authentication
Installation
SKILL.md
Authentication
Rule
Auth is powered by Better Auth with account-first design. Every new user creates an account on first visit. Use getSession(event) to authenticate custom routes; actions are auto-protected. Normal app HTML and React Router page-data responses are one impersonal, public-cacheable shell for every visitor. The client decides whether to render private UI or redirect to sign-in.
Auth Modes
| Mode | Behavior |
|---|---|
| Development (default) | Real Better Auth — same flow as production. There is no auth bypass. On first run the framework auto-creates a throwaway dev account and signs you in without printing its credentials (disable with AGENT_NATIVE_DISABLE_AUTO_DEV_ACCOUNT=1), so you are not stuck at a login wall. getSession() returns the signed-in user or null — it never falls back to a sentinel identity. |
| Production (default) | Better Auth with email/password + social providers (Google, GitHub). Organizations built in. |
AUTH_MODE=local |
Not a browser auth bypass, and never returns local@localhost. It only affects CLI/agent identity: it lets pnpm action / the local agent loop auto-bind to the single real signed-in dev user from the sessions table (see scripts/dev-session.ts). Browser login is unchanged. |
AUTH_SKIP_EMAIL_VERIFICATION=1 |
QA/preview escape hatch for real email/password accounts. Signup skips email verification and does not send the signup verification email. Local dev/test skips verification by default; set AUTH_SKIP_EMAIL_VERIFICATION=0 only when testing verification itself. Use +qa emails for test accounts. |
AUTH_DISABLED=true |
Skip login/signup entirely — every request runs as dev@local.test. For local dev, cloud previews, and internal demos only; not for production with real users. |
ACCESS_TOKEN / ACCESS_TOKENS |
Static bearer fallback for MCP/connect clients that cannot use OAuth. Not browser auth and never a token login page. |
| Custom | Pass your own getSession to autoMountAuth(app, { getSession }). |