Better Auth IAM Provider
Open-source, framework-agnostic authentication and authorization library for TypeScript. Embedded directly in your application and backed by your own database, with a plugin system covering 2FA, passkeys, organizations, SSO/SAML, SCIM, an OAuth 2.1 / OpenID Connect provider and MCP/agent auth. Core differentiator: it is a library, not a hosted service, so there is no vendor server, no per-user pricing and no redirect to a third-party domain. An optional paid Better Auth Infrastructure adds a dashboard, audit logs, security detections and managed email/SMS.
Features
- 🇸🇪🇱🇫🇒ðŸ‡ðŸ‡´ðŸ‡¸ðŸ‡¹ðŸ‡ªðŸ‡©Self-hosted
- On-premisesAny cloud
- TypeScriptJavaScriptNext.jsNuxtSvelteKitSolidStartAstroTanStack StartReact RouterWakuExpressHonoFastifyElysiaNestJSNitroEncoreConvexExpoElectronLynx
If you want to compare IAM features of different providers, please check out the (C)IAM Identity Providers benchmark.
Looking for Better Auth’s OpenID Connect protocol compatibility? View Better Auth on the OpenID Connect Providers benchmark.
Frequently Asked Questions
Does Better Auth support Username and Password authentication method?
Better Auth supports Username and Password authentication method. Email/password sign-up and sign-in built in (scrypt hashing by default, pluggable via custom hash/verify), with email verification and password reset. The username plugin adds username-based sign-in with configurable length, validator and normalization. Read more
Does Better Auth support Social Sign-in authentication method?
Better Auth supports Social Sign-in authentication method. Over 35 built-in social providers (Google, GitHub, Apple, Microsoft, Discord, LinkedIn, X, and more). Any other OAuth 2.0 / OIDC provider can be added with the Generic OAuth plugin. Read more
Does Better Auth support Passkey authentication method?
Better Auth supports Passkey authentication method. Passkeys (WebAuthn/FIDO2) via the passkey plugin, built on SimpleWebAuthn. Supports conditional UI / autofill and a passkey-first registration flow. Documented as a primary sign-in method only, not as a second factor. Read more
Does Better Auth support Email Passwordless authentication method?
Better Auth supports Email Passwordless authentication method. Email one-time codes via the Email OTP plugin (sign-in, email verification, password reset). The application supplies the email delivery function. Configurable code length, expiry, attempt limit and storage (plain, encrypted or hashed). Read more
Does Better Auth support Phone Passwordless authentication method?
Better Auth supports Phone Passwordless authentication method. Phone number sign-up/sign-in with SMS one-time codes via the phone number plugin. The application supplies the SMS delivery function (any provider, including Twilio Verify through a custom verifyOTP). Also supports phone number plus password. Read more
Does Better Auth support Magic Link authentication method?
Better Auth supports Magic Link authentication method. Email magic links via the magic link plugin. Single-use tokens (default 5 minutes), optional hashed token storage, built-in rate limit. The application supplies the email delivery function. Read more
Does Better Auth support Anonymous / Guest authentication method?
Better Auth supports Anonymous / Guest authentication method. The anonymous plugin issues a session for a guest user with a generated placeholder identity. An onLinkAccount callback migrates data to the real account when the guest later signs in or up, and the anonymous record is removed by default. Read more
Does Better Auth support Time-based One-Time Password (TOTP) MFA?
Better Auth supports Time-based One-Time Password (TOTP) MFA. TOTP authenticator apps via the two-factor plugin (30-second period, enrollment verification, configurable issuer, optional trusted devices for 30 days). Account lockout after repeated failed verifications is on by default. Read more
Does Better Auth support HMAC-based One-Time Password (HOTP) MFA?
Better Auth does not support HMAC-based One-Time Password (HOTP) MFA. The two-factor plugin documents TOTP and OTP only; no counter-based HOTP. Read more
Does Better Auth support Universal 2nd Factor (U2F) MFA?
Better Auth does not support Universal 2nd Factor (U2F) MFA. No FIDO U2F second factor is documented. Passkeys are offered as a sign-in method, not as a second factor. Read more
Does Better Auth support WebAuthn MFA?
