better-auth
Audited by Runlayer on Feb 24, 2026
Malicious tool definition detected
```bash npm install better-auth ``` ### Backend Configuration ```typescript import { betterAuth } from 'better-auth'; import { twoFactor } from 'better-auth/plugins'; export const auth = betterAuth({ appName: 'My App', plugins: [ twoFactor({ issuer: 'My App', otpOptions: { async sendOTP({ user, otp }, ctx) { // Required: Send OTP to user via email, SMS, etc.
Description: Example ```typescript import { betterAuth } from 'better-auth'; import { twoFactor, organization, magicLink, passkey } from 'better-auth/plugins'; export const auth = betterAuth({ database: drizzleAdapter(schema, { provider: 'postgresql', }), emailAndPassword: { enabled: true, requireEmailVerification: true, }, socialProviders: { github: { clientId: process.env.AUTH_GITHUB_CLIENT_ID!, clientSecret: process.env.AUTH_GITHUB_CLIENT_SECRET!, enabled: true, }, }, plugins: [ twoFactor({ t
Tool passed security scan
Malicious tool definition detected
Description: await response.json(); setSession(data); } catch { setSession(null); } finally { setLoading(false); } } loadSession(); }, []); return { session, loading }; } ``` ## Step 8: Server Actions for Auth ```typescript // app/actions.ts 'use server'; import { auth } from '@/lib/auth'; import { headers } from 'next/headers'; export async function getSession() { return auth.api.getSession({ headers: await headers(), }); } export async function signOut() { return auth.api.signOut({ headers: aw
Malicious tool definition detected
Malicious tool definition detected
Malicious tool definition detected
Tool passed security scan
Malicious tool definition detected
**Security**: Enforce HTTPS in production 6.
Malicious tool definition detected
Tool: assets/nextjs/auth-client.ts Description: // Better Auth client configuration import { createAuthClient } from 'better-auth/react'; export const authClient = createAuthClient({ baseURL: process.env.NEXT_PUBLIC_BETTER_AUTH_URL || 'http://localhost:3000', });
Malicious tool definition detected
import jwt from 'jsonwebtoken'; import fs from 'fs'; function generateAppleClientSecret() { const privateKey = fs.readFileSync('./AuthKey.p8'); const token = jwt.sign({}, privateKey, { algorithm: 'ES256', keyid: process.env.AUTH_APPLE_KEY_ID, issuer: process.env.AUTH_APPLE_TEAM_ID, audience: 'https://appleid.apple.com', subject: process.env.AUTH_APPLE_CLIENT_ID, expiresIn: '180d', }); return token; } ``` ## Discord OAuth Setup ### 1.
Tool passed security scan
Tool passed security scan
Tool passed security scan
Tool passed security scan
Tool passed security scan
Passed Files (9)Click to expand
Tool passed security scan
Tool passed security scan
Tool passed security scan
Tool passed security scan
Tool passed security scan
Tool passed security scan
Tool passed security scan
Tool passed security scan
Tool passed security scan