Better Auth RS

Authentication for Rust with Axum integration and application-owned SeaORM entities. The compatibility target is better-auth@1.7.6: routes, payloads, cookies, and errors follow the upstream TypeScript runtime.

[!WARNING] Version 1.0.0-alpha.5 is in development. Public Rust APIs and database schemas can change between alpha releases.

Configure model IDs and application-owned defaults through database ID generation. User creation evaluates the ID generator at the ID field's schema position among input callbacks.

DatabaseError variants carry DatabaseErrorCause. Use .into() when constructing a cause from a string and .as_str() when reading its diagnostic. Driver errors retain their source and native callback identity; see database errors for metadata and compatibility limits.

Derived entities can bind multiple native fields to one member with repeated #[auth(alias = "native_field")] attributes. The CLI emits these bindings when declarations share a column, including User and Session getters and typed writes. Configure each logical field's runtime mapping separately; see adapter configuration.

Custom Organization adapters implement TeamStore::delete_team_for_organization_value to retain invitation cleanup scope across lifecycle hooks. Custom adapters must provide a credential-account point query independent of list pagination; see adapter configuration. Enable advanced.database.joins = Some(true) for typed core and Organization associations with Memory child references or SeaORM query snapshots. Plugins can declare native and custom models through runtime model registration. Native declarations share relationship resolution and SeaORM schema validation; custom persistence remains the application adapter's responsibility.

Sessions use signed cookies. Cookie attributes follow upstream serialization and mutation order; see the cookie guide for partitioned chunks and LastLogin prefix behavior. Response headers preserve repeated cookie writes in order; explicit expiration removes earlier values and chunks. Enable SessionConfig.bearer explicitly for Authorization header authentication; see the session guide for cache and application field configuration. Custom session cookie signers receive native FieldMap claims and retain values until their clone or serialization boundary. Use Custom Session to transform public session responses with typed application context. Use Multi Session to remember and switch between accounts, with adapter-specific session selection and joined field projection.

Endpoint responses and hook contexts retain native values until an explicit conversion. Read native fields with AuthResponse.body.field_value() or json(); bytes() produces HTTP body bytes, including unquoted native strings. AuthResponse::json_value preserves native ctx.json data; HTTP before hooks use strict JSON, while endpoint and after-hook results use the upstream HTTP cycle markers. FieldValue::stringify remains strict. AuthResponse::binary and blob retain binary identity. into_http_response() returns AuthResult<AuthResponse> and selects the MIME type from the final value. Explicit responses expose their own headers through explicit_response_headers(); headers retains the endpoint accumulator until HTTP materialization. native_status() retains absent, undefined, null, and dynamic status values through SchemaValue<u16>; status and status_text describe materialized HTTP output. Pass None to native constructors when the endpoint has no explicit status. AuthError::FieldInput retains typed field-policy issues with Better Auth identity and a named BAD_REQUEST status. AuthError::RequestValidation retains request-schema issues with Better Call identity and numeric status 400. Both convert to message-first native error bodies. Native errors retain the complete original object; read their public payload with body_value()? or api_error_body()?. Use error.into_thrown_value()? to embed a caught error in native callback data without HTTP sanitization. Use AuthError::from_code for coded upstream errors, from_status for an explicit body with a named or numeric status, and try_api_error for complete native constructor inputs; see errors. See response hooks for replacement and header merging.

Native Headers values retain object identity and keep header entries outside enumerable properties. Read their header collection with Headers::from_field_value; request header writes remain visible through retained response_headers_value() handles.

Use SessionManager::resolve_native, AuthContext::require_native_session, and AuthRequest::native_session_snapshot() to retain native User relationship results. Endpoint and Custom Session callbacks receive NativeSessionData; clones share its native root. Use session_property and user_property for live reads, or explicit session_view and user_view projections for Rust slots. Typed convenience methods require one User. Account and Session stores expose native selectors for complete field mapping and conversion; string methods remain available. Owned adapter projections return the first callback error while already-started peers continue; see projection lifetime. Email OTP and Magic Link share sequential access cleanup with the upstream lock and partial-persistence behavior; see database integration and Magic Link.

Use BetterAuth::stateless(config) without an application schema or database. Encrypted session and OAuth cookies survive adapter restart; process-local users and plugin records do not. See stateless sessions for storage defaults, hooks, and revocation behavior.

