919: Better Auth with Better Auth

Scott and Wes recap the current state of web authentication and explore how Better Auth simplifies the whole process. With built-in plugins, modern features, and no need to hand-roll your own solution, Better Auth makes secure login a breeze for developers. Show Notes 00:00 Welcome to Syntax! 00:59 Scott’s history with authentication. 02:05 Brought to you by Sentry.io. 03:15 My opinion has changed on auth. 04:40 Current authentication options. 06:32 Arctic. 06:56 OpenAUTH. 07:36 Auth.js. 08:02 Better Auth. 10:45 Better Auth CLI. 11:37 Email integration. 12:09 Hooks and Tokens. 13:43 CAPTCHA Integration. 14:36 Database Integration. 15:04 Integrations. 15:19 Plugin Ecosystem. 17:40 Admin features. 19:41 The Docs. Hit us up on Socials! Syntax: X Instagram Tiktok LinkedIn Threads Wes: X Instagram Tiktok LinkedIn Threads Scott: X Instagram Tiktok LinkedIn Threads Randy: X Instagram YouTube Threads

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Scott Tolinski?

  Welcome to Syntax Today. We're going to be talking about authentication and authorization and different platforms, but mostly my new favorite platform for doing auth on the web. And I will say CJ is going to be doing a deeper explainer video on this. So if you're the type of person who watches this and is like, "I gotta see more code and how to use this," just check back on the channel. CJ is going to be doing a video using better auth here. So I will say that I personally have a long history with auth, and we will get into that in just a little bit. My name is Scott Talinski. I'm a developer from Denver. With me as always is Wes. Boss. What's up Wes?

• 0:40Wes Bos?

  Oh, no. Excited to hear about this. I have not dipped into it yet, so I've got lots of questions for you.

• 0:46Scott Tolinski?

  Yeah. Yeah, man. I'm all hopped up on a steroid. I'm on a prednisone or something. So I'm, I've got a lot of energy today.

• 0:52Wes Bos?

  I can't go in the Olympics now.

• 0:54Scott Tolinski?

  No. Yes, right. No, not that kind of steroid. I don't think they, it's an inflammation steroid. So let me tell you, my history with auth is I frequently rolled my own auth. I wrote my own auth for LevelUp tutorials because in the initial time that the platform was built, it was built in Meteor. And when I moved it to React and just React and my own database, Mongo, I was like, "Oh, shoot. I was using Meteor's auth. So now I gotta build an auth that's similar to Meteor's, but my own." So I rolled my own. I built it from scratch. And it wasn't impossible. I learned a lot. Did it take more than a day? No, absolutely not. But did it take a lot of knowledge and requirements? Yeah.

• 1:35Scott Tolinski?

  A lot of times people are like, "Don't even consider rolling your own auth. It is a treacherous path of demons and..." It's not. You follow a few simple steps. You follow some best practices. Bingo, bango. You got an auth. But the dialogue for me has changed a little bit in terms of like what auth actually is as the years have gone by. And that has led me to actually want to use other platforms for my auth instead of rolling my own. We'll talk about that as we go. But if you chose to roll your own auth, you're gonna make sure you have some really good knowledge about how your site is working at all times. And to that, you need something like Sentry. S E N T R Y dot I O forward slash syntax is the best place to get total

• 2:19Scott Tolinski?

  visibility into your site. And Sentry has a new feature called Sear, which allows you to get to the root cause of issues on your site quickly and easily using AI. And I gotta say, man, Sentry has done such a good job of being like, let's figure out how AI works inside of our application, rather than like Sentry as a whole, as an application, rather than like, oh, we'll just put a chatbot in the app, right? Because that's like the solution that so many different companies come up with these days. Oh, you need AI? Let's throw a chatbot in the app or an autocomplete or something like that. So Sentry has done such a good job experimenting. And I gotta say, this is just one of a handful of incredible

• 3:04Scott Tolinski?

  tools that Sentry is constantly putting out. So check them out at Sentry.io. So why has my thoughts on auth changed over the years? Because what? 10 years ago? Eight years ago? What was auth, right? Auth, you might have had login with Google, you might have had login with GitHub if you're a developer, you had email and password. That was primarily the main. You had two FA on some sites. And that two FA could be text message, it could be your authenticator app or any of that stuff.

