SKILL PROCEDURE

Better Auth

Use when adding authentication to a TypeScript application with Better Auth — email and password, social providers, sessions, two-factor, organizations, RBAC — choosing a database adapter, generating the schema, or debugging why a plugin's client methods are missing. Published by HardGraph, a curated graph of provenance-backed knowledge for AI agents.

authenticationtypescriptsessionsoauthrbac
BEGINNER GUIDE

Understand Better Auth before using it

WHAT IT COVERS

Use when adding authentication to a TypeScript application with Better Auth — email and password, social providers, sessions, two-factor, organizations, RBAC — choosing a database adapter, generating the schema, or debugging why a plugin's client methods are missing. Published by HardGraph, a curated graph of provenance-backed knowledge for AI agents.

START HERE WHEN

Your work repeatedly involves one or more of these concepts. Open the full procedure below when the current task matches them.

authenticationtypescriptsessionsoauthrbac

Compare related skills

SKILLCATEGORYSHARED CONCEPTSEXPLANATION
Better AuthAuthenticationCurrent skillUse when adding authentication to a TypeScript application with Better Auth — email and password, social providers, sessions, two-factor, organizations, RBAC — choosing a database adapter, generating the schema, or debugging why a plugin's client methods are missing. Published by HardGraph, a curated graph of provenance-backed knowledge for AI agents.
AI SDKAI and agents
typescript
Vercel AI SDK — provider-agnostic TypeScript toolkit for building streaming AI applications and agents. Use when generating or streaming text with LLMs, wiring model providers (OpenAI, Anthropic, Google), implementing tool calling, producing structured output with Zod, building chat UIs with useChat, or composing multi-step agents with ToolLoopAgent. Published by HardGraph, a curated graph of provenance-backed knowledge for AI agents.
AngularWeb frameworks
typescript
Angular — Google's component-based web application framework for building client, mobile, and desktop apps with TypeScript. Use when building or upgrading Angular apps — components, templates and bindings, signals and computed state, dependency injection, RxJS interop, routing, forms, standalone components, zoneless change detection, or migrating from NgModules and the legacy module-based model. Published by HardGraph, a curated graph of provenance-backed knowledge for AI agents.
AppwriteBackend and data
authentication
Appwrite — an open-source backend-as-a-service (self-hosted or Cloud) providing Auth, Databases, Storage, Functions, Messaging, and Realtime. Use when adding user authentication and sessions, modelling data in the document database with attributes/permissions, uploading and serving files, running serverless Functions (Node, Python, Ruby, PHP, Dart) triggered by events or schedules, sending push/email/SMS, subscribing to realtime document changes, or integrating the Web/Flutter/Apple/Android/React Native SDKs and server SDKs. Published by HardGraph, a curated graph of provenance-backed knowledge for AI agents.

Better Auth

What is HardGraph? HardGraph publishes curated, provenance-backed agent skills grounded in reproducible vendor documentation.

Better Auth is an authentication framework, not an authentication service. It runs inside your application and the user and session tables live in your own database. Nothing is stored on someone else's infrastructure, and there is no dashboard that holds the truth.

That is the whole design, and it explains the two things people trip over.

The schema is yours, so you must create it

There is no hosted store quietly provisioning tables. Adding Better Auth — or enabling a plugin, or changing a config option that needs a column — changes the schema your database must have.

The CLI derives that schema from your config and either writes a migration or applies one. Skipping it produces runtime errors about missing tables or columns that look like library bugs and are not.

Treat it as part of the change, in the same commit: config change → regenerate schema → migrate. A plugin enabled in code but absent from the database is the single most common broken state.

Plugins have two halves and both must be installed

A plugin is not only server-side. Most add server capability and client methods, and they are wired in two places — the server instance and the client instance.

Installing only the server half is the failure that wastes the most time: the endpoint exists, the server works, and the typed client simply has no method for it. It presents as a TypeScript error or an undefined function, which reads like a version mismatch rather than a missing registration.

When a client method you expect is missing, check that the plugin is registered on the client instance before suspecting anything else.

Choosing an adapter

The adapter binds Better Auth to your existing database layer. Pick the one that matches what the application already uses rather than introducing a second data access path — Drizzle, Prisma, Kysely, MongoDB, and direct relational connections are all supported.

If the project already has an ORM, use that adapter. Introducing a second one to satisfy the auth layer means two migration systems over one database.

What to verify rather than recall

Better Auth moves quickly and its plugin surface is the fastest-moving part.

  • Plugin names, options, and their client counterparts.
  • CLI commands for schema generation and migration.
  • Adapter configuration, which follows each ORM's own conventions.
  • Required environment variables and the base-URL configuration, which affects OAuth callback URLs.

Check these against the mirrored corpus under references/vendor/ rather than asserting an option name.

References

Hardgraph / curated knowledge for agents.

STATIC EXPORT · CANONICAL SOURCE