Better Auth Plugins

Better Auth Plugins

Goals

• Add server plugins to extend auth features.
• Add client plugins for matching client methods.
• Apply schema changes when plugins add tables.

Quick start

1. Import the plugin from better-auth/plugins and add it to plugins. 2. Run migrations (generate or migrate) when required. 3. Add the client plugin from better-auth/client/plugins.

Example: Two-factor authentication

import { betterAuth } from "better-auth";
import { twoFactor } from "better-auth/plugins";

export const auth = betterAuth({
  plugins: [twoFactor()],
});

import { createAuthClient } from "better-auth/client";
import { twoFactorClient } from "better-auth/client/plugins";

export const authClient = createAuthClient({
  plugins: [twoFactorClient({ twoFactorPage: "/two-factor" })],
});

Migration reminder

Run the CLI when a plugin adds tables:

npx @better-auth/cli generate

npx @better-auth/cli migrate

Guardrails

• Add server and client plugins together to keep APIs aligned.
• Keep nextCookies (if used) last in the server plugin list.
• Review plugin docs for required schema and env variables.

References

• toolchains/platforms/auth/better-auth/better-auth-plugins/references/plugins-index.md

Plugin index

Use the plugin docs to see configuration, schema, and client APIs.

Common auth plugins:

• 2FA: https://www.better-auth.com/docs/plugins/2fa
• Magic link: https://www.better-auth.com/docs/plugins/magic-link
• Passkey: https://www.better-auth.com/docs/plugins/passkey
• Username: https://www.better-auth.com/docs/plugins/username
• Email OTP: https://www.better-auth.com/docs/plugins/email-otp
• Phone number: https://www.better-auth.com/docs/plugins/phone-number

Security and token plugins:

• API keys: https://www.better-auth.com/docs/plugins/api-key
• Bearer tokens: https://www.better-auth.com/docs/plugins/bearer
• JWT: https://www.better-auth.com/docs/plugins/jwt
• Captcha: https://www.better-auth.com/docs/plugins/captcha
• Have I Been Pwned: https://www.better-auth.com/docs/plugins/have-i-been-pwned

Org and enterprise:

• Organization: https://www.better-auth.com/docs/plugins/organization
• SSO: https://www.better-auth.com/docs/plugins/sso
• SCIM: https://www.better-auth.com/docs/plugins/scim
• OIDC provider: https://www.better-auth.com/docs/plugins/oidc-provider
• OAuth provider: https://www.better-auth.com/docs/plugins/oauth-provider
• OAuth proxy: https://www.better-auth.com/docs/plugins/oauth-proxy

Other plugins:

• Admin: https://www.better-auth.com/docs/plugins/admin
• Multi-session: https://www.better-auth.com/docs/plugins/multi-session
• Anonymous: https://www.better-auth.com/docs/plugins/anonymous
• Device authorization: https://www.better-auth.com/docs/plugins/device-authorization
• One-time token: https://www.better-auth.com/docs/plugins/one-time-token
• One-tap: https://www.better-auth.com/docs/plugins/one-tap
• Generic OAuth: https://www.better-auth.com/docs/plugins/generic-oauth

Full plugin list:

• https://www.better-auth.com/docs/plugins