better-auth

The better-auth skill provides integration patterns for Better Auth, a type-safe TypeScript authentication framework, across a NestJS backend and a Next.js App Router frontend using Drizzle ORM with PostgreSQL. It solves the problem of standing up production-grade authentication — email/password, social login, and advanced factors — without hand-rolling insecure plumbing, by supplying a structured four-phase setup plus ready-made asset files and reference guides.

The skill walks through database setup (Drizzle config, schema, migrations with a verification checkpoint), backend setup (a Better Auth instance wired into a NestJS module and a catch-all auth controller), frontend setup (auth client, route-protecting middleware, sign-in pages), and advanced features (2FA/TOTP, passkeys, magic links, organizations, and SSO). It ships asset files for NestJS services, controllers, guards, modules, and schema, and for Next.js middleware, session hooks, and pages, alongside reference documents for setup, schema, social providers, MFA, passkeys, plugins, examples, and best practices. The best-practices reference is notably security-conscious: it instructs storing secrets in environment variables and never committing them, generating strong secrets, requiring HTTPS in production, validating OAuth redirect URLs to prevent open redirects, relying on Better Auth's built-in password hashing and CSRF protection, adding rate limiting against brute force, using a scalable session store like Redis, and always implementing email verification.

The target users are full-stack TypeScript developers building NestJS and Next.js applications who need multi-provider authentication, multi-tenant organizations, or passwordless flows. Because it documents standard credential handling through environment variables and official tooling, and actively promotes defensive practices rather than any exfiltration or bypass, it is a safe, guidance-oriented skill.