better-authSelf-hosted auth for TypeScript/Cloudflare Workers with social auth, 2FA, passkeys, organizations, RBAC, and 15+ plugins. Requires Drizzle ORM or Kysely for D1 (no direct adapter). Self-hosted alternative to Clerk/Auth.js. Use when: self-hosting auth on D1, building OAuth provider, multi-tenant SaaS, or troubleshooting D1 adapter errors, session caching, rate limits, Expo crashes, additionalFields bugs.
Install via ClawdBot CLI:
clawdbot install veeramanikandanr48/better-authGrade Good — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Calls external URL not in known-safe list
https://www.better-auth.com/changelogsAudited Apr 17, 2026 · audit v1.0
Generated Mar 1, 2026
A B2B software company building a cloud-based service with separate organizations for each customer. They need self-hosted authentication with role-based access control (RBAC) and organization management to securely isolate tenant data and user permissions. The D1 adapter with Drizzle ORM enables scalable, serverless auth on Cloudflare Workers.
A tech startup creating an API or developer platform that requires its own OAuth provider for third-party integrations. They leverage the OAuth 2.1 Provider plugin to build a custom authentication flow, supporting social logins and secure token management while self-hosting on D1 for cost control and compliance.
A large corporation migrating internal tools to a modern web stack, requiring single sign-on (SSO) via SAML 2.0 for employee access. They use the @better-auth/sso package to integrate with existing identity providers, ensuring secure, centralized authentication across multiple applications with stateless session management.
An online retail business building a secure customer portal with email/password login and two-factor authentication (2FA). They implement better-auth on Cloudflare Workers to handle user sessions, passkey support for frictionless logins, and Stripe integration for subscription management, all while troubleshooting D1 adapter errors for reliability.
A mobile app development team using Expo for cross-platform apps, needing a robust auth backend to prevent crashes and handle social sign-ins like Patreon and Kick. They deploy better-auth on D1 with the Kysely adapter pattern, ensuring proper cookie handling and session caching for mobile users.
Offer the core better-auth package as free, open-source software for self-hosting, while monetizing through premium plugins like advanced SSO, SCIM provisioning, or enterprise support. Revenue is generated via subscription fees for these add-ons, targeting businesses needing enhanced features.
Provide paid consulting services to help companies integrate better-auth into their projects, especially for complex scenarios like multi-tenant setups or troubleshooting D1 adapter issues. Revenue comes from hourly rates or project-based contracts, leveraging expertise in TypeScript and Cloudflare Workers.
Launch a managed, hosted version of better-auth as a service, similar to Clerk or Auth.js, but built on the same self-hostable codebase. Charge based on usage metrics like monthly active users or authentication requests, appealing to teams wanting convenience without infrastructure management.
💬 Integration Tip
Always use a factory function pattern in Cloudflare Workers to initialize better-auth inside the request handler, as D1 database bindings are only available there; for TanStack Start, ensure the reactStartCookies plugin is the last one to handle cookies correctly.
Scored Apr 19, 2026
Clerk integration. Manage Users, Organizations. Use when the user wants to interact with Clerk data.
Clerk auth with API Keys beta (Dec 2025), Next.js 16 proxy.ts (March 2025 CVE context), API version 2025-11-10 breaking changes, clerkMiddleware() options, webhooks, production considerations (GCP outages), and component reference. Prevents 15 documented errors. Use when: API keys for users/orgs, Next.js 16 middleware filename, troubleshooting JWKS/CSRF/JWT/token-type-mismatch errors, webhook verification, user type inconsistencies, or testing with 424242 OTP.
Sentry API integration with managed authentication. Monitor errors, issues, and application performance. Use this skill when users want to list issues, retrieve events, manage projects, teams, or releases in Sentry. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway). Calls run through the `maton` CLI with OAuth login, or over raw HTTP with a Maton API key where the CLI cannot be installed. Every call is authenticated as the user's connection and reaches only what that connection's authorization allows, which the provider enforces on every request; the endpoints documented here are the ones this skill uses, and any other endpoint of this app needs the user to ask for it by name. Default to read and list calls, and confirm every write or new connection with the user. This file also documents the three constructs that turn a Sentry connection into automation, in the order they are used: the connection (the first step), a hosted function that runs a Sentry action through the Maton SDK, and a trigger that calls that function on a schedule or on an event. Those sections are the platform's own reference text, shared with the api-gateway skill, with Sentry examples; they add no Sentry capability - Sentry is not an event source, a trigger cannot read Sentry data, and the files under `references/<source>/triggers.md` are the platform's event catalogues for the sources Maton offers (time, Calendly, GitHub, Gmail, HubSpot, Linear, Notion, Slack, Stripe).
OneNote API integration with managed OAuth via Microsoft Graph. Access notebooks, sections, section groups, and pages. Use this skill when users want to create or manage OneNote notebooks, organize notes, or work with page content. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway). Calls run through the `maton` CLI with OAuth login, or over raw HTTP with a Maton API key where the CLI cannot be installed. Every call is authenticated as the user's connection and reaches only what that connection's authorization allows, which the provider enforces on every request; the endpoints documented here are the ones this skill uses, and any other endpoint of this app needs the user to ask for it by name. Default to read and list calls, and confirm every write or new connection with the user. This file also documents the three constructs that turn an OneNote connection into automation, in the order they are used: the connection (the first step), a hosted function that runs an OneNote action through the Maton SDK, and a trigger that calls that function on a schedule or on an event. Those sections are the platform's own reference text, shared with the api-gateway skill, with OneNote examples; they add no OneNote capability - OneNote is not an event source, a trigger cannot read OneNote data, and the files under `references/<source>/triggers.md` are the platform's event catalogues for the sources Maton offers (time, Calendly, GitHub, Gmail, HubSpot, Linear, Notion, Slack, Stripe).
Download YouTube videos by URL in various resolutions using a pay-per-use API with credit-based authentication and no charge on failed downloads.
Podio API integration with managed OAuth. Manage workspaces, apps, items, tasks, and comments. Use this skill when users want to read, create, update, or delete Podio items, manage tasks, or interact with Podio apps and workspaces. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway). Calls run through the `maton` CLI with OAuth login, or over raw HTTP with a Maton API key where the CLI cannot be installed. Every call is authenticated as the user's connection and reaches only what that connection's authorization allows, which the provider enforces on every request; the endpoints documented here are the ones this skill uses, and any other endpoint of this app needs the user to ask for it by name. Default to read and list calls, and confirm every write or new connection with the user. This file also documents the three constructs that turn a Podio connection into automation, in the order they are used: the connection (the first step), a hosted function that runs a Podio action through the Maton SDK, and a trigger that calls that function on a schedule or on an event. Those sections are the platform's own reference text, shared with the api-gateway skill, with Podio examples; they add no Podio capability - Podio is not an event source, a trigger cannot read Podio data, and the files under `references/<source>/triggers.md` are the platform's event catalogues for the sources Maton offers (time, Calendly, GitHub, Gmail, HubSpot, Linear, Notion, Slack, Stripe).