BetterAuth Self-Hosted
IntermediateWeb AppA self-hosted BetterAuth server: sign-in, sessions, and OAuth for your apps on infrastructure you run.
Published 27 September 2026
About BetterAuth Self-Hosted
BetterAuth is an open-source TypeScript authentication framework. By default it lives inside your app: a route handler mounted at /api/auth that stores users, sessions, and accounts in the app's own database. This stack runs it the other way, as a dedicated auth server: a small Node service whose only job is authentication, with PostgreSQL behind it and Docker packaging both.
What makes that work is the OAuth 2.1 Provider plugin. It turns the BetterAuth instance into an authorization server with OpenID Connect: your apps register as clients, send users to the auth server to sign in, and receive signed tokens they verify against its JWKS endpoint. One login then covers every app that trusts the server, the way a hosted identity provider works, and the MCP plugin extends the same server to MCP servers and agent tools. Email and password, social providers, magic links, passkeys, two-factor authentication, and organizations all come from the same plugin system.
What you give up is the hosted dashboard. The admin plugin exposes user management as APIs (list, ban, impersonate, revoke sessions) but ships no interface, so teams build a small admin page, run a community dashboard such as Better Auth Studio, or pay for the vendor's Better Auth Infrastructure, which adds a managed dashboard, audit logs, abuse protection, and email and SMS sending on top of the server you still run yourself.
The stack suits several apps that should share one login, products that need identity data on their own infrastructure, and TypeScript teams who want auth reviewed as code rather than configured in a vendor console. A single app with one backend usually doesn't need a separate server: mounting BetterAuth inside that backend is simpler, and the project stacks list it as an authentication option for exactly that.
Key Features
- ✓OAuth 2.1 Provider plugin: one BetterAuth server signs users in for every app that trusts it
- ✓OpenID Connect with signed JWTs that clients verify through the server's JWKS endpoint
- ✓Email and password, social login, magic links, passkeys, and two-factor authentication as plugins
- ✓Users, sessions, accounts, and OAuth clients stored in your own PostgreSQL
- ✓Admin plugin APIs for listing, banning, and impersonating users and revoking sessions
- ✓Docker packaging for the auth server and PostgreSQL, portable across any VPS or cloud instance
When to Use BetterAuth Self-Hosted
- →Several apps or subdomains that should share one login
- →Products replacing Clerk or Auth0 to remove per-user pricing
- →Teams whose data-residency rules keep identity data off third-party services
- →Authorization for MCP servers and AI agent tools through the MCP plugin
- →TypeScript teams who want auth configuration reviewed in code
Pros
- No per-user cost at any scale; the bill is one small server
- Identity data stays in a PostgreSQL database you control and can export
- Standard OAuth 2.1 and OpenID Connect, so any compliant client library can sign in against it
- Auth configuration lives in TypeScript under version control
Cons
- You are the identity provider: security patches, signing keys, and uptime are yours
- No admin interface ships with the server; build one, run a community dashboard, or pay for the vendor's
- Younger and less proven for multi-app federation than Keycloak
- A separate server adds a deploy and a redirect hop compared with embedding BetterAuth in one app
Hosting Options for BetterAuth Self-Hosted
Deploy BetterAuth Self-Hosted on Hetzner
A flat-rate root VPS where the auth server and its PostgreSQL share one small instance, from around €4-5/mo. Login traffic is light, so an entry instance carries a sizeable user base; the cost is running backups and security updates yourself, which matters more for an identity server than for most services.
Deploy BetterAuth Self-Hosted on Railway
Runs the auth server as an ordinary Node service with managed PostgreSQL in the same project, redeploying on git push. Railway terminates TLS itself, so the reverse proxy or PaaS choice doesn't apply. The $5/mo Hobby plan plus usage typically lands a small auth server around $10/mo, with no server to patch.
Deploy BetterAuth Self-Hosted on Render
Runs the auth server as a Node web service with Render's managed PostgreSQL behind it and TLS terminated at the platform. Skip the free tier: a free service sleeps after 15 minutes idle and its free database expires after 30 days, and a sign-in that waits on a cold start is a poor first impression. Budget the $7/mo Starter instance plus the database.
