better-auth 1.0.0-alpha.2

The most comprehensive authentication framework for Rust
Documentation

Better Auth RS

The most comprehensive authentication framework for Rust. Inspired by Better Auth.

[!WARNING] v1 is in alpha. The current release (1.0.0-alpha.2) is under active development. APIs, wire formats, and database schemas may change without notice between alpha releases, and production use is not recommended yet. Please report issues and feedback on GitHub.

The pinned compatibility target is better-auth@1.4.19. The v1 release scope covers phases 0-12 in ROADMAP.md, and the TypeScript runtime plus better-auth/client harness remain the source of truth for wire behavior.

Crates.io Documentation CI License better-auth compatibility

Features

  • Plugin Architecture — compose only the auth features you need
  • Type Safety — leverages Rust's type system for compile-time guarantees
  • Async First — built on Tokio with full async/await support
  • App-Owned SeaORM Schema — auth entities live in your SeaORM model graph
  • Framework Integration — first-class Axum support with session extractors
  • OpenAPI — auto-generated API specification
  • Middleware — CSRF, CORS, rate limiting, body size limits
  • Database Hooks — intercept create/update/delete operations

Quick Start

[dependencies]
better-auth = { version = "1.0.0-alpha.2", features = ["axum", "seaorm2"] }

Generate the schema scaffolding with the CLI:

cargo install better-auth-cli
better-auth-rs generate -o src/auth_schema.rs

Or write it by hand — the AuthEntity derive generates all trait impls:

use better_auth::{AuthConfig, AuthSchema, BetterAuth};
use better_auth::plugins::EmailPasswordPlugin;
use better_auth::seaorm::{AuthEntity, Database, SeaOrmStore};
use better_auth::seaorm::sea_orm::entity::prelude::*;

// Only include the fields you need — plugin fields are optional.
// The AuthEntity macro adapts: missing fields return sensible defaults.
#[derive(Clone, Debug, serde::Serialize, DeriveEntityModel, AuthEntity)]
#[auth(role = "user")]
#[sea_orm(table_name = "users")]
pub struct UserModel {
    #[sea_orm(primary_key, auto_increment = false)]
    pub id: String,
    pub name: Option<String>,
    pub email: Option<String>,
    pub email_verified: bool,
    pub image: Option<String>,
    pub created_at: DateTimeUtc,
    pub updated_at: DateTimeUtc,
    // Plugin fields — add only if you use the plugin:
    // pub username: Option<String>,          // username plugin
    // pub two_factor_enabled: bool,          // two-factor plugin
    // pub role: Option<String>,              // admin plugin
    // pub banned: bool,                      // admin plugin
    // Extra app-specific fields work too:
    // pub locale: Option<String>,
}

// ... session, account, verification entities ...

#[derive(AuthSchema)]
#[auth(user = "crate::UserModel")]
#[auth(session = "crate::SessionModel")]
#[auth(account = "crate::AccountModel")]
#[auth(verification = "crate::VerificationModel")]
pub struct AppAuthSchema;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let database = Database::connect("sqlite::memory:").await?;
    let config = AuthConfig::new("your-very-secure-secret-key-at-least-32-chars-long")
        .base_url("http://localhost:3000");
    let store = SeaOrmStore::<AppAuthSchema>::new(config.clone(), database);

    let auth = BetterAuth::<AppAuthSchema>::new(config)
        .store(store)
        .plugin(EmailPasswordPlugin::new().enable_signup(true))
        .build()
        .await?;

    Ok(())
}

Your app owns the auth entities and migrations — Better Auth adapts to whatever schema you define.

Plugins

Better Auth RS ships with a rich set of plugins. Enable only what you need:

Plugin Description
Email/Password Sign up/sign in with email & password, username support
Session Management Session listing, revocation, and token refresh
Password Management Password reset, change, and set flows
Email Verification Email verification workflows
Account Management Account linking and unlinking
Organization Multi-tenant organizations with RBAC
OAuth Social sign-in via OAuth 2.0 providers
Two-Factor TOTP-based 2FA with backup codes
Passkey WebAuthn passkey authentication
API Key API key generation, rotation, and revocation
Admin User management and administrative operations

See the Plugins documentation for usage details.

Feature Flags

Feature Description
axum Axum web framework integration
seaorm2 SeaORM database integration
redis-cache Redis session/cache backend

Crate Structure

Crate Description
better-auth Main crate — re-exports and framework integration
better-auth-core Core auth runtime, store, middleware, and error handling
better-auth-api Plugin implementations
better-auth-seaorm SeaORM store, entity traits, and AuthEntity derive macro
better-auth-cli CLI tools (better-auth-rs generate)

Documentation

Detailed guides and API reference are available in the docs/ directory:

Examples

# Axum web server
cargo run --example axum_server --features axum,seaorm2

# PostgreSQL (custom ID types, manual trait impls)
cargo run --example postgres_usage --features seaorm2

# Full-stack (better-auth frontend + better-auth-rs backend)
cargo run --manifest-path examples/fullstack/backend/Cargo.toml

See examples/README.md for detailed documentation on each example.

License

Licensed under either of:

at your option.