• 3:41Wes Bos?

  Yeah.

• 3:42Scott Tolinski?

  You didn't have pass keys. You didn't have enter your phone number and we'll send you a text message and now your account is tied to your phone number or whatever, like you do on TikTok or whatever. You didn't have that QR code sign in with your phone and now the TV app is then authenticated.

• 3:59Wes Bos?

  Yeah, I love that, by the way. And whenever I have to sign into something and it says, just pull your phone out and scan this code. Yes, please.

• 4:08Scott Tolinski?

  Yeah, I got you. No problem. Yeah, I know. That was, that's just such a quality of life.

• 4:15Wes Bos?

  There's so many things. And then like, when you get corporate, man, these like OAuth integrations are unbelievable. Be like it to sign in with your corporate account and auth is very, very complicated.

• 4:30Wes Bos?

  And deep well, and I don't envy anybody that has to work full time on auth. That seems hard.

• 4:36Scott Tolinski?

  Yeah, it has only gotten harder and more complicated. And so what are your choices? Your choices are to one, use like a paid service. Like a paid service, there's several like very popular paid services out there to do auth that have been around for a while. You have like auth zero has been around for a while. They sponsored syntax at some point. They're a very reliable application platform.

• 5:03Wes Bos?

  Clerk is pretty popular right now as well.

• 5:05Scott Tolinski?

  Clerk is popular. The thing that I have a hold up with these is it's like, I like hosting my stuff. I like hosting my stuff where I host all my other stuff. I like it to be part of my database. I don't want to have to pay for a service. I don't want to have to rely on another server for my authentication system. If my authentication system is a part of my like current site, I just don't want to have that. There's other ones. Lucia was a really popular one for a little bit of, of rolling your own auth. It's deprecated now. I always like, I always appreciated Lucia existing, but it still felt like you were doing a lot of work to get auth going.

• 5:47Scott Tolinski?

  It gave you some of the tools to get auth going, but it was still like, I might as well just been rolling my own. And that's the balance I've always found to be a bit tenuous with some of these things. They're either not full featured enough, or they're full featured and you gotta do everything yourself. And by that point, like, why am I even using this?

• 6:08Wes Bos?

  Yeah, it's like a little, little lower level. Like I use, I use Passport.

• 6:12Scott Tolinski?

  Yes.

• 6:13Wes Bos?

  On my website, but like, I, I have, I have to do all the JWT stuff myself and whatnot. I'm sure that's changed since whenever I have, I've actually implemented it. But yeah, it's, it was more of a lower level primitive where you have to do all of the, the heavy lifting yourself.

• 6:32Scott Tolinski?

  Yes. Now we have some choices. Arctic, I'd never used or heard of Arctic until when I went to research this episode. So if you're using Arctic, let me know how you feel about it. There's a lot of providers here. It's a, an auth client. I've never seen it. The docs aesthetically don't.

• 6:52Scott Tolinski?

  Don't give me the warm and fuzzies, but it exists and it was an option. Open auth from the folks who do SST. Open auth is great. This is basically a roll your own auth. Gives you a little auth server. You can sign in with all the different stuff. You can customize the UI a little bit. There's all these different auth providers. I like the idea of this. I never quite got it. I think there's, there's, I need to spend a little bit more time with it. If you're out there and you're using Open auth and really prefer it. Yes, that sounds great. Let me know. But again, it feels like it's its own auth client that just kind of stands alone. It's its own thing, right?

• 7:35Scott Tolinski?

  There is Next auth, which I don't know if you know this, but Next auth became auth.js. Or at least, yes, they have opened it up to be more than just Next JS. It works with all of the stuff. They have example apps with SvelteKit. This to me seems like a nice option. This is kind of interesting, looking for a hosted alternative use clerk. You know? I don't have anything bad to say about auth JS. But when I learned about Better auth, this was the first auth platform for me that made me say, I gotta use this thing. Because it does everything and it does absolutely everything. And it connects very well to the tools that you, you know and love.

• 8:19Scott Tolinski?

