Struct AuthConfig 

pub struct AuthConfig {

    pub secret: String,
    pub managed_secrets: Option<ManagedSecrets>,
    pub app_name: String,
    pub base_url: String,
    pub dynamic_base_url: Option<DynamicBaseUrl>,
    pub trusted_origins_resolver: Option<Arc<dyn TrustedOriginsResolver>>,
    pub base_path: String,
    pub trusted_origins: Vec<String>,
    pub disabled_paths: Vec<String>,
    pub render_error_page: bool,
    pub api_error_url: Option<String>,
    pub throw_api_errors: bool,
    pub session: SessionConfig,
    pub user: UserConfig,
    pub verification: VerificationConfig,
    pub jwt: JwtConfig,
    pub password: PasswordConfig,
    pub account: AccountConfig,
    pub email_provider: Option<Arc<dyn EmailProvider>>,
    pub background_tasks: Option<Arc<dyn BackgroundTaskHandler>>,
    pub awaited_notification_errors: AwaitedNotificationErrorPolicy,
    pub user_validation: Option<Arc<dyn UserInfoValidator>>,
    pub advanced: AdvancedConfig,
}

Main configuration for Alibi

Fields

secret: String

Single-secret input. Managed mode uses current_secret() instead.

managed_secrets: Option<ManagedSecrets>

Versioned encryption keys. When present, its current key signs new tokens. Managed ciphertext requires a versioned envelope.

app_name: String

Application name, used for cookie prefixes, email templates, etc.

Defaults to "Better Auth".

base_url: String

Base URL for the authentication service (e.g. "http://localhost:3000").

dynamic_base_url: Option<DynamicBaseUrl>

Request-dependent host allowlist. Static base_url remains the default.

trusted_origins_resolver: Option<Arc<dyn TrustedOriginsResolver>>

Application callback resolving additional trusted origins from the real request.

base_path: String

Base path where the auth routes are mounted.

All routes handled by Alibi will be prefixed with this path. For example, with the default "/api/auth", the sign-in route becomes "/api/auth/sign-in/email".

Defaults to "/api/auth".

trusted_origins: Vec<String>

Origins that are trusted for CSRF and other cross-origin checks.

Supports glob patterns (e.g. "https://*.example.com"). These are shared across all middleware that needs origin validation (CSRF, CORS, etc.).

disabled_paths: Vec<String>

Paths that should be disabled (skipped) by the router.

Any request whose path matches an entry in this list will receive a 404 response, even if a handler is registered for it.

render_error_page: bool

Render the built-in HTML page for GET /error instead of redirecting to /.

Defaults to false when NODE_ENV is production, and true otherwise. Set this to true to enable the renderer in production, corresponding to upstream’s explicit onAPIError.customizeDefaultErrorPage option.

api_error_url: Option<String>

Default OAuth error destination, corresponding to onAPIError.errorURL.

throw_api_errors: bool

Propagate ordinary endpoint failures to the hosting application. Explicit public API errors continue to return HTTP responses.

session: SessionConfig

Session configuration

user: UserConfig

Application user-field input, adapter and public output policies.

verification: VerificationConfig

Verification storage lifecycle settings.

jwt: JwtConfig

JWT configuration

password: PasswordConfig

Password configuration

account: AccountConfig

Account configuration (linking, token encryption, etc.)

email_provider: Option<Arc<dyn EmailProvider>>

Email provider for sending emails (verification, password reset, etc.)

background_tasks: Option<Arc<dyn BackgroundTaskHandler>>

Observe already running deferred operations. Ignoring their completion does not cancel them; applications may retain completions for shutdown.

awaited_notification_errors: AwaitedNotificationErrorPolicy

Error handling when the request awaits a lifecycle notification.

user_validation: Option<Arc<dyn UserInfoValidator>>

Validate fresh identity data before its creation hooks or provider account/session writes. Returning non-provider sign-ins are unchanged.

advanced: AdvancedConfig

Advanced configuration options

Implementations

impl AuthConfig

pub fn dynamic_base_url(self, config: DynamicBaseUrl) -> Self

pub fn trusted_origins_resolver( self, resolver: impl TrustedOriginsResolver + 'static, ) -> Self

pub fn trusted_providers_resolver( self, resolver: impl TrustedProvidersResolver + 'static, ) -> Self

Replace static account-linking trust with an async application policy.

pub async fn resolve_request(&self, request: &AuthRequest) -> AuthResult<Self>

Resolve the URL and origin policy without mutating the shared instance.

