Module plugins 

Built-in plugins and their configuration.

Modules

access

Public access-control utilities matching Better Auth’s resource and action rules.

account_management

admin

anonymous

Anonymous accounts and their cleanup when a proven account replaces them.

api_key

bearer

Bearer authentication through the ordinary signed session-cookie lifecycle.

captcha

CAPTCHA admission before endpoint parsing and authentication side effects.

custom_session

Application-owned asynchronous session response projection.

device_authorization

email_otp

Passwordless email authentication and verification using single-use codes.

email_password

email_verification

haveibeenpwned

Compromised-password policy at initialized password hashing.

helpers

Shared helpers for plugin implementations.

jwt

Asymmetric session JWTs, public JWKS, and trusted server-side signing.

last_login_method

Remember successful session issuance without changing authentication authority.

magic_link

Single-use mailbox authentication links, with native delivery callbacks.

metadata

Built-in endpoint and model declarations owned by the feature crate.

multi_session

Browser-local selection and revocation of several authenticated accounts.

oauth

oauth_popup

Popup OAuth entry and callback delivery, paired with the official popup client.

oauth_proxy

OAuth code exchange on a production host, followed by stateful completion on the originating preview host with database or authenticated cookie state.

oauth_token_conversion

Explicit administrative conversion of pre-Source native OAuth token rows.

one_tap

Google One Tap authentication with verified Google ID tokens.

one_time_token

Short-lived, single-use credentials that hand an existing session to a client.

open_api

OpenAPI schema generation and Scalar reference page.

organization

passkey

password_management

phone_number

Phone ownership verification, password login and scoped password reset.

session_management

siwe

Sign in with Ethereum using a single-use challenge and application-owned signature verification, including contract-wallet RPC providers.

two_factor

user_management

Structs

AccountManagementPlugin

Account management plugin for listing and unlinking user accounts.

AdminBannedUserMessageHandler

Cloneable, type-checked application callback configuration.

AdminConfig

Configuration for the admin plugin.

AdminPlugin

Admin plugin for user management operations.

AnonymousConfig

AnonymousLink

Both authenticated accounts involved in an anonymous account upgrade.

AnonymousPlugin

ApiKeyCallbackContext

Immutable application context for trusted API-key lookup and validation.

ApiKeyConfig

Configuration for the API Key plugin, aligned with the TypeScript ApiKeyOptions.

ApiKeyGenerationOptions

Inputs passed to an application key generator; length excludes the prefix.

ApiKeyPlugin

API Key management plugin.

BearerConfig

Configuration of the bearer-to-cookie adapter.

BearerPlugin

CaptchaConfig

CaptchaPlugin

ChangeEmailConfig

Configuration for the change-email feature.

CustomSessionPlugin

Replace GET session responses while retaining core authentication and cookies. Register before an explicitly installed SessionManagementPlugin so this plugin owns the GET route. The replacement accepts GET only, including when deferred refresh is enabled.

DeleteExpiredApiKeysResponse

Result of trusted forced expiration cleanup. Store failures are logged.

DeleteUserConfig

Configuration for the delete-user feature.

DeviceAuthorizationPlugin

OAuth 2.0 device authorization grant plugin.

EmailOtpConfig

Configuration for email OTP verification, login, password reset and email change.

EmailOtpPlugin

EmailPasswordConfig

EmailPasswordPlugin

Email and password authentication plugin

EmailVerificationConfig

EmailVerificationPlugin

Email verification plugin for handling email verification flows

HaveIBeenPwnedConfig

Published enabled, exact-path and compromised-message settings.

HaveIBeenPwnedPlugin

Installs a password hash policy; it contributes no HTTP routes.

LastLoginMethodConfig

LastLoginMethodContext

Request context retained at the actual adapter or completed-response boundary.

LastLoginMethodPlugin

MagicLinkConfig

MagicLinkPlugin

MultiSessionConfig

Number of distinct accounts retained in this browser’s signed cookies.

MultiSessionPlugin

OAuthPlugin

OAuthPopupPlugin

Starts a popup in its first-party auth context and delivers callback results to the trusted opener. Register alongside super::oauth::OAuthPlugin and super::BearerPlugin for embedded clients.

OAuthProxyConfig

Immutable application configuration.

OAuthProxyPlugin

OneTapConfig

OneTapPlugin

OpenApiConfig

OpenApiPlugin

OrganizationConfig

Configuration for the Organization plugin

OrganizationCreatePatch

Supported fields merged over the validated draft without revalidation.

OrganizationCreatedContext

Persisted row snapshots used after adding the creator and after creation. The latter callback runs after default-team callbacks and before selection.

OrganizationDraftContext

The validated draft after creation policies and the initial slug check.

OrganizationMemberCreatePatch

Trusted member-field overrides. The source generates member IDs itself.