  So when you get through it, yeah, like works with all your frameworks. Multi-factor authentication, you know, has support for auth or email and password. Members and invitation, has a ton of plugins, works with all of the good stuff.

• 8:35Wes Bos?

  Built-in rate limiter. That's another thing I had to write myself as well.

• 8:40Scott Tolinski?

  Yes. So when we go through this, I'll show you a little bit about what's so cool about this. But I spent some time this past week implementing both JWT-based auth flows as well as your standard session-based cookie auth flow with this. Using SvelteKit and CloudFlare workers and using D1. And it was really, really super painless, really super painless. To the point where I was up and running in no time. I was trying to get a whole, LiveStore is another. Local first platform for like,

• 9:17Wes Bos?

  Yeah.

• 9:17Scott Tolinski?

  That's a whole other topic, which we'll talk about some other time. And I hit some snags getting LiveStore working in SvelteKit since there isn't an official implementation just yet. But I got this side of things up and running in no time. I was able to authenticate, log in, all that stuff.

• 9:34Wes Bos?

  So this is, to be clear, this is a package for when your server is in JavaScript. And they also provide client stuff when you want your UI to be in, I guess your UI is always in JavaScript.

• 9:46Scott Tolinski?

  Yeah, and I don't know specifically.

• 9:50Wes Bos?

  There's a view adapter, a Svelte adapter, Solid, Vanilla, and React.

• 9:55Scott Tolinski?

  Yeah. And so when I rolled mine, I did make the form myself and I'm just submitting to an endpoint. And in that endpoint, I'm using auth handle as like the endpoints. And that is handling all of the endpoints for me.

• 10:11Wes Bos?

  Do it yourself. Yeah. It looks like what they give you is just like sign in, sign up and session functions.

• 10:17Scott Tolinski?

  Correct. And that's really how I prefer these things to be personally, because I like, you know, I don't like it going off somewhere and opening another window or something like that. I want my darn auth in my darn app. And I want to have control over the form. I want it to look like the rest of my app and I want it to feel nice. In fact, it depends on what you need and want, right? So basically, yeah, you got all this dang stuff. There's a CLI to generate your migrations for you. And if you're using the Drizzle adapter, it generates the Drizzle schema, which then you can just use Drizzle's own migrations for you. If you're using Keesley, it works with all of the ORMs.

• 11:02Scott Tolinski?

  So the CLI is really great. You just run a generate command and it gives you the migration files. Man, there's just so many nice things here that in terms of like, when you need to have a specific style of auth, it can handle it for you. Because some of these platforms are like, we do session based auth and that's it. With this, it's like, if I want to do session based, Auth, I got it. If I want to do JWT, like I said, I got it. If I want to connect it to my own database, I got it. There's no problems there. Or if I want to have a database just for auth, you can do that too. It even connects directly to email and you can add email verification directly from Better Auth,

• 11:45Scott Tolinski?

  which is something, when I was working on an email client for my platform DropinWes, this was built into my auth client because back in meteor days, that was built in. And like all these, that like sending an email with authentication is something you always got to do. So like, it makes so much sense to have emails, verification and all that stuff being a part. And it's really mostly just like the hooks, right? Because you're writing and bringing in your own email platforms, but it's creating the emails for you. It's, well, it's, you're creating the emails, but it's giving you those hooks to send the verifications.

• 12:24Wes Bos?

  Oh, and it does all the like, the password, reset tokens and expiring and all that. Yeah, see, I wrote all that myself as well.

• 12:33Scott Tolinski?

  Yes.

• 12:33Wes Bos?

  Nice.

• 12:34Scott Tolinski?

  I've written two factor auth myself. So I've done all of this stuff, rolled my own. And I got to say that it's so nice that it like, here's your token, here's your URL, send, reset password, got to have it. And you know, it gives you hooks for everything. It lets you tap in here if you want to tap in. There's plugins to add in the whole plugin system, which we'll talk in about a little bit. Like we mentioned, there's OAuth provider. So if you just want to sign in with Google, you don't even have to darn, set anything up for that. You're just bringing in your ID. Next thing you know, like that's the easiest possible way to get up and running with this in no time. Rate limiting is just a couple of properties when you're configuring your auth. You want a rate limit? You can add a rate limit. Rate limit enabled. True. Done. Bingo bango. Like, man, it's like...