Errors

Fails when no permitted host or fallback exists, the fallback is invalid, or an application trust resolver fails.

impl AuthConfig

pub const fn awaited_notification_errors( self, policy: AwaitedNotificationErrorPolicy, ) -> Self

Choose whether awaited lifecycle email delivery failures fail the request.

pub fn background_tasks(self, handler: Arc<dyn BackgroundTaskHandler>) -> Self

Integrate deferred task completions with the application executor.

pub fn new(secret: impl Into<String>) -> Self

pub fn app_name(self, name: impl Into<String>) -> Self

Set the application name.

pub fn base_url(self, url: impl Into<String>) -> Self

Set the base URL (e.g. "https://myapp.com").

Also updates session.cookie_secure to match the URL scheme: HTTPS URLs set Secure=true, HTTP URLs set Secure=false.

pub fn account(self, account: AccountConfig) -> Self

pub fn api_error_url(self, url: impl Into<String>) -> Self

Configure the default OAuth error destination (onAPIError.errorURL). An empty value uses the endpoint’s ordinary fallback.

pub fn base_path(self, path: impl Into<String>) -> Self

Set the base path where auth routes are mounted.

pub fn trusted_origin(self, origin: impl Into<String>) -> Self

Add a trusted origin. Supports glob patterns (e.g. "https://*.example.com").

pub fn trusted_origins(self, origins: Vec<String>) -> Self

Set all trusted origins at once.

pub fn disabled_path(self, path: impl Into<String>) -> Self

Add a path to the disabled paths list.

pub fn disabled_paths(self, paths: Vec<String>) -> Self

Set all disabled paths at once.

pub const fn throw_api_errors(self, enabled: bool) -> Self

Propagate ordinary endpoint exceptions through the public request result.

pub const fn session_expires_in(self, duration: Duration) -> Self

Set the session expiration duration.

pub const fn session_update_age(self, duration: Duration) -> Self

pub const fn disable_session_refresh(self, disabled: bool) -> Self

pub const fn session_fresh_age(self, duration: Duration) -> Self

pub fn session_cookie_cache(self, config: CookieCacheConfig) -> Self

Set the cookie cache configuration for sessions.

pub const fn jwt_expires_in(self, duration: Duration) -> Self

Set the JWT expiration duration.

pub fn advanced(self, advanced: AdvancedConfig) -> Self

pub fn cookie_prefix(self, prefix: impl Into<String>) -> Self

pub const fn disable_csrf_check(self, disabled: bool) -> Self

pub fn current_secret(&self) -> &str

Current key for signing tokens and cookies. Retained keys are encryption readers; signed cookies and signed JWTs deliberately use only this key.

pub fn verification_secrets(&self) -> impl Iterator<Item = &str>

Current-format encryption readers in configured order.

pub fn managed_secrets(self, secrets: ManagedSecrets) -> Self

Enable managed encryption with an explicit current version and readers.

pub fn origin_check_disabled_for(&self, path: &str) -> bool

Determine whether this request path opts out of origin validation.

pub fn current_origin_check_disabled(&self) -> bool

Apply the configured origin policy at an initialized request callback.

pub const fn disable_origin_check(self, disabled: bool) -> Self

pub fn cross_sub_domain_cookies(self, domain: impl Into<String>) -> Self

pub fn cross_sub_domain_cookies_from_base_url(self) -> Self

Share cookies using the configured or request-resolved base URL’s hostname. This follows the published hostname directly; it does not infer a parent or registrable domain. Use cross_sub_domain_cookies when a deployment needs an explicit parent domain.

pub fn is_origin_trusted(&self, origin: &str) -> bool

Check the resolved base origin or a configured trusted pattern.

Explicit patterns follow Better Auth 1.7.6: * and ? match URL origins (or hosts for patterns without a scheme), while custom schemes retain authority and normalized path-prefix constraints. Resolve dynamic policies with resolve_request before evaluating them.

pub fn is_redirect_target_trusted(&self, url: &str) -> bool

Check whether a URL is a safe redirect target.

A URL is safe if it is a relative path (starts with /, no traversal tricks) or its origin matches base_url or trusted_origins.

This is used by both the CSRF middleware (for POST body/query targets) and per-endpoint origin checks (e.g. verify-email GET).

pub fn is_path_disabled(&self, path: &str) -> bool

Check whether a given path is disabled.

pub fn validate(&self) -> Result<(), AuthError>

Errors

Returns a configuration error if the signing secret is empty or shorter than 32 bytes.

Trait Implementations

impl Clone for AuthConfig

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AuthConfig

fn default() -> Self

Returns the “default value” for a type.