Deploy BetterAuth Self-Hosted on DigitalOcean
A root Droplet from about $6/mo with snapshots and a cloud firewall in the panel, plus managed PostgreSQL (from about $15/mo) if you'd rather not run the identity database yourself. Managed backups with point-in-time recovery are the reason to pick it for auth specifically: that database holds every user, session, and signing key.
Deploy BetterAuth Self-Hosted on Hostinger
The lowest-cost VPS in the list, with KVM plans from around $5/mo and a beginner-friendly panel. BetterAuth's own footprint is modest, so the entry plan works; the tradeoff is fewer regions for placing the auth server near your apps' users, and backups and hardening are still yours.
These are highlighted picks. To see all the tools, check the Hosting & Cloud category.
Reverse Proxy Options for BetterAuth Self-Hosted
BetterAuth Self-Hosted with Traefik
Configures itself from Docker labels on the auth container and renews Let's Encrypt certificates automatically. The BetterAuth setting to get right behind any proxy is the public base URL (BETTER_AUTH_URL) and the trusted origins, since OAuth redirect URIs and the token issuer are built from them.
BetterAuth Self-Hosted with Caddy
Automatic HTTPS from a few lines of config, simpler than Traefik's labels for a single auth service. Caddy forwards the original host and protocol by default, so secure session cookies and OAuth callbacks see the public HTTPS address without extra setup.
BetterAuth Self-Hosted with NGINX
The most familiar proxy, with TLS managed manually through Certbot. Set the forwarded protocol and host headers explicitly: without them the auth server believes it runs on plain HTTP, and secure cookies or OAuth redirect URIs come out wrong.
Self-Hosted PaaS Options for BetterAuth Self-Hosted
BetterAuth Self-Hosted with Coolify
Deploys the auth server from its Docker image with PostgreSQL provisioned beside it and HTTPS from Coolify's bundled proxy, managed from a dashboard instead of a config file. Useful when the auth server shares a VPS with the apps that sign in through it, since Coolify can host those too.
BetterAuth Self-Hosted with Dokploy
The same dashboard-driven deploy as Coolify, with its own bundled proxy and one-click databases, from a newer and smaller project. Check its scheduled database backups before choosing: the PostgreSQL service it runs is the whole of your identity data.
BetterAuth Self-Hosted Add-ons
Each addition below extends this stack with a capability the base stack works fine without. None are required: include the ones your product actually needs when building this stack, and skip the rest.
Tunnel Add-ons
Add a tunnel when you're self-hosting without a static IP or can't open inbound ports — a home server, a VPS behind restrictive network policies, or anywhere a reverse proxy alone can't reach the internet.
BetterAuth Self-Hosted with Cloudflare Tunnel
Makes the auth server reachable over HTTPS through an outbound-only connection, with no inbound ports or static IP, for a server on a home network or behind NAT. The public hostname becomes the base URL your apps' OAuth redirects point to, so settle it before registering clients.
BetterAuth Self-Hosted with ngrok
The quicker-start tunnel for testing sign-in flows against an auth server on your own machine. Its free-tier limits suit development rather than a production identity server that every app depends on.
Frequently Asked Questions about BetterAuth Self-Hosted
Why self-host BetterAuth instead of using Clerk or Auth0?
Per-user pricing and data location. Clerk is free up to 50,000 monthly retained users per app and bills per user beyond that; Auth0 is free up to 25,000 monthly active users, with paid plans from $35/mo that scale with users. Every sign-in also passes through their servers. A self-hosted BetterAuth server has no per-user bill at any scale and keeps credentials in your own PostgreSQL. The vendor's own paid option, Better Auth Infrastructure, doesn't change that: it adds a managed dashboard, audit logs, and email sending while the auth server stays yours. The trade is that you become the identity provider, with patches, signing keys, and uptime on your side.
Do I need a separate auth server, or can BetterAuth live inside my app?
For one app with one backend, embed it: BetterAuth mounts as a route handler in that backend and needs nothing else to run. A dedicated server earns its place when several apps or subdomains should share one login, when services in other languages need to verify the same users, or when MCP servers and agent tools need OAuth authorization. It costs an extra deploy and a redirect to the auth server at sign-in, so start embedded and split it out when a second app needs the same accounts.
What does the server need to run?