• 13:20Scott Tolinski?

  We know exactly what you want with auth and what you do with auth and we're just going to make it do everything for you. Again, session management can be enabled and if you have session management, you can choose how long those sessions are. And again, it generates the database schemas and everything for you. You're not having to ever write a database schema with this thing, which I've written a ton of those for auth, I'll tell you that.

• 13:43Wes Bos?

  Yeah. Oh, and there's captcha integration, which is, is key as well. Cause I was, I was like thinking about like, looking at the rate limiting. I was like, yeah, rate limiting is, is one part of it. You know, you don't want people hitting your signup endpoints too often, but then there's also you have to throw a captcha in there when people are trying to sign in.

• 14:01Scott Tolinski?

  There's even like update user functions and stuff like that, which, huh, yes, delete user, update user.

• 14:08Wes Bos?

  That seems very refreshing.

• 14:09Scott Tolinski?

  It's very refreshing. And I've just like, you know, so many times when you see things like this, there's a lot of big promises made and under-delivered. This thing is flown so far under the radar to me that by the time I'm seeing it, it is a full grown ass man of a package. It has got everything in here. Social sign-ons, you could sign in with Roblox if you want to sign in with Roblox. You can do that. Sign in with, with any of this stuff. Hugging face or any of these things. The, the database integration, it works with MySQL, SQLite, Postgres. It has adapters for Drizzle, Prisma, MongoDB, everything. I'm telling you, when I got this up and running with D1, it was as simple

• 14:50Scott Tolinski?

  as just using the SQLite adapters and bingo bango. And I did it with Drizzle actually, just because Drizzle makes a lot of sense for that. So Drizzle, SQLite, D1, you're good to go. Integrations, there's integrations for all of your stuff. Astro, Remix, Nux, Felt. Like, who wrote all this code? This, this is so much stuff and it's great.

• 15:15Wes Bos?

  Can't be known.

• 15:16Scott Tolinski?

  Yeah, it's awesome. It works with everything here and the plugin ecosystem is wonderful. So let's talk about the plugins and folks, this is not a paid product. This is, this is something you can just use. This is not an advertisement. This is me just gushing about something I like. You got two factor auth that can come with the two FA one time password codes, time based one passwords. You can get all of that. It's a plugin. Standard username and password. You can get anonymous logins. You can do the whole phone number and send a one time password over the phone. You want to log in like a pro like Tik Tok, they got you on that one. Super nice. It is in here. Magic link auth.

• 15:58Scott Tolinski?

  If you're the type of person who likes to go to an email, email, uh, one time password.

• 16:03Wes Bos?

  I can hate. I both love and hate magic links so much.

• 16:07Scott Tolinski?

  There's a time, there's a time when I like them and a time when I hate them and it depends on the.

• 16:11Wes Bos?

  I don't know why my password is send me a link. It's, it's fine, but half the time I'm sitting there waiting like, I don't know, 10 seconds for them to send the email and then another 10, 15 seconds for my email to refresh. And it's just like, come on, let me in. Paskey's has been the best experience I've had ever with authentication. Cause it's just pops up. You want to sign with Paskey, you hit the button. You, I don't know, you scan your face or your palm or whatever you need to do. And then boom, you're in, you don't have to do all this dancing. Send me an email and me copy this stupid code or let me, let me use the SMS token. I hate that as well. That seems like everybody's, everybody's doing SMS right now.

• 16:52Scott Tolinski?

  Yep. So Paskey in here, what is this? One tap allows a single tap using Google's one tap API.

• 16:58Wes Bos?

  One tap is, one tap is Google, like sign in with Google. When they released it, sites were like very aggressively popping it up. And it was really annoying because like you could just visit a random website and it'd be like signing with Google or sign up with Google and you just have to hit it. It does some weird. Like it iframes in the Google thing, so it will show like your, your face and your icon and your email address and everything, but the site can't access that until you explicitly allow it. But that is a nice, in some cases, it can be a nice experience if you open it up properly. I think Google fixed that though, because I haven't had that annoyance in a while.