Better Auth does not support WebAuthn MFA. The passkey plugin is documented as a passwordless sign-in method only; the two-factor plugin does not list WebAuthn as a second factor. Read more
Does Better Auth support Email Code MFA?
Better Auth supports Email Code MFA. Second-factor OTP codes delivered by email through the application-provided sendOTP function of the two-factor plugin. Read more
Does Better Auth support Phone Code MFA?
Better Auth supports Phone Code MFA. Second-factor OTP codes delivered by SMS through the application-provided sendOTP function of the two-factor plugin. Requires an SMS provider chosen by the application. Read more
Does Better Auth support Recovery Code MFA?
Better Auth supports Recovery Code MFA. Backup codes generated by the two-factor plugin. Each code is single-use and can be regenerated, which invalidates the previous set. Read more
Does Better Auth support Push Notification MFA?
Better Auth does not support Push Notification MFA. No push-based approval second factor is documented.
Does Better Auth support Adaptive / Risk-Based MFA MFA?
Better Auth does not support Adaptive / Risk-Based MFA MFA. No risk-based adaptive MFA. Better Auth Infrastructure (Sentinel) can challenge or block risky sign-ins, but it does not trigger MFA step-up. Read more
Does Better Auth support Cisco Duo MFA?
Better Auth does not support Cisco Duo MFA. No Cisco Duo integration is documented.
Does Better Auth support Step-Up Authentication MFA?
Better Auth partially supports Step-Up Authentication MFA. Sensitive endpoints require a fresh session (session.freshAge, default 1 day) and password re-entry for actions such as enabling 2FA or deleting an account. There is no ACR/AMR-based step-up policy; the OAuth provider advertises acr_values_supported as ["0"]. Read more
Does Better Auth support OpenID Connect (OIDC) integration protocol?
Better Auth supports OpenID Connect (OIDC) integration protocol. Acts as an OpenID Connect provider through the OAuth 2.1 Provider plugin (authorization code with PKCE, refresh tokens, client credentials, discovery, UserInfo, RP-initiated and back-channel logout). The older OIDC Provider and MCP plugins build on the same capability. Also consumes OIDC providers as a relying party. Read more
Does Better Auth support SAML 2.0 integration protocol?
Better Auth partially supports SAML 2.0 integration protocol. SAML 2.0 Service Provider only, through the SSO plugin (signed AuthnRequests, encrypted assertions, IdP-initiated SSO). Better Auth cannot act as a SAML identity provider. Read more
Does Better Auth support WS-Federation integration protocol?
Better Auth does not support WS-Federation integration protocol. WS-Federation is not supported.
Does Better Auth support Machine-to-Machine (M2M) Authentication integration protocol?
Better Auth supports Machine-to-Machine (M2M) Authentication integration protocol. OAuth 2.0 client_credentials grant via the OAuth Provider plugin (fail-closed: scopes must be explicitly allowed per client), plus the API Key plugin for key-based service authentication. Read more
Does Better Auth support OpenID Connect (OIDC) Federation identity federation?
Better Auth supports OpenID Connect (OIDC) Federation identity federation. Generic OAuth plugin connects any OIDC provider through a discovery URL (ID token signature, issuer, audience and nonce validation, PKCE on by default). The SSO plugin registers per-domain OIDC providers at runtime. Read more
Does Better Auth support SAML 2.0 Federation identity federation?
Better Auth supports SAML 2.0 Federation identity federation. Inbound SAML 2.0 federation via the SSO plugin, with domain-based provider resolution, DNS domain verification, certificate rotation, InResponseTo validation, replay protection and deprecated-algorithm checks. Single Logout is not documented. Read more
Does Better Auth support Active Directory / LDAP identity federation?
Better Auth does not support Active Directory / LDAP identity federation. No built-in LDAP or on-premises Active Directory connector. Microsoft Entra ID is reachable over OIDC.
Does Better Auth support Azure Active Directory (Entra ID) identity federation?
Better Auth supports Azure Active Directory (Entra ID) identity federation. Microsoft social provider and a Microsoft Entra ID helper for the Generic OAuth plugin (ID token verification enabled automatically). Entra ID tenants can also be registered as OIDC/SAML providers through the SSO plugin. Read more
Does Better Auth support Bulk User Import user management?