BetterAuth publishes no hardware floor, since it's a library; the estimate prices what this stack deploys, one Node service plus PostgreSQL. 1 vCPU and 1 GB of RAM run it to start, and 2 GB is comfortable once the database grows and sign-in traffic has peaks. Password hashing is the one CPU-heavy step, so a burst of logins spikes the processor briefly. 20 GB of SSD covers the database for a long time.
What needs backing up, and how do upgrades work?
PostgreSQL holds everything that matters: users, accounts, sessions, registered OAuth clients, and the signing keys behind every issued token. Lose it and every app's users are gone and every token stops verifying, so schedule backups and test a restore. The container itself is rebuildable. Upgrades are a package version bump, and releases that change the schema ship with the BetterAuth CLI's migrate command; back up first, run the migration, then deploy the new version.
BetterAuth or Keycloak for a self-hosted identity server?
Both run your own identity provider for several apps. Keycloak is the mature Java server with an admin console, SAML federation, and LDAP or Active Directory integration built in, at the cost of a heavier footprint (its official sizing starts at about 1.25 GB of memory per instance) and configuration through its UI. BetterAuth covers OAuth 2.1 and OpenID Connect with a lighter footprint and configuration in TypeScript, but no admin UI of its own. Choose Keycloak for enterprise federation; choose BetterAuth when the team is TypeScript-first and the apps need standard OAuth sign-in.
Stacks Related to BetterAuth Self-Hosted
Strapi Self-Hosted
Infrastructure
Self-hosted Strapi: an open-source headless CMS with PostgreSQL, on a server you control.
Airflow Self-Hosted
Infrastructure
Self-hosted Apache Airflow: the standard data-pipeline scheduler on your infrastructure.
n8n Self-Hosted
Infrastructure
Self-hosted n8n on your own server, with full control over the database, the host, and how it's exposed to the internet.
GitLab Self-Hosted
Infrastructure
Self-hosted GitLab with Docker: your code, your CI, your infrastructure.
Scores
Popularity3/5
BetterAuth has become a default recommendation in TypeScript auth conversations, though recognition is still concentrated in the fullstack TypeScript ecosystem.
Learning Curve3/5
The library API is clean and TypeScript-first, but you are the identity provider — sessions, email verification, and MFA edge cases all land on your team.
Flexibility5/5
Sessions, OAuth providers, MFA, organizations, and the OAuth 2.1 provider arrive as composable plugins configured in TypeScript.
Performance4/5
Auth runs on your own server next to your own PostgreSQL, with no cross-region hop to a vendor; a dedicated server adds one redirect at sign-in, and headroom scales with hardware you control.
Portability5/5
User accounts are ordinary rows in your own PostgreSQL, so the data leaves with you; adopting a managed provider later is a migration rather than a wall.
Tools in the BetterAuth Self-Hosted Stack
Databases
Authentication
DevOps & CI/CD
Add-ons (optional — add any, or none)
Tunnel
BetterAuth Self-Hosted Pricing
BetterAuth and PostgreSQL are open source, so the recurring cost is one small server at $4-20/mo on any of the hosting options. There's no per-user charge at any scale, which is the comparison that matters: Clerk is free up to 50,000 monthly retained users per app and Auth0 up to 25,000 monthly active users, and both bill per user beyond that. A managed admin dashboard is the one optional extra, through Better Auth Infrastructure's Pro plan at $20/mo.
1 GB of RAM runs the Node auth server and PostgreSQL to start; 2 GB is comfortable. Login traffic is light, so an entry instance on any provider works.
No per-user or per-sign-in pricing, the main reason to run it instead of a hosted identity provider.
Traefik, Caddy, NGINX, Coolify, and Dokploy all self-host free, with free Let's Encrypt certificates.
BetterAuth Self-Hosted System Requirements
- CPU
- 1 vCPU
- RAM
- 1 GB to start, 2 GB comfortable
- Disk
- 20 GB SSD
- OS
- Any Linux with Docker
No official requirements published — tekyous guidance based on the bundle's services.
BetterAuth is a library with no published floor; the estimate prices what this stack deploys, a dedicated Node auth server plus PostgreSQL. Password hashing is the one CPU-heavy step, so login bursts spike the processor briefly.