Better Auth Best Practices

Implementation and migration guide for Better Auth, the framework-agnostic TypeScript authentication and authorization library. This skill contains 42 rules organized by impact across 8 categories, derived from the official documentation and migration guides.

When to Apply

Reference these guidelines when:

• Setting up a fresh Better Auth instance (config, adapter, route handler, client)
• Wiring framework-specific integrations (Next.js App/Pages Router, SvelteKit, Hono, Express, Nuxt, Astro)
• Configuring sessions, cookies, and security (rate limit, trusted origins, password hashing)
• Adding plugins: 2FA, organization, admin, magicLink, JWT, passkey, multi-session
• Migrating from another auth library (NextAuth/Auth.js, Clerk, Auth0, Supabase Auth)
• Debugging "session is null" / "redirect_uri_mismatch" / 403 CSRF errors
• Reviewing PRs that touch lib/auth.ts, auth-client.ts, or /api/auth/ route handlers

Rule Categories by Priority