Configure application user fields with AuthConfig.user.fields_mut() and matching application-owned entity columns. Configured fields use their logical name when field_name is omitted or empty, including username projections. User lists filter and sort declared scalar display fields by logical or mapped name before output transforms, including nullable String, Boolean, and Number filters. SeaORM reads non-reference String query values from model columns; SQLite also reads declared Boolean and Number additional columns. SQLite additional-field output also reads supported non-reference column values before callbacks and decoding, preserving null and empty values despite Serde omission. Undeclared filters return an error. Undeclared nonempty sort fields fail before SQL reads; Memory reports the error when at least two filtered rows require comparison. Runtime callbacks and record fields use FieldValue, FieldObject, FieldArray, FieldDate, and FieldMap; FieldObject::own_keys enumerates without reading values, fallible object and array reads retain shared handles, and JSON conversion occurs at explicit input, cache, and output boundaries. FieldFunction::contextual supplies receiver-aware coercion and toJSON callbacks; native JSON preserves each property key and calls the method only at serialization; Memory serializes synchronous reentry through one database operation gate. See JSON field bindings for Memory versus SQL mutation semantics and explicit typed conversion. Use FieldValidators.input for public input validation. Create default and update factories with UserFieldFactory::new(|| ...); Clone, call(), and conversion to FieldFunction retain one function identity and its named properties. Factory errors propagate before storage writes. Use FieldValue::model_property and set_model_property for shared native property access, and FieldArray::with_length for sparse arrays. Use FieldValue::slice_method_with when argument conversion can run callbacks; the method is resolved before the argument closure. User creation/update hooks and Session creation hooks receive complete native fields through FieldMap and return DatabaseHookUpdate<FieldMap>; see database hooks for patch and secondary-storage ordering. See user fields for input validation, defaults, transforms, public visibility, output coverage, Memory JSON representation, and SQL query column mappings.

Typed API Key, Passkey, DeviceCode, TwoFactor, JWK, and Wallet records retain declared field presence and property order. API Key, Passkey, DeviceCode, TwoFactor, JWK, and WalletAddress use shared declarations, including index and reference metadata, and adapter policies for all native and additional fields; see API Key fields and Passkey fields. Database API Key updates preserve updatedAt unless the patch or field policy changes it. Direct API Key refill writes must clone the observed last_refill_at field to preserve Memory Date identity.

Use AuthRecordFields::structured_clone for an independent native record graph that preserves schema variants and hidden ownership state. Clone errors leave new identities uncommitted; see JSON field bindings.

Adapter-created JSON text uses JavaScript property ordering and number formatting. FieldValue::stringify retains original field-read errors and reports cyclic values as AuthError::TypeError. Raw UserConfig::project_record and batch helpers share adapter field order, mapping, and ID conversion. Custom adapters can use FieldValue to retain runtime values until an explicit JSON boundary. Manual SeaORM models can use seaorm::field_value::{from_column, decode_column} for typed column conversion. See JSON field bindings for value conversion and native SQL JSON storage.

Account and Verification Memory fields store JSON as text and retain native arrays. See field representation for callback values and reference conversion. Account/User and Session/User joins execute the selected schema relationship and preserve single, missing, or array results through better_auth::store::JoinValue. Memory User associations also preserve omitted fields instead of converting them to null. Session snapshots retain loaded relationships as SessionData<JoinValue<UserView>>; see database integration for custom adapter migration. NativeSessionData preserves native snapshots; SessionData defaults to a typed User.

Verification-email hooks and delivery callbacks, user-management callbacks, and Two Factor OTP senders receive native FieldValue users. VerificationEmail::user_view() provides object field access when an application requires it. See email verification for null update results and callback ordering. Verification stores and transactions expose find_verification_value and update_verification_value for native cache results; existing VerificationView methods remain explicit projections. See secondary storage for parsing, callback identity, atomic consumption, and custom-store bridges. Email OTP exposes get_value() and EmailOtpMessage.otp: SchemaValue<String> to retain native adapter results; see Email OTP.

Account after-update hooks use DatabaseUpdateResult to distinguish a projected single-row result from a batch count. Password-reset flows select all credential Accounts by the original user, provider, and account fields. One Time Token generators can borrow the active endpoint and transaction through OneTimeTokenCallbacks; see database hooks and One Time Token.