• 17:39Scott Tolinski?

  Yeah, even more additional features, admin stuff, listen to this. Admin provides a set of administrative functions for user management, allow for creating users, managing roles, banning and unbanning and impersonating users. This is stuff that every single auth system needs to have in it. And oftentimes you're writing that yourself. I've written an impersonation system. I've written a banning and unbanning. I called it the ban hammer and it was a, it was pretty, it was pretty fun to use, but like I would have rather not have to write it myself, that's for sure.

• 18:11Wes Bos?

  Wait, so you said there's, there's a whole banning system?

• 18:14Scott Tolinski?

  Yes. Yes, banning and unbanning, impersonating, creating and managing from an admin side of things.

• 18:22Wes Bos?

  Wow. So is this, this doesn't get into like roles and access, does it?

• 18:30Scott Tolinski?

  Roles, it gets into setting roles.

• 18:33Wes Bos?

  Really?

• 18:33Scott Tolinski?

  Yes, setting roles, set roles, but it-

• 18:37Wes Bos?

  Whole access controls built in?

• 18:39Scott Tolinski?

  Brother, I'm telling you, this thing absolutely rules. And then MCP, MCP plugin lets you act as an auth provider for MCP clients if you need that.

• 18:52Scott Tolinski?

  Dude, there is just, it's too much stuff in here in terms of like, it just does it all dang all. Single support, single sign on.

• 19:03Scott Tolinski?

  Bearer tokens, like you said, captcha, there's a feature in here that can check for, have I been pwned database to know if your password has been involved in any sort of data leaks. Multi-session, active multiple sessions across different accounts from the same browser. Man, there is just so many things. There's even a Stripe plugin, listen what the Stripe plugin does. Process subscription lifecycle events, so you can probably change roles based on a subscription like-

• 19:34Wes Bos?

  Oh, that's a good call. You keep those in sync.

• 19:38Scott Tolinski?

  And like, yeah, man.

• 19:41Scott Tolinski?

  And there's guides, the docs are great. Here, you want to use it with, or want to migrate from Superbase or Next or Clerk? You can do that. Man, I gotta say, better off, folks.

• 19:56Wes Bos?

  How does this hook up to, to your users? Like this, does this also take care of like what a user is? Or, or in create? What if you have existing like users? You probably can hook that up, right?

• 20:12Scott Tolinski?

  I, you know, there's, there's references on here on out of migrate from other platforms. So I would look into that because I don't know how you would migrate. Like, given that like the hashing algorithms and stuff depends on what this uses and what that uses. I don't know. I don't know exactly.

• 20:32Wes Bos?

  If you store your passwords as plain text, you don't have that problem.

• 20:36Scott Tolinski?

  If you store your passwords as plain text, you don't have that problem. But what it does give you, it spits all this stuff out. Like I said, it spits out the schemas that you then use to do the migrations, or it spits out just straight up migration files for you. So again, like you tell it what you need and it's either giving you the session table, the user table, whatever, the admin tables, it's giving you all that stuff. And then if you add features, it's giving you the migrations for those. You can use it with whatever ORM or whatever solution you're doing to manage your migrations, or you can write those by hands with the SQL files that it pumps out of here for you. So it, the reason I like this so much is it lives a part of your database where your data is. If you wanted to, if you want to keep your users with all your other stuff, it just lives there.

• 21:17Wes Bos?

  Someone, I don't, I don't think this exists, but someone needs to build this. Is there like a, a UI? You know how like Drizzle Kit has, or Drizzle has Drizzle Kit, which is kind of just a UI for managing the database? What I want with this is a UI for all of the user management, you know? Like see active sessions, uh, look at all the roles, assign new roles, remove roles. Like they're, the whole UI around

• 21:44Scott Tolinski?

  The whole UI around that.

• 21:45Wes Bos?

  User management and like access control and sessions and banning and unbanning.

• 21:51Wes Bos?

  All of that is, that's a, that's a very complex UI. It would be really nice to have like some sort of thing you could drop in that allows you to query filter for all of this.

• 22:01Scott Tolinski?