Better Auth partially supports Bulk User Import user management. No dedicated bulk import endpoint. Migration guides and scripts cover importing users from Auth0, Clerk, Supabase Auth, WorkOS and Auth.js, and because data lives in the application database, users can also be loaded with SQL or the ORM. Read more
Does Better Auth support Password Hash Import (Multiple Formats) user management?
Better Auth partially supports Password Hash Import (Multiple Formats) user management. Imported users keep their existing hashes by overriding emailAndPassword.password.hash/verify with the legacy algorithm (for example bcrypt). The default algorithm is scrypt. Read more
Does Better Auth support Bulk User Export user management?
Better Auth partially supports Bulk User Export user management. No dedicated export endpoint. User data lives in the application-owned database, and the admin plugin lists users with pagination. Read more
Does Better Auth support Bulk User Update / Delete user management?
Better Auth does not support Bulk User Update / Delete user management. The admin plugin documents single-user operations only; no bulk update or delete. Read more
Does Better Auth support Inbound SCIM Provisioning user management?
Better Auth supports Inbound SCIM Provisioning user management. SCIM 2.0 server (RFC 7643/7644) via the SCIM plugin: Users and Groups resources, bearer-token connections, discovery endpoints, and managed token rotation. Requires a database adapter with interactive transactions. Better Auth Infrastructure adds a managed Directory Sync dashboard. Read more
Does Better Auth support Outbound SCIM Provisioning user management?
Better Auth does not support Outbound SCIM Provisioning user management. The SCIM plugin is inbound only; Better Auth does not push users to downstream applications. Read more
Does Better Auth support SCIM Groups Provisioning user management?
Better Auth supports SCIM Groups Provisioning user management. SCIM Groups resource with direct memberships. Groups can be projected to application roles through role mapping. Read more
Does Better Auth support Just-In-Time (JIT) User Provisioning user management?
Better Auth supports Just-In-Time (JIT) User Provisioning user management. Users are created on first social or SSO sign-in. The SSO plugin offers provisionUser (per new user or on every login) and automatically adds users to the linked organization with a default or computed role. Read more
Does Better Auth support Self-Service Profile Management Portal user management?
Better Auth supports Self-Service Profile Management Portal user management. Built-in client APIs to update profile, change email (with verification), change or set password, list and revoke sessions, link and unlink accounts, and delete the account. Read more
Does Better Auth support User Account Linking user management?
Better Auth supports User Account Linking user management. Automatic linking of providers that confirm a verified email, trusted-provider list, manual linking (including with ID tokens), unlinking, and an option to disable implicit linking. Read more
Does Better Auth support User Blocking / Banning user management?
Better Auth supports User Blocking / Banning user management. The admin plugin can ban and unban users with an optional reason and expiry. Banning blocks sign-in and revokes existing sessions. Read more
Does Better Auth support User Metadata user management?
Better Auth supports User Metadata user management. The user table can be extended with additional typed fields, and plugins add their own fields. Fields live in the application database and in the same schema as the rest of the application. Read more
Does Better Auth support Application Metadata user management?
Better Auth supports Application Metadata user management. Additional fields can be declared as not settable by the end user (input: false) and written only by server code, which covers admin-only attributes. The admin plugin stores role and ban state this way. Read more
Does Better Auth support User Search user management?
Better Auth supports User Search user management. The admin plugin lists users with search (contains, starts_with, ends_with on email or name), filters, sorting and offset pagination. Read more
Does Better Auth support Role-Based Access Control (RBAC) user management?
Better Auth supports Role-Based Access Control (RBAC) user management. Role-based access control with custom resources and actions via createAccessControl. Admin plugin roles are global, organization plugin roles are scoped per organization, and users can hold multiple roles. Read more
Does Better Auth support Organizations (Multi-Tenancy B2B) user management?
Better Auth supports Organizations (Multi-Tenancy B2B) user management. Organization plugin: organizations, members, invitations, teams, an active organization per session, per-organization roles with optional runtime-defined (dynamic) roles, lifecycle hooks and configurable limits. Read more
Does Better Auth support Password Strength Policies user management?
Better Auth partially supports Password Strength Policies user management. Default password length of 8 to 128 characters. The Have I Been Pwned plugin rejects breached passwords. No built-in composition rules or strength scoring; custom rules can be added with hooks. Read more
Does Better Auth support Username Restrictions user management?