Account, Verification, and Session before-update hooks receive a mutable FieldMap and return DatabaseHookUpdate<FieldMap>. Their typed caller DTOs convert once before the shared patch policy. Session cache writers receive the final fields through the same boundary. Trusted plugins can use BeforeRequestAction::InjectNativeSession to preserve native Session values through endpoint dispatch, including /update-user selectors and nullable update fallbacks. AdminApi::create_user uses the same validator, handler, and before/after hooks as its routed endpoint; see plugin hooks.

Session runtime tokens, dates, and optional native strings also use SchemaValue; see Session fields for getters, setters, and custom model migration. User and Session views retain field order through projection and serialization. Creation-after hooks receive nullable results; see database hooks for committed null readbacks and cancellation.

Public User projection preserves already transformed fields, including missing and own-undefined properties, without repeating adapter callbacks. Declared returned: false fields are removed after the output clone. Session expiry, revocation, and refresh consume the projected Session fields, so hiding a native field also changes the value visible to those operations.

All native UserView fields and AuthUser getters retain replacement values through SchemaValue. Use FieldFunction::contextual and call_with for borrowed receiver and argument handles; see user fields. FieldValue::Function retains callback identity; public output and transaction snapshots propagate AuthError::DataClone for function values. Use .typed()? for an operation that requires the default Rust type or .field_value() to retain the complete value. User input DTOs retain typed convenience fields and accept native replacements through additional_fields. The adapter converts each DTO once to an ordered FieldMap before hooks and field policies. Memory User records and SQL User/Account rows remain raw until shared output policies finish. Use get_user_by_field_value and update_user_by_field_value for native selectors; update_user_by_id_value delegates to the same policy and updates retain nullable results. See database integration for custom model migration, physical column contracts, and the SQLite parameter-binding safety boundary.

Full Organization reads retain ordered adapter fields and relationship cardinality in OrganizationDetails. Call into_public_value(&organization_fields) to apply member lookup and public field policies in upstream order. The result retains native values until HTTP serialization. See database integration for custom adapter requirements.

Native SQLite User timestamp writes use UTC text with millisecond precision. See the database guide for precision and custom-model limits; the paired contract verifies equal raw text and four public reads for its fixed inputs.

The schema generator keeps its default table name when modelName is omitted or empty. Fresh SQLite generation uses upstream native table and column defaults for User, Account, Verification, JWK, RateLimit, Organization, Member, OrganizationRole, Team, Invitation with teams enabled, DeviceCode, and WalletAddress. Fresh PostgreSQL and MySQL generation uses native column defaults for User, Account, Verification, JWK, RateLimit, Organization, Member, OrganizationRole, Team, Invitation, DeviceCode, and WalletAddress; bundled entities retain their existing mappings. Generated User email is required and uses a native unique constraint; its Rust input remains optional. Generated Invitation storage uses an optional role; public invitation inputs and role logic remain unchanged. Fresh Session generation uses an explicit row-presence model; --session-active-column retains the Rust active-column extension for regeneration. Use --device-code-legacy-schema to retain the previous DeviceCode representation. Fresh Organization generation omits the private update timestamp; use --organization-legacy-schema to retain the previous columns. Derived Organization models may omit adapter-private columns; handwritten models can return None from SeaOrmOrganizationModel::private_column for absent private storage. See schema mapping for configuration, preserved declarations, and migration boundaries.

