better-auth

Provides a self-hosted authentication solution for TypeScript and Cloudflare Workers, featuring social auth, 2FA, and RBAC.

Install this skill

0/100

Security score

The better-auth skill was audited on Feb 9, 2026 and we found 86 security issues across 4 threat categories, including 1 high-severity. Review the findings below before installing.

Categories Tested

Security Issues

medium line 270

Template literal with variable interpolation in command context

SourceSKILL.md

270	authorization_endpoint: `${process.env.BETTER_AUTH_URL}/api/auth/oauth2/authorize`,

medium line 271

Template literal with variable interpolation in command context

SourceSKILL.md

271	token_endpoint: `${process.env.BETTER_AUTH_URL}/api/auth/oauth2/token`,

medium line 1439

Template literal with variable interpolation in command context

SourceSKILL.md

1439	const callbackURL = `${env.BETTER_AUTH_URL}/api/auth/callback/google`;

medium line 1486

Template literal with variable interpolation in command context

SourceSKILL.md

1486

html: `

high line 1221

System command execution

SourceSKILL.md

1221	- 2FA system (TOTP, backup codes, email OTP): 20 hours

low line 707

Fetch to external URL

SourceSKILL.md

707	await fetch("https://api.example.com/data", {

low line 269

Access to .env file

SourceSKILL.md

269	issuer: process.env.BETTER_AUTH_URL,

low line 270

Access to .env file

SourceSKILL.md

270	authorization_endpoint: `${process.env.BETTER_AUTH_URL}/api/auth/oauth2/authorize`,

low line 271

Access to .env file

SourceSKILL.md

271	token_endpoint: `${process.env.BETTER_AUTH_URL}/api/auth/oauth2/token`,

low line 1154

Access to .env file

SourceSKILL.md

1154	const db = createDatabase(c.env.DB);

low line 1155

Access to .env file

SourceSKILL.md

1155	const auth = createAuth(db, c.env);

low line 57

External URL reference

SourceSKILL.md

57	📚 Docs: https://www.better-auth.com/changelogs

low line 75

External URL reference

SourceSKILL.md

75	📚 Docs: https://www.better-auth.com/changelogs

low line 87

External URL reference

SourceSKILL.md

87	📚 Docs: https://www.better-auth.com/blog/1-3

low line 217

External URL reference

SourceSKILL.md

217	📚 Official Docs: https://www.better-auth.com/docs/integrations/tanstack

low line 227

External URL reference

SourceSKILL.md

227	\| OAuth 2.1 Provider \| `better-auth/plugins` \| Build OAuth 2.1 provider with PKCE, JWT tokens, consent flows (replaces MCP & OIDC plugins) \| [📚](https://www.better-auth.com/docs/plugins/oauth-pro

low line 228

External URL reference

SourceSKILL.md

228	\| SSO \| `better-auth/plugins` \| Enterprise Single Sign-On with OIDC, OAuth2, and SAML 2.0 support \| [📚](https://www.better-auth.com/docs/plugins/sso) \|

low line 229

External URL reference

SourceSKILL.md

229	\| Stripe \| `better-auth/plugins` \| Payment and subscription management with flexible lifecycle handling \| [📚](https://www.better-auth.com/docs/plugins/stripe) \|

low line 230

External URL reference

SourceSKILL.md

230	\| MCP \| `better-auth/plugins` \| ⚠️ Deprecated - Use OAuth 2.1 Provider instead \| [📚](https://www.better-auth.com/docs/plugins/mcp) \|

low line 231

External URL reference

SourceSKILL.md

231	\| Expo \| `better-auth/expo` \| React Native/Expo with `webBrowserOptions` and last-login-method tracking \| [📚](https://www.better-auth.com/docs/integrations/expo) \|

low line 283

External URL reference

SourceSKILL.md

283	redirectURLs: ["https://claude.ai/callback"],

low line 290

External URL reference

SourceSKILL.md

290	📚 Full Docs: https://www.better-auth.com/docs/plugins/oauth-provider

low line 300

External URL reference

SourceSKILL.md

300	\| Bearer \| API token auth (alternative to cookies for APIs) \| [📚](https://www.better-auth.com/docs/plugins/bearer) \|

low line 301

External URL reference

SourceSKILL.md

301	\| One Tap \| Google One Tap frictionless sign-in \| [📚](https://www.better-auth.com/docs/plugins/one-tap) \|

low line 302

External URL reference

SourceSKILL.md

302	\| SCIM \| Enterprise user provisioning (SCIM 2.0) \| [📚](https://www.better-auth.com/docs/plugins/scim) \|