Better Auth supports Username Restrictions user management. The username plugin supports minimum length (default 3), maximum length (default 30), custom validators for the username and the display username, and configurable normalization (lowercase by default). Read more
Does Better Auth support Progressive Profiling / Forms user management?
Better Auth does not support Progressive Profiling / Forms user management. No built-in progressive profiling; the application owns the UI and can collect extra fields itself.
Does Better Auth support Attribute-Based Access Control (ABAC) access control?
Better Auth does not support Attribute-Based Access Control (ABAC) access control. Access control is role and permission based (resource to actions). There is no attribute-based policy engine. Read more
Does Better Auth support Fine-Grained Authorization (FGA / ReBAC) access control?
Better Auth does not support Fine-Grained Authorization (FGA / ReBAC) access control. No relationship-based or policy-based authorization engine. Dynamic organization roles, teams and API key permissions cover coarser use cases. Read more
Does Better Auth support API Authorization (Scopes / Permissions) access control?
Better Auth supports API Authorization (Scopes / Permissions) access control. The OAuth Provider plugin issues audience-bound JWT access tokens (RFC 8707 resource indicators) with per-resource scopes, introspection, and verifyAccessTokenRequest for resource servers. The API Key plugin supports per-key permissions, rate limits and expiry. Read more
Does Better Auth support Audit Log Retention security feature?
Better Auth partially supports Audit Log Retention security feature. The open-source library has no built-in audit log. Better Auth Infrastructure records user, session, account, organization and security events, with retention of 1 day (Starter), 7 days (Pro) and custom (Enterprise). Read more
Does Better Auth support Audit Log Streaming security feature?
Better Auth supports Audit Log Streaming security feature. Log drain is part of Better Auth Infrastructure Enterprise and listed as a $25/month add-on. Read more
Does Better Auth support Security Center (Threat Monitoring Dashboard) security feature?
Better Auth supports Security Center (Threat Monitoring Dashboard) security feature. The Better Auth Infrastructure dashboard surfaces Sentinel security events: blocked requests, credential stuffing, impossible travel, geo-blocking, bots, suspicious IPs, velocity abuse and compromised passwords. Read more
Does Better Auth support Encryption at Rest security feature?
Better Auth partially supports Encryption at Rest security feature. Encryption of the database is the host application's responsibility. The library encrypts JWT private keys with AES-256-GCM by default and supports versioned secrets for rotation, but OAuth provider tokens stored in the account table are not encrypted by default. Read more
Does Better Auth support Encryption in Transit security feature?
Better Auth supports Encryption in Transit security feature. Secure, httpOnly, SameSite=Lax cookies are issued automatically for HTTPS base URLs. TLS itself is terminated by the host application or its infrastructure. Read more
Does Better Auth support Customer Managed Keys (BYOK) security feature?
Better Auth partially supports Customer Managed Keys (BYOK) security feature. Everything is self-hosted, so secrets are customer-controlled. The JWT plugin supports custom signing functions backed by an external KMS (Google KMS, AWS KMS, Azure Key Vault) with a remote JWKS URL. Read more
Does Better Auth support Bot Detection security feature?
Better Auth supports Bot Detection security feature. The captcha plugin protects sign-up, sign-in and password reset with reCAPTCHA v2/v3, Cloudflare Turnstile, hCaptcha, CaptchaFox or Vercel BotID. Better Auth Infrastructure (Sentinel) adds bot blocking. Read more
Does Better Auth support Brute Force Protection security feature?
Better Auth supports Brute Force Protection security feature. Built-in rate limiting on all routes with stricter rules for sensitive ones (for example 3 requests per 10 seconds on email sign-in and on two-factor routes), account lockout on repeated failed 2FA attempts, and attempt limits on OTP codes. Read more
Does Better Auth support Suspicious IP Throttling security feature?
Better Auth supports Suspicious IP Throttling security feature. Per-IP rate limiting with configurable trusted proxy headers and IPv6 subnet grouping in the open-source library. Better Auth Infrastructure (Sentinel) adds blocking or challenging of known malicious IPs and geo allow/deny lists. Read more