API Key, Passkey, DeviceCode, TwoFactor, JWK, and WalletAddress runtime fields preserve omitted, null, and cross-type values through SchemaValue<T>, including response decoding and API Key cache reads. Device consumption retains private storage bindings across output transforms; use a record returned by the adapter for consumption. Custom secondary-storage backends implement set_native to receive FieldValue keys and values and floating-point TTLs. get_native, delete_native, and atomic get_and_delete_native preserve native values; their default bridges accept string keys. Memory retains Undefined separately from a missing entry. Redis converts keys at its encoding boundary and rejects non-string values. Ordinary callers can keep using get, set, and delete. Cache consumers share the owned invoke_get_native, invoke_set_native, and invoke_delete_native entry points; override these methods to preserve synchronous invocation errors before an asynchronous completion. See Secondary storage for invocation and atomic-operation contracts. Handwritten SeaORM Session models implement new_active(id, &FieldMap) and declare application insert columns with extra_insert_columns. Use CreateSession.inherited_fields for values that precede native creation fields and defaults; additional_fields retains explicit override precedence. Register replacements after the native plugin to override complete declarations; later native plugins restore their declarations at the original field positions. Generate matching application-owned columns for changed storage types. SeaORM schema checks use the resolved field mappings; a remapped native field leaves its old column subject to the same nullable-or-default requirement as any unwritten column. Custom SchemaTable descriptors specify the independent primary key in id_column and mapped declarations in columns. Cached name sorting propagates ordinary JSON object conversion errors; see API Key storage.

Generate Passkey storage with --plugins passkey for the 11 standard columns, or add --passkey-legacy-schema to retain opaque credential storage. EphemeralStore defaults to Native; select .with_passkey_storage(PasskeyStorage::Legacy) for existing opaque Memory credentials. Bind the generated AppPluginSchema; see Passkey storage modes for typed inputs and application-owned migrations.

Passkey authentication callbacks receive the output-projected credential_id as SchemaValue<String>. Registration user IDs and CreatePasskey.user_id also retain native values through SchemaValue<String>. Custom stores implement list_passkeys_by_user_value; the existing string method delegates to this boundary. Use .typed()? for operations that require ordinary strings or .field_value() to retain replacement values; see Passkey callbacks.

Generate TwoFactor storage with --plugins two-factor for the seven upstream columns and nullable verification fields. Use --two-factor-legacy-schema when regenerating the previous schema. Declare application columns with twoFactor.additionalFields and register matching runtime policies; see TwoFactor storage for the public additional_fields maps.

Fresh API Key generation uses table apikey, native camelCase columns, nullable Boolean flags, INTEGER numeric columns, and nonunique credential indexes. Use --api-key-legacy-schema to retain the previous names, types, nullability, and indexes during regeneration. Runtime flags preserve NULL through SchemaValue<bool>; see schema mapping for the public type and database migration boundaries. API Key expiration configuration accepts fractional seconds for its default and fractional days for its bounds; see API Key configuration for units. Declare application columns with apikey.additionalFields and register matching runtime policies; API Key storage describes the additional_fields maps, guarded usage updates, and cache behavior.

Configure Social Twitch with OAuthProvider::twitch and TwitchOptions, Social LINE with OAuthProvider::line, or Generic LINE with GenericOAuthConfig::line and resolved inputs through GenericOAuthProfileContext; see the OAuth guide for provider-specific PKCE options, fractional token lifetimes, the alpha callback migration, and the verification boundary. Use OAuthProvider::gitlab_with_issuer for self-hosted GitLab. OAuthCallbacks supplies custom ID-token verifiers with the typed endpoint context, runtime, and resolved session. Social refresh callbacks and legacy ID-token verifiers retain optional NativeRequest metadata. Social profile fields preserve omitted and null email/verification values; callbacks preserve application errors. Verification-email delivery failures are logged without changing the verification decision. The guide describes provider-specific missing-profile responses and public User projection after OAuth cookie issuance.

AuthContext::base_url() returns an owned URL snapshot. set_base_url updates the current dispatch and its retained handles; child dispatches and HTTP response hooks keep their own URL state. See runtime URL configuration for context ownership and caller migration.

Use get_oauth_state(&request)? in request hooks to read generated or validated OAuth state with native values. See the OAuth state contract for trusted fields and the UTF-16 object-key boundary. Use OAuth Popup to return OAuth sign-in results to a trusted popup opener. Enable OpenAPI for the configured runtime schema and Scalar reference page, including custom JWT discovery paths, registered model presence and declaration order, JavaScript model and field-key enumeration, and storage-dependent Verification components.

The JWT plugin supports local and custom signing, server-only verification, and asymmetric session cookie caches. Database key selection follows the configured query limit.

Use CAPTCHA for request verification and Have I Been Pwned for compromised-password checks. Versioned secrets support encryption-key rotation with retained legacy data.

For integration tests, enable TestUtilsPlugin and use auth.test() for seeded users, authenticated cookies, and OTP capture. See the test utilities guide.

