BetterAuth

BetterAuth is a comprehensive authentication and authorization framework for TypeScript. Rather than relying on a third-party cloud service, BetterAuth runs entirely within your application — you own the sessions, the user data, and the logic.

The library covers the full authentication surface: email and password with session management and account recovery, social OAuth providers (Google, GitHub, Apple, Discord, and many more), passkeys (WebAuthn), magic links, email OTP, phone number verification, two-factor authentication (TOTP), and API key management. An organization plugin provides multi-tenancy out of the box — teams, roles, invitations, and access control — making it practical for SaaS applications from the start.

For enterprise requirements, a separate SSO plugin adds SAML 2.0 and OpenID Connect support with per-organization provider configuration, enabling scenarios where each tenant authenticates through its own identity provider. Domain-based provider trust is also supported in recent releases.

BetterAuth is designed around a plugin system: start with the features you need and add capabilities incrementally without rewriting your auth layer. Database support is adapter-based — PostgreSQL, MySQL, SQLite, and MongoDB are all supported. Framework integration adapters exist for Next.js, Nuxt, SvelteKit, Astro, Hono, Express, Fastify, Remix, and others.

The Auth.js / NextAuth team merged into the BetterAuth project in September 2025, making BetterAuth the official successor to the most widely used Node.js auth library. It is backed by Y Combinator (W25 batch).

Because BetterAuth runs inside your application, session validation involves no external HTTP call and there is no per-MAU pricing. Teams host it on their own infrastructure alongside their existing database.