dev-auth

Modern Web Auth

Choosing your auth stack

Solution	When to choose	Avoid when
better-auth	Total control, TS-first, extensible (plugins), native 2FA/passkeys	Project < 1 week MVP
Lucia v3+	Minimalist approach, source-available code, you control everything	No time for plumbing
NextAuth/Auth.js	Next.js ecosystem, easy OAuth, lots of adapters	Need fine control over sessions
Clerk	Fast MVP, pre-built UI, paid SaaS	Limited budget, sovereign data control
Supabase Auth	Already on Supabase, RLS for authorization	Non-Postgres stack, complex custom auth
Auth0 / Okta	Enterprise, SAML/SCIM compliance	Indie apps, high cost

IMPORTANT: Never roll your own auth (homemade JWT, custom password hashing). Use a maintained lib.

better-auth (recommended 2026)

Framework-agnostic (Next, Remix, SvelteKit, Nuxt, vanilla). TypeScript-first.

Install

npm install better-auth

Minimal setup (Next.js)

// lib/auth.ts
import { betterAuth } from "better-auth";
import { Pool } from "pg";

export const auth = betterAuth({
  database: new Pool({ connectionString: process.env.DATABASE_URL }),
  emailAndPassword: { enabled: true },
  socialProviders: {
    github: {
      clientId: process.env.GITHUB_CLIENT_ID!,
      clientSecret: process.env.GITHUB_CLIENT_SECRET!,
    },
  },
});

// app/api/auth/[...all]/route.ts
import { auth } from "@/lib/auth";
import { toNextJsHandler } from "better-auth/next-js";

export const { GET, POST } = toNextJsHandler(auth);

Client

// lib/auth-client.ts
import { createAuthClient } from "better-auth/react";

export const authClient = createAuthClient();

// Usage
const { data: session } = authClient.useSession();
await authClient.signIn.email({ email, password });
await authClient.signUp.email({ email, password, name });
await authClient.signOut();

Useful plugins

import { twoFactor, magicLink, passkey } from "better-auth/plugins";

betterAuth({
  plugins: [
    twoFactor(),                              // TOTP
    magicLink({ sendMagicLink: ... }),        // Email magic link
    passkey(),                                // WebAuthn/passkeys
  ],
});