits landing daily as of October 2026, riding the wave of developers who want Auth0-style features without a vendor. An official MCP plugin lets coding agents manage auth flows. Because it is young, the API surface is still evolving, so upgrades need more attention than with decade-old auth libraries.
What it can do
- Email/password, magic link, email OTP, and social OAuth sign-in
- Passkeys, two-factor auth, and backup codes
- Organizations, teams, roles, and admin plugin
- Enterprise SSO via OIDC and SAML
- MCP plugin for agent-driven auth management
Setup
Install with npm install better-auth, create an auth instance wired to your database adapter, and mount the handler route in your framework.
Prerequisites
Node.js 18+; a TypeScript project; a database (Postgres, MySQL, SQLite, or MongoDB) unless using an ephemeral adapter.
Use cases
Works with
Trust score — 8/10
Scored 8/10 (verified tier, metrics-v1). Evidence: 30,308 GitHub stars; repo pushed 2026-10-15 (same-day activity); MIT license confirmed via GitHub API; Framework adapters, plugin list (passkeys, 2FA, orgs, SSO) and MCP plugin verified against official docs. Manual review: project is young (2024-era) with a still-evolving API surface; upgrades need care. License: MIT.
★ 30,308 GitHub stars
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.