Auth

Email/password and OAuth authentication with sessions, powered by Better Auth.

What you get

Email + password sign-up and sign-in with secure, cookie-based sessions
Ready-made routes: /sign-in, /sign-up, /forgot-password, and /reset-password
Optional Google and GitHub OAuth, enabled by adding credentials, disabled when absent
Drizzle tables for users, sessions, and accounts, plus requireAuth middleware for protecting oRPC procedures

How it works

Better Auth is configured in apps/api/src/lib/auth.ts and mounted at /api/auth/*. The web app talks to it through a typed client. Protect any procedure by composing the auth middleware:

export const getProfile = protectedProcedure
  .handler(async ({ context }) => {
    // context.user is guaranteed to exist here
    return context.user;
  });

OAuth providers

Set GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET or the equivalent GITHUB_* variables in .dev.vars to turn a provider on. Leave them empty to keep it off, or remove the provider in src/lib/auth.ts.

Tip

With the email module installed, verification and password-reset emails are wired up automatically. Without it, those flows still work using the token; they just don't send mail.

Setup

bash

# generate a session secret
openssl rand -base64 32   # -> BETTER_AUTH_SECRET

# create the auth tables
cd apps/api && bun db:generate && bun db:migrate