Better Auth
Better Auth setup for TypeScript apps: email/password, OAuth, 2FA, passkeys, DB adapters
Test report
- Verdict
- Works with setup
- Score
- Tested
- Jul 21, 2026
- Environment
- Claude Code 2.x (agent harness)
- Upstream re-checked
- Aug 10, 2026 · 15ef839
INSTALL: frontmatter parses (name + description + license + version 2.0.0); all 5 body-referenced files fetched HTTP 200 (references/email-password-auth.md 8567B, oauth-providers.md 9293B, database-integration.md 10517B, advanced-features.md 10604B, scripts/better_auth_init.py 16394B). Grepped the 521-line Python script: no curl|sh, no base64, no network calls, no injection text; only relative Path(__file__) resolution and `secrets` for key generation. TRIGGER 5/5 — SHOULD fire: "Add Better Auth email/password + GitHub OAuth to my Next.js 15 app" (yes), "I want passwordless passkey/WebAuthn sign-in for our SvelteKit TypeScript app" (yes), "Set up TOTP two-factor auth and role-based access control for our Node/TS SaaS" (yes); SHOULD NOT: "Our nginx reverse proxy needs HTTP basic auth on /admin" (no — infra, not app auth), "Configure OAuth2 client credentials to call the Stripe API from our Python backend" (no — outbound machine auth, wrong language). OUTPUT: task was "add Better Auth to Next.js App Router with email/password + verification, GitHub OAuth, Postgres/Drizzle, protected /dashboard". I wrote the baseline from memory without opening any reference doc (caveat: I had already read SKILL.md's body, so contamination is limited to the top-level quickstart, not the references, which carry the skill's real payload). Skill run beat baseline on four concrete points: correct sendVerificationEmail({user,url,token}) signature plus sendOnSignUp/autoSignInAfterVerification (baseline guessed), middleware via auth.api.getSession({headers}) with matcher instead of my hand-rolled cookie-name sniff, account.accountLinking.trustedProviders which baseline missed entirely, and the --adapter drizzle CLI flag. But I then verified the references against the real package (npm pack better-auth@1.6.23 and @better-auth/drizzle-adapter, grepped dist): `emailAndPassword.sendResetPasswordToken` does not exist (only `sendResetPassword`), `password.requireUppercase` does not exist (real option is top-level `minPasswordLength`), and the drizzle `schema: { user: "users" }` string map is the wrong shape — that field takes drizzle table objects, plural naming is `usePlural: true`. Those three would silently no-op, so password reset emails and password policy would quietly never fire. DOCS: SKILL.md is honest about structure and does not oversell; docked one point because the reference docs document options absent from the shipped library and the skill carries a "version 2.0.0" label with no indication of which better-auth version it tracks.
Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works
- Installs cleanly 5/5
- Triggers reliably 5/5
- Output vs. baseline 5/10
- Docs & honesty 4/5
What Better Auth does
Guides implementation of Better Auth, the framework-agnostic TypeScript auth library, covering email/password with verification and reset, social OAuth providers, 2FA/TOTP, passkeys, magic links, sessions, and database adapters for Drizzle, Prisma, Kysely, and MongoDB. Triggers when adding authentication or authorization to a TypeScript or JavaScript app, wiring OAuth login, setting up multi-factor auth, or configuring auth database schema and protected routes. Ships four reference documents plus a Python initialization script that scaffolds auth config and .env values.
How to install Better Auth
git clone --depth 1 https://github.com/mrgoonie/claudekit-skills /tmp/claudekit-skills
mkdir -p ~/.claude/skills
cp -R /tmp/claudekit-skills/.claude/skills/better-auth ~/.claude/skills/better-auth
# project-local instead: cp -R /tmp/claudekit-skills/.claude/skills/better-auth .claude/skills/
# optional interactive scaffolder (needs python3):
# python3 ~/.claude/skills/better-auth/scripts/better_auth_init.py
Skills live in ~/.claude/skills/ (global) or .claude/skills/
(per-project). Restart Claude Code after installing.
Commands — how to trigger Better Auth
-
/better-authBetter Auth setup for TypeScript apps: email/password, OAuth, 2FA, passkeys, DB adapters
It also activates on plain-language prompts like these:
-
Add Google OAuth login with Better Auth -
Set up two-factor authentication for this app -
Configure role-based access control with Better Auth
Frequently asked questions
- Is the Better Auth skill free?
- Yes. The skill itself is free from mrgoonie/claudekit-skills. SkillProof publishes the install command and an independent test verdict at no cost.
- Does Better Auth work with Claude Code?
- We tested it with Claude Code 2.x (agent harness) on Jul 21, 2026. Verdict: Works with setup. INSTALL: frontmatter parses (name + description + license + version 2.0.0); all 5 body-referenced files fetched HTTP 200 (references/email-password-auth.md 8567B, oauth-providers.md 9293B, database-integration.md 10517B, advanced-features.md 10604B, scripts/better_auth_init.py 16394B). Grepped the 521-line Python script: no curl|sh, no base64, no network calls, no injection text; only relative Path(__file__) resolution and `secrets` for key generation. TRIGGER 5/5 — SHOULD fire: "Add Better Auth email/password + GitHub OAuth to my Next.js 15 app" (yes), "I want passwordless passkey/WebAuthn sign-in for our SvelteKit TypeScript app" (yes), "Set up TOTP two-factor auth and role-based access control for our Node/TS SaaS" (yes); SHOULD NOT: "Our nginx reverse proxy needs HTTP basic auth on /admin" (no — infra, not app auth), "Configure OAuth2 client credentials to call the Stripe API from our Python backend" (no — outbound machine auth, wrong language). OUTPUT: task was "add Better Auth to Next.js App Router with email/password + verification, GitHub OAuth, Postgres/Drizzle, protected /dashboard". I wrote the baseline from memory without opening any reference doc (caveat: I had already read SKILL.md's body, so contamination is limited to the top-level quickstart, not the references, which carry the skill's real payload). Skill run beat baseline on four concrete points: correct sendVerificationEmail({user,url,token}) signature plus sendOnSignUp/autoSignInAfterVerification (baseline guessed), middleware via auth.api.getSession({headers}) with matcher instead of my hand-rolled cookie-name sniff, account.accountLinking.trustedProviders which baseline missed entirely, and the --adapter drizzle CLI flag. But I then verified the references against the real package (npm pack better-auth@1.6.23 and @better-auth/drizzle-adapter, grepped dist): `emailAndPassword.sendResetPasswordToken` does not exist (only `sendResetPassword`), `password.requireUppercase` does not exist (real option is top-level `minPasswordLength`), and the drizzle `schema: { user: "users" }` string map is the wrong shape — that field takes drizzle table objects, plural naming is `usePlural: true`. Those three would silently no-op, so password reset emails and password policy would quietly never fire. DOCS: SKILL.md is honest about structure and does not oversell; docked one point because the reference docs document options absent from the shipped library and the skill carries a "version 2.0.0" label with no indication of which better-auth version it tracks.
- What is the Better Auth SkillProof Score?
- 7.6/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 5/10, docs & honesty 4/5.
- How do I install Better Auth?
- Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
- Can I use Better Auth with Cursor, Copilot, Gemini CLI, Codex or other AI tools?
- The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.