ctxpipe: Skill for Claude Code

Secret Management

The auth secret is the foundation of Better Auth's security. It's used for signing session tokens, encrypting sensitive data, and generating secure cookies.

Configuring the Secret

import { betterAuth } from "better-auth";

export const auth = betterAuth({
  secret: process.env.BETTER_AUTH_SECRET, // or via `BETTER_AUTH_SECRET` env
});

Better Auth looks for secrets in this order:

1. options.secret in your config
2. BETTER_AUTH_SECRET environment variable
3. AUTH_SECRET environment variable

Secret Requirements

Better Auth validates your secret and will:

• Reject default/placeholder secrets in production
• Warn if the secret is shorter than 32 characters
• Warn if entropy is below 120 bits

Generate a secure secret:

openssl rand -base64 32

Important: Never commit secrets to version control. Use environment variables or a secrets manager.

Rate Limiting

Rate limiting protects your authentication endpoints from brute-force attacks and abuse. By default, rate limiting is enabled in production but disabled in development. To explicitly enable it, set rateLimit.enabled to true in your auth config. Better Auth applies rate limiting to all endpoints by default.

Each plugin can optionally have it's own configuration to adjust rate-limit rules for a given endpoint.

Default Configuration

import { betterAuth } from "better-auth";

export const auth = betterAuth({
  rateLimit: {
    enabled: true, // Default: true in production
    window: 10, // Time window in seconds (default: 10)
    max: 100, // Max requests per window (default: 100)
  },
});

Storage Options

Configure where rate limit counters are stored:

rateLimit: {
  storage: "database", // Options: "memory", "database", "secondary-storage"
}

• memory: Fast, but resets on server restart (default when no secondary storage)
• database: Persistent, but adds database load
• secondary-storage: Uses configured secondary storage like Redis (default when available)