  And it feels like that would be relatively easy, given that there is all of like with the admin, the plugin here. Like, you know, you can list users with a specific query, get all those users, you can ban and you can manage those things really easily from the auth client. So like to me, that like the UI part of it would be really nice to have as just like in addition to this, based on whatever you're using.

• 22:30Scott Tolinski?

  Yeah, people out there are probably wondering, what is the effing catch? What's the catch here?

• 22:36Wes Bos?

  Yeah, it says they've raised $5 million. Is there a rug pull coming?

• 22:41Scott Tolinski?

  There is not a rug pulling. One thing that I really appreciate about these folks is that there is a product behind this, but the product does not take away from the open source side of things. So like, what does, like, where is that product?

• 23:02Wes Bos?

  You can't even find it. That's good.

• 23:05Scott Tolinski?

  Yeah, which is funny because I, I've actually, I've signed up for the, wow, interesting. They just have this, I've signed up for it at some point to join the waitlist. So the product is a managed version essentially like Clerk or something like that. If you don't want to add it into your stack, but it also includes all of the things that you would need like for sending email and SMS. So it's, you're not having to bring your own email. You're not having to bring your own SMS service.

• 23:38Wes Bos?

  Hook it up to Twilio or whatever.

• 23:40Scott Tolinski?

  Right. You're not having to bring all that stuff. It includes all of that. So it's just like, hey, we, we've given you the components. You can hook it up to your own stuff. But now, in, in here, here's one that you'll notice, a unified dashboard to manage users and user analytics. So it's giving you that analytics dashboard and.

• 24:00Wes Bos?

  Oh, that's what I was just talking about, that UI component. That's probably would be one of their paid features. Yeah.

• 24:06Scott Tolinski?

  Yes, and it looks good and it doesn't look like something that I would be paying for because I honestly don't need this. But I am one of these 4,000 people that have joined the waitlist because I do think the product looks good. But it's not removing any of the stuff that I would actually need to want to use this. So.

• 24:24Wes Bos?

  Yeah.

• 24:25Scott Tolinski?

  Yeah.

• 24:26Wes Bos?

  Or like, like what a lot of people do as well with auth is there, you have an idea. You just, you need to build a product.

• 24:33Scott Tolinski?

  Yeah.

• 24:33Wes Bos?

  You just throw a hosted auth in there as quick as possible. Because you're like, I'm not, I'm excited about the product. I'm not excited about like hashing JWT tokens and whatnot. Like, I'm not gonna spend forever on that. So you just slap that in there. So it's nice to know that you'd be able to like duck out to this thing if you needed to.

• 24:56Scott Tolinski?

  And Betteroff folks, like the developers behind this. Gosh, you guys are just, guys and gals, whoever's doing this are on it. They even have an llms.txt of their entire docs done in Markdown for LLM consumption. So if you're the type of person who wants to just pass this into Cursor and have it available to reference, they, they, they got you on that too. So, um, llms.txt is one of my new favorite things that a lot of folks are doing to give you just quickly and easily consumable documentation in text form.

• 25:35Scott Tolinski?

  And they got that too. So Dan, if you need, if you need, if you need a new auth solution in your life that like doesn't provide a lot of pain, man, this is not an ad, obviously. They're, they're not making any money even yet. There's no product.

• 25:53Scott Tolinski?

  But I've, I've used it. I've been to the edge and back. I've tried it. It was great. I used it for two different types of offflows. It was easy to change between them. I changed between them in a couple of minutes, just random migration, changed some code around, saved my JWT or whatever. And now I'm in with a JWT-based auth if I want it. Docs are very nice and easily consumable.

• 26:14Scott Tolinski?

  And there's just, there's just a lot of good stuff here. So I don't, I don't have any additional thoughts other than Better Off truly is like the thing that's made me reconsider writing my own off and I will be using this going forward. And I'm going to dump, I'm going to dump the off package that I was writing because this is like 10,000 times better and has wider coverage than anything I could possibly do by my own. So shout out to Better Off team.

• 26:41Wes Bos?

  Awesome. All right. Thanks so much for tuning in. Thanks for the explanation, Scott, and we will catch you later.

• 26:47Scott Tolinski?

  Peace.