Better Auth keeps identity code and data inside the application
Better Auth gives a TypeScript application a server handler, typed client, session model, and database schema rather than sending every identity operation to a hosted vendor. Email and password login and social providers cover the basic path. Plugins add passkeys, magic links, two-factor authentication, organizations, SSO, SCIM, API keys, and an OAuth provider. The same library can sit beside an application or run as a separate self-hosted auth server. User records remain in the database the team already controls.
The project had 29,688 GitHub stars and 680 open issues and pull requests when we fetched it on August 26, 2026. That interest makes the adapter and plugin ecosystem attractive, yet the combined open count also signals a lot of moving surface area. Better Auth is framework agnostic because its handler uses standard Request and Response objects. Its guides provide specific wiring for Next.js, Nuxt, SvelteKit, Hono, Cloudflare Workers, Express, Expo, and several other runtimes. CommonJS is expressly unsupported.
The quick start still includes a database and schema work
Installation starts with the package, a high-entropy secret of at least 32 characters, and a base URL. The app creates an auth instance, chooses a database, generates or migrates the required tables, mounts a catch-all route, and creates a client instance. SQLite, PostgreSQL, and MySQL can connect directly. Drizzle, Prisma, MongoDB, and other adapters cover projects that already have a persistence layer. Stateless sessions are possible, although the guide says most plugins need a database.
A social login adds at least 2 provider values, the client ID and client secret, plus callback configuration at the provider. Password reset, verification, and magic-link features need an email sender. Passkeys, organizations, SSO, SCIM, and API keys add their own policy decisions and sometimes schema. Better Auth avoids per-user vendor pricing, but it does not remove operational ownership. The adopting team is responsible for secret rotation, migrations, mail reliability, abuse controls, backups, logs, and security response.
What happened when we ran it
Our sandbox installed 2,442 packages in 59 seconds and used 2,841 MB on disk. The build then succeeded in 113 seconds. We tested commit 79904f0 inside an unprivileged lab-node:22 container with 3 CPUs, 8 GB of RAM, and no secrets. The checkout held 2,201 files and about 465,466 source lines. These numbers describe the pnpm monorepo development path, not the cost of adding one runtime package to an application.
The test command failed after 159 seconds. Our harness summary recorded 334 passing tests and 1 failing test out of 335. The supplied log tail shows another layer of workspace reporting: better-auth:test ended with 2 failed files, 96 passed files, 1 skipped file, 2,600 passing tests, 2 failures, 11 skips, and 1 todo. It also shows all 924 OAuth-provider tests passing. We cannot reconcile the two aggregation levels from the tail alone, so both are reported without inventing a cause.
Plugins save code while increasing the upgrade surface
Better Auth's plugin design is more substantial than a list of callbacks. A plugin can define endpoints, database tables, hooks, request middleware, rate limits, trusted origins, and a typed client extension. That makes it possible to add an organization or passkey feature without forking the core. The CLI includes plugin schema in generated migrations, and additional user or session fields flow into inferred TypeScript types. Teams can also write private plugins for their own policies.
Version v1.7.1, released August 18, 2026, shows both the value and the cost of that breadth. It fixed database transactions, SCIM parsing and credentials, SAML assertion verification, adapter transactions, OAuth scope errors for MCP clients, and a dangerous CLI migration case. Current issue #10913 reports that the same OAuth-provider release rejects every loopback redirect URI for web clients. Issue #10947 reports nullable Drizzle v1 fields where generated schema should include notNull(). Each deployed combination needs regression tests.
Edge runtimes need more scrutiny than Node servers
Cloudflare Workers are documented, including the Node compatibility flag needed for AsyncLocalStorage. The docs also support constructing auth from request-scoped bindings, which is common on that platform. Issue #10999 identifies a specific concern in v1.7.1: generic OAuth discovery reportedly runs during plugin initialization for every auth instance, has no shared cache, and exposes no fetch timeout. A stalled identity provider could therefore affect routes that only need an existing session. The report is source analysis, not a documented production outage.
That distinction matters because authentication failures have a wide blast radius. A team deploying to Workers should reproduce the generic OIDC path under slow and unavailable discovery endpoints before launch. Node applications should test migration rollback, session revocation, provider token refresh, and email failure. The repository includes 16 CI workflow files and a tests directory, but our red run is reason enough to treat local integration coverage as part of the product, not optional ceremony.
Current development is healthy and demands careful pinning
GitHub recorded a push on August 26, 2026, eight days after v1.7.1. New issues received replies within hours, and the release notes span core, adapters, SCIM, SSO, OAuth, and CLI packages. That is healthy maintenance for a security-sensitive library. It also means a minor release can touch several authentication protocols and storage paths at once. The 680 open issues and pull requests should be read as an active queue, not a defect count.
Better Auth is strongest for a TypeScript team that wants ownership and has the discipline to exercise it. Choose a small set of plugins, keep schema changes in normal review, and pin every Better Auth package to compatible versions. Test login, logout, revocation, provider failure, and migration against a copy of production data. If the team wants someone else to handle those duties, a managed identity service is the honest alternative. If it wants control, Better Auth is one of the most capable open choices, with a heavier source tree than its tidy API suggests.