OrganizationMemberDraftContext

The actual creator-member draft and the organization already persisted.

OrganizationPlugin

Organization plugin for multi-tenancy support

PasskeyAuthenticationConfig

PasskeyAuthenticationContext

Immutable request and application settings. Captures may hold typed services.

PasskeyAuthenticatorSelection

PasskeyConfig

PasskeyOptionsContext

PasskeyPlugin

Passkey / WebAuthn authentication plugin.

PasskeyRegistrationConfig

PasskeyRegistrationContext

Immutable request and application settings; captures may hold typed services. A captured store is not automatically rebound to the registration transaction.

PasskeyRegistrationOverride

PasskeyRegistrationUser

PasswordManagementConfig

PasswordManagementPlugin

Password management plugin for password reset and change functionality

PhoneNumberConfig

PhoneNumberPlugin

PwnedPasswordClient

HTTP range service. Its endpoint is trusted application configuration; requests contain only five uppercase SHA-1 characters, never the password.

RolePermissions

Role-based permission grants for the admin plugin.

SessionManagementPlugin

Session management plugin for handling session operations

SiweConfig

SIWE application policies. A verifier is required because contract-wallet verification and chain-specific RPC access are owned by the application.

SiwePlugin

TwoFactorConfig

Public configuration for the two-factor plugin.

TwoFactorPlugin

Two-factor authentication plugin providing TOTP, OTP, and backup code flows.

UserManagementConfig

Combined configuration for the UserManagementPlugin.

UserManagementPlugin

User self-service management plugin (change email & delete account).

VerifiedPasskeyAuthentication

Actual verifier result, supplied only after the signed assertion succeeds.

VerifiedPasskeyRegistration

Facts supplied after the requested registration protocol and attestation policy verifies. None attestation admits a credential without proving key possession.

Enums

ApiKeyErrorMessage

Upstream verification messages can contain either text or an error-code object.

AuthenticationResult

Verification authority: Core verifies supported typed keys; the bounded raw verifier verifies original COSE facts without manufacturing a Core result.

CaptchaProvider

OneTapClientId

Google client IDs accepted as the ID-token audience.

PasskeyExtensions

TwoFactorBackupStorage

Backup persistence policy. Encrypted storage is the pinned default.

TwoFactorOtpStorage

Persistence format for delivered two-factor OTPs.

Traits

AdminBannedUserMessage

Resolves the message returned when a nonexpired banned user requests a session.

AnonymousIdentity

Application-owned generation of anonymous display names and email addresses.

ApiKeyDefaultPermissions

Trusted dynamic defaults, evaluated even when creation supplies an override.

ApiKeyGenerator

Trusted custom secret generation. The application owns the returned full key.

ApiKeyGetter

Application lookup replaces configured API-key headers entirely.

ApiKeyValidator

Trusted acceptance predicate, evaluated before key usage is consumed.

BeforeStoreLastLoginMethodCookie

Cookie consent does not decide whether the authenticated session may persist.

LinkAnonymousAccount

Transfer application-owned data before the anonymous account is deleted.

OAuthJwksSource

Application-owned key transport/cache. Request claims never choose its URL.

OrganizationCreationHooks

Creation hooks are awaited at their individual source phases.

PasskeyAuthenticationAfterVerification

Awaited before counter persistence and session creation. The client data is untrusted application input; it cannot replace the verified credential owner.

PasskeyExtensionsResolver

PasskeyRegistrationAfterVerification

PasskeyUserResolver

Resolve an authorized registration identity when no session is available.

PasswordHasher

Custom password hasher trait for pluggable password hashing strategies.

ResolveLastLoginMethod

A synchronous application resolver. None falls back to the built-in resolver; an empty string suppresses tracking. Errors propagate at the invoking boundary.

SendChangeEmailConfirmation

Custom callback for sending change-email confirmation emails.

SendEmailOtp

Delivers a code to its intended mailbox with the real native callback context. Delivery awaits and propagates errors by default; configured background work owns its context and logs failures while retaining the issued verification.

SendMagicLink

SendPhoneOtp

SendResetPassword

Trait for sending password reset emails.

SendTwoFactorOtp

Callback used by the two-factor plugin to deliver a one-time password.

SendVerificationEmail

Trait for custom email sending logic.

SessionTransform

Project an authenticated session response into application response data.

TwoFactorBackupCipher

Async persistence callbacks for the complete backup-code JSON string.

TwoFactorOtpCipher

Application-owned reversible OTP representation.

TwoFactorOtpHasher

Application-owned irreversible OTP representation.

Type Aliases

ApiKeyPermissions

Ordered resource/action permissions, following JavaScript object insertion order.

EmailVerificationHook

Shorthand for the async hook closure type used by EmailVerificationConfig::before_email_verification and EmailVerificationConfig::after_email_verification.