low line 303

External URL reference

SourceSKILL.md

303	\| Anonymous \| Guest user access without PII \| [📚](https://www.better-auth.com/docs/plugins/anonymous) \|

low line 304

External URL reference

SourceSKILL.md

304	\| Username \| Username-based sign-in (alternative to email) \| [📚](https://www.better-auth.com/docs/plugins/username) \|

low line 305

External URL reference

SourceSKILL.md

305	\| Generic OAuth \| Custom OAuth providers with PKCE \| [📚](https://www.better-auth.com/docs/plugins/generic-oauth) \|

low line 306

External URL reference

SourceSKILL.md

306	\| Multi-Session \| Multiple accounts in same browser \| [📚](https://www.better-auth.com/docs/plugins/multi-session) \|

low line 307

External URL reference

SourceSKILL.md

307	\| API Key \| Token-based auth with rate limits \| [📚](https://www.better-auth.com/docs/plugins/api-key) \|

low line 398

External URL reference

SourceSKILL.md

398	discoveryUrl: "https://linear.app/.well-known/openid-configuration",

low line 686

External URL reference

SourceSKILL.md

686	baseURL: "https://api.example.com",

low line 707

External URL reference

SourceSKILL.md

707	await fetch("https://api.example.com/data", {

low line 816

External URL reference

SourceSKILL.md

816	📚 Docs: https://www.better-auth.com/docs/plugins/2fa

low line 883

External URL reference

SourceSKILL.md

883	📚 Docs: https://www.better-auth.com/docs/plugins/organization

low line 952

External URL reference

SourceSKILL.md

952	📚 Docs: https://www.better-auth.com/docs/plugins/admin

low line 956

External URL reference

SourceSKILL.md

956	Passkey Plugin (5 endpoints) - [Docs](https://www.better-auth.com/docs/plugins/passkey):

low line 959

External URL reference

SourceSKILL.md

959	Magic Link Plugin (2 endpoints) - [Docs](https://www.better-auth.com/docs/plugins/magic-link):

low line 962

External URL reference

SourceSKILL.md

962	Username Plugin (2 endpoints) - [Docs](https://www.better-auth.com/docs/plugins/username):

low line 965

External URL reference

SourceSKILL.md

965	Phone Number Plugin (5 endpoints) - [Docs](https://www.better-auth.com/docs/plugins/phone-number):

low line 968

External URL reference

SourceSKILL.md

968	Email OTP Plugin (6 endpoints) - [Docs](https://www.better-auth.com/docs/plugins/email-otp):

low line 971

External URL reference

SourceSKILL.md

971	Anonymous Plugin (1 endpoint) - [Docs](https://www.better-auth.com/docs/plugins/anonymous):

low line 974

External URL reference

SourceSKILL.md

974	JWT Plugin (2 endpoints) - [Docs](https://www.better-auth.com/docs/plugins/jwt):

low line 977

External URL reference

SourceSKILL.md

977	OpenAPI Plugin (2 endpoints) - [Docs](https://www.better-auth.com/docs/plugins/open-api):

low line 1019

External URL reference

SourceSKILL.md

1019	body: { name: "New Name", image: "https://..." },

low line 1198

External URL reference

SourceSKILL.md

1198	Interactive documentation: Visit `http://localhost:8787/api/auth/reference`

low line 1398

External URL reference

SourceSKILL.md

1398	origin: "http://localhost:5173", // Frontend URL (no trailing slash)

low line 1406

External URL reference

SourceSKILL.md

1406	trustedOrigins: ["http://localhost:5173"], // Same as CORS origin

low line 1429

External URL reference

SourceSKILL.md

1429	Provider setting: https://yourdomain.com/api/auth/callback/google

low line 1430

External URL reference

SourceSKILL.md

1430	better-auth URL: https://yourdomain.com/api/auth/callback/google

low line 2030

External URL reference

SourceSKILL.md

2030	- Homepage: https://better-auth.com

low line 2031

External URL reference

SourceSKILL.md

2031	- Introduction: https://www.better-auth.com/docs/introduction

low line 2032

External URL reference

SourceSKILL.md

2032	- Installation: https://www.better-auth.com/docs/installation

low line 2033

External URL reference

SourceSKILL.md

2033	- Basic Usage: https://www.better-auth.com/docs/basic-usage

low line 2037

External URL reference

SourceSKILL.md

2037	- Session Management: https://www.better-auth.com/docs/concepts/session-management

low line 2038

External URL reference

SourceSKILL.md

2038	- Users & Accounts: https://www.better-auth.com/docs/concepts/users-accounts

low line 2039

External URL reference

SourceSKILL.md

2039	- Client SDK: https://www.better-auth.com/docs/concepts/client

low line 2040

External URL reference

SourceSKILL.md

2040	- Plugins System: https://www.better-auth.com/docs/concepts/plugins

low line 2044

External URL reference

SourceSKILL.md

2044	- Email & Password: https://www.better-auth.com/docs/authentication/email-password

low line 2045

External URL reference

SourceSKILL.md

2045	- OAuth Providers: https://www.better-auth.com/docs/concepts/oauth

low line 2050

External URL reference

SourceSKILL.md

2050	- 2FA (Two-Factor): https://www.better-auth.com/docs/plugins/2fa

low line 2051

External URL reference

SourceSKILL.md

2051	- Organization: https://www.better-auth.com/docs/plugins/organization

low line 2052

External URL reference

SourceSKILL.md

2052	- Admin: https://www.better-auth.com/docs/plugins/admin

low line 2053

External URL reference

SourceSKILL.md

2053	- Multi-Session: https://www.better-auth.com/docs/plugins/multi-session

low line 2054

External URL reference

SourceSKILL.md

2054	- API Key: https://www.better-auth.com/docs/plugins/api-key

low line 2055

External URL reference

SourceSKILL.md

2055	- Generic OAuth: https://www.better-auth.com/docs/plugins/generic-oauth

low line 2058

External URL reference

SourceSKILL.md

2058	- Passkey: https://www.better-auth.com/docs/plugins/passkey

low line 2059

External URL reference

SourceSKILL.md

2059	- Magic Link: https://www.better-auth.com/docs/plugins/magic-link

low line 2060

External URL reference

SourceSKILL.md

2060	- Email OTP: https://www.better-auth.com/docs/plugins/email-otp

low line 2061

External URL reference

SourceSKILL.md

2061	- Phone Number: https://www.better-auth.com/docs/plugins/phone-number

low line 2062

External URL reference

SourceSKILL.md

2062	- Anonymous: https://www.better-auth.com/docs/plugins/anonymous

low line 2065

External URL reference

SourceSKILL.md

2065	- Username: https://www.better-auth.com/docs/plugins/username

low line 2066

External URL reference

SourceSKILL.md

2066	- JWT: https://www.better-auth.com/docs/plugins/jwt

low line 2067

External URL reference

SourceSKILL.md

2067	- OpenAPI: https://www.better-auth.com/docs/plugins/open-api

low line 2068

External URL reference

SourceSKILL.md

2068	- OIDC Provider: https://www.better-auth.com/docs/plugins/oidc-provider

low line 2069

External URL reference

SourceSKILL.md

2069	- SSO: https://www.better-auth.com/docs/plugins/sso

low line 2070

External URL reference

SourceSKILL.md

2070	- Stripe: https://www.better-auth.com/docs/plugins/stripe

low line 2071

External URL reference

SourceSKILL.md

2071	- MCP: https://www.better-auth.com/docs/plugins/mcp

low line 2075

External URL reference

SourceSKILL.md

2075	- TanStack Start: https://www.better-auth.com/docs/integrations/tanstack

low line 2076

External URL reference

SourceSKILL.md

2076	- Expo (React Native): https://www.better-auth.com/docs/integrations/expo

low line 2082

External URL reference

SourceSKILL.md

2082	- Discord: https://discord.gg/better-auth

low line 2087

External URL reference

SourceSKILL.md

2087	- Drizzle ORM: https://orm.drizzle.team/docs/get-started-sqlite

low line 2088

External URL reference

SourceSKILL.md

2088	- Kysely: https://kysely.dev/

low line 2130

External URL reference

SourceSKILL.md

2130	- [Hono + better-auth on Cloudflare](https://hono.dev/examples/better-auth-on-cloudflare) - Official Hono example

low line 2131

External URL reference

SourceSKILL.md

2131	- [React Router + Cloudflare D1](https://dev.to/atman33/setup-better-auth-with-react-router-cloudflare-d1-2ad4) - React Router v7 guide

low line 2132

External URL reference

SourceSKILL.md

2132	- [SvelteKit + Cloudflare D1](https://medium.com/@dasfacc/sveltekit-better-auth-using-cloudflare-d1-and-drizzle-91d9d9a6d0b4) - SvelteKit guide

Scanned on Feb 9, 2026

View Security Dashboard

Installation guide →

GitHub Stars 2.2K

Rate this skill

Categorydevelopment

UpdatedApril 10, 2026

openclaw backend backend-developer product-manager growth-pm development product

openclaw/skills