Cookie lifetime configuration and HTTP cookie helper parameters accept fractional seconds. Explicit CookieAttributes.expires uses chrono::DateTime<Utc>. HTTP issuance and clearing return AuthResult and enforce the 400-day limits before formatting; see cookie configuration for numeric types and override precedence. The two Two Factor cookie lifetimes use f64 seconds and preserve explicit zero. The TOTP period and account lockout duration also accept fractional seconds. TOTP counters preserve JavaScript Number window offsets and unsigned 64-bit wrapping; see the same guide for numeric and timing boundaries. Direct TwoFactorStore::record_two_factor_failure callers provide a borrowed FieldDate deadline closure, evaluated after the projected counter reaches the threshold. view_backup_codes returns FieldValue so declared native replacements remain observable. OAuth Proxy accepts f64 seconds for its maximum profile age, including the upstream non-finite comparisons.

Use additionalFields in the CLI schema configuration to generate application columns or replace native declarations, including TeamMember fields. Replacements use the logical field name when fieldName is omitted or empty and share the backend storage types used by added fields. Register matching runtime field policies; see schema mapping.

Quick start

These examples use the current master branch. The DX changes are not yet published as a new crate release. Add these dependencies to your application's Cargo.toml:

[dependencies]
better-auth = { version = "1.0.0-alpha.5", git = "https://github.com/better-auth-rs/better-auth-rs", branch = "master", features = ["axum", "seaorm2"] }
axum = "0.8"
tokio = { version = "1", features = ["macros", "rt-multi-thread", "net"] }
serde = { version = "1", features = ["derive"] }
serde_json = "1"

Generate the core auth entities:

cargo install better-auth-cli --git https://github.com/better-auth-rs/better-auth-rs --branch master --locked
better-auth-rs generate --output src/auth_schema.rs

The CLI also preserves explicit core model declarations and the bound rate-limit model name for initialization telemetry. Empty native field mappings retain the model's resolved defaults and raw declarations; see schema generation.

Use --generate-id serial for integer IDs. Use --generate-id uuid --database postgres for native PostgreSQL UUIDs. The database option also selects storage for fresh application JSON fields: SQLite uses scalar-capable SqlText, while PostgreSQL/MySQL retain Json. Match the generated schema to the database backend and AuthConfig.advanced.database.generate_id. Derived plugin and organization bindings expose declared ID references so Serial writes normalize numeric aliases after configured input transforms.

Use this src/main.rs:

mod auth_schema;

use auth_schema::{AppAuthSchema, create_auth_tables};
use better_auth::{AuthConfig, BetterAuth};
use better_auth::integrations::axum::AxumIntegration;
use better_auth::plugins::{EmailPasswordPlugin, SessionManagementPlugin};
use better_auth::seaorm::{Database, SeaOrmStore};
use std::sync::Arc;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let database = Database::connect("sqlite::memory:").await?;
    create_auth_tables(&database).await?;
    let config = AuthConfig::new(std::env::var("AUTH_SECRET")?)
        .base_url("http://localhost:3000");
    let store = SeaOrmStore::<AppAuthSchema>::new(config.clone(), database);
    let auth = Arc::new(
        BetterAuth::<AppAuthSchema>::new(config)
            .store(store)
            .plugin(EmailPasswordPlugin::new().enable_signup(true))
            .plugin(SessionManagementPlugin::new())
            .build()
            .await?,
    );
    let app = axum::Router::new()
        .nest("/auth", auth.clone().axum_router())
        .with_state(auth);
    let listener = tokio::net::TcpListener::bind("127.0.0.1:3000").await?;
    axum::serve(listener, app).await?;
    Ok(())
}

Set AUTH_SECRET to a random secret of at least 32 characters, then run cargo run. The builder resolves explicit secrets before BETTER_AUTH_SECRET and AUTH_SECRET; short secrets warn, while NODE_ENV=production rejects the default development key. The in-memory database resets when the process stops. Use application-owned versioned migrations for persistent databases; create_auth_tables only initializes an empty database.

The quick-start guide includes sign-up and cookie session requests; the check gate compiles and runs the documented application. The independent consumer verifies public schema derives, generated entities, registration, login, Axum sessions, API keys, and TOTP.

Plugins and features

Plugins include email/password, username, sessions, password management, email verification, email OTP, phone numbers, anonymous accounts, SIWE, Magic Link, one-time tokens, multiple sessions, last login method, JWT, OAuth, One Tap, OAuth Proxy, organizations, two-factor authentication, passkeys, API keys, and admin. Use UsernamePlugin for username options or EmailPasswordPlugin::username(true) for defaults. Generate fields and tables for each selected plugin; startup rejects missing entity fields. Bind generated custom plugin tables with with_plugin_schema::<AppPluginSchema>(). See database integration and User field declaration order.

One-time token lifetimes include storage hashing time. See session transfer for expiration and consumption behavior.

Generic raw-profile handlers return AuthResult<Option<serde_json::Value>>: Some supplies a profile, None reports absence, and application errors propagate. Configure Generic OAuth or OIDC with OAuthPlugin::add_generic_provider and GenericOAuthConfig, including constructors for Auth0, Keycloak, Okta, Microsoft Entra ID, Gumroad, HubSpot, Patreon, Slack, and Yandex. OIDC discovery supplies endpoints and JWKS; set require_id_token_verification: true to require verification capability. Generic OAuth sign-up flags retain omission through Option<bool>. The OAuth guide covers client authentication, profile mapping, sign-up restrictions, and email verification. Signature verification requires OpenSSL 3.0 or newer; the complete ML-DSA algorithm set requires OpenSSL 3.5 or newer.

The organization plugin supports optional teams, team membership limits, active teams, and persisted roles scoped to an organization. Enable teams through OrganizationTeamsConfig and dynamic roles through dynamic_access_control(true) with access-control statements. Use auth.organization()?.add_member(Some(body)).await for server-only member creation through the native hook pipeline. TeamMember replacements use the same registered field policies; see database integration for native references, timestamps, and custom model migration. Organization CRUD retains endpoint-specific errors. Custom stores preserve organization list relationships as JoinValue<FieldMap>, return optional invitation status updates, and implement scoped Team reads on AuthTransaction; see the plugin guide for projection, transaction, and hook behavior.

Native and custom model declarations share alias resolution order. Use better_auth::plugin::ModelFields::register_model_schema from AuthPlugin::schema to declare a native model name with its field policies; see plugin declarations.

Memory Serial mode stores numeric primary IDs and returns string IDs through public record APIs. Verification reservations use the same adapter ID policy; duplicate exclusion requires that policy to retain the deterministic key and the store to enforce its uniqueness. Wallet, Passkey, TwoFactor, and TeamMember owner values use SchemaValue<String> and preserve numeric references in storage; use user_id.typed()? when you need a string. API Key referenceId also preserves native values through SchemaValue<String>; upstream does not declare an ID reference, so Serial reference conversion does not apply. Memory Serial mode applies Organization reference conversion to stored fields, queries, and internal relation keys. See Organization field policies for typed storage boundaries.

User, Session, JWK, and Wallet ID declarations retain their field position. The adapter controls their generation and conversion; see model IDs for nested callback behavior.

The device authorization plugin supports asynchronous code generators and propagates callback errors before persistence. Default device codes contain ASCII letters and digits; verification links replace any existing user-code query parameter.

The Admin plugin preserves a cancelled user update as a nullable response. Database-hook errors continue to propagate. User cache refresh errors use the instance logger; logger failures propagate after the completed write; see commit ordering.

HTTP rate limits support memory, database, secondary, and custom storage. Database selection restores the native RateLimit declarations after plugin registration. RateLimitConfig.model_name and fields configure the final table alias and column mappings; SQL mappings must match the bound generated entity. Use BetterAuth::call_endpoint for trusted endpoint calls with JSON input. Use call_endpoint_value with NativeEndpointInput to retain native body and query values through the same registered hooks and dispatcher.

Use ctx.logger().error("message", &[])? for fallible instance diagnostics. Configure config.logger with LoggerConfig { .. }.into(), or retain LoggerOptions for live callback replacement. An instance freezes its logging policy and retains its original callback owner; see observability for configuration and error ownership.

Passwords use Better Auth's scrypt format by default. Existing PasswordHasher implementations keep their string and boolean methods; override verify_native to consume a replaced Account password field without losing its native value. The password guide explains native verification and explicit Argon2 migration. Add HaveIBeenPwnedPlugin to reject compromised passwords before hashing.

Use ApiKeyView::try_from_api_key(&key)?, InvitationView::try_from_invitation(&invitation)?, and BasicMemberResponse::try_from_member(&member)? for native public views. The conversions preserve source fields and propagate dynamic read errors. BasicMemberResponse aliases the core Member; OrganizationView, OrganizationResponse, and CreatedOrganizationResponse alias the core Organization. Convert a custom organization with Organization::from(&record). A joined MemberResponse exposes the complete membership through .member and the user summary through .user; construct it with try_from_member_and_user.

API Key, Passkey, DeviceCode, TwoFactor, JWK, and WalletAddress merge complete native and application field declarations through ModelFields. Both adapters apply the same record and patch policies before runtime record construction; Memory retains live field reads and SQL retains query snapshots. Ordinary raw SQL CRUD reads physical columns before declaration projection, so unused Entity columns do not constrain these queries. Native runtime fields preserve dynamic values through SchemaValue<T>, while ordinary typed inputs remain available. Organization, Member, Invitation, Team, and OrganizationRole SQL CRUD use the same raw-field output boundary; their ordinary Memory CRUD responses retain selected live rows. Organization record JSON decoding preserves property order and revives only declared native date fields; native adapter conversion preserves the original values. User, Member, and Device ownership queries share Memory comparison semantics while retaining their separate selection and mutation boundaries. Generate matching columns with the CLI schema configuration. See plugin field policies and the alignment inventory for acceptance and remaining differences.

Device request fields support ordered synchronous or asynchronous validation with structured issues. See request field validation for configuration, storage separation, and the BodyValidator migration. A configured grant adds typed request authorization, declared stored fields, a required session-redemption policy, and owner-only verification context. Server-only redemption accepts DeviceCodeOwnership::Where(DeviceCodeWhere) with 11 comparison operators and two string comparison modes. Conditions use native scope, declared non-reference fields, or String, Json, and Date references to id, and retain the original code and owner bindings. In requires an array before adapter conversion. FieldEquals, FieldIn, and FieldNotIn accept String references; Serial IDs retain the shared numeric conversion. The helper returns the active internal user schema, including hidden fields. See ownership conditions for values, backend behavior, and remaining reference limitations.

Optional configuration fields use Option to distinguish omission from an explicit value. Construct social providers with a built-in constructor or OAuthProvider::custom. See configuration options for defaults and OAuth for provider configuration. Observability documents logging, tracing, opt-in telemetry, Linux CPU and memory metadata, kernel and WSL detection, process-cached Docker detection, and the current alignment boundaries.

Google sign-in maps verified ID-token claims through the shared Google verifier used by One Tap. GoogleOptions adds accepted client IDs while retaining the primary ID for authorization and token requests. See Google profile behavior for configuration, custom callbacks, and account-info behavior.

Built-in provider constructors supply provider defaults and profile mapping, including Sign in with Apple. Social Microsoft uses OAuthProvider::microsoft with MicrosoftOptions; Generic Entra keeps its separate constructor. See built-in providers for supported constructors and configuration.

Set OAuthProvider::redirect_uri to use a configured provider callback URI for both authorization and code exchange. The optional client_key follows each Social provider’s code-exchange options; see the OAuth guide for exceptions.

Custom OAuthUserInfoHandler implementations return AuthResult<Option<OAuthUserInfoResponse>> to distinguish a missing profile from an application error. Profile names, emails, and mapper overrides preserve missing, null, and string values, including GitHub email-list fallback. Sign-in normalizes omitted and null names to an empty string for storage and admission; see the OAuth guide.

Documentation and development

• Installation and Axum integration
• API key server API and database hooks
• Secondary storage for sessions, one-time verification values, and API keys
• Examples, contributing, and alignment roadmap
• Compatibility harness; upstream behavior remains the source of truth

Install devenv, then run devenv test. Local checks and CI use scripts/check.sh. The shell supplies ICU 78.3 for Memory string collation; external builds must configure the ICU library path and major version as described in installation.

License

Licensed under MIT or Apache-2.0, at your option.

Password reset lifetime configuration uses fractional seconds (Option<f64>); see the password management guide for defaults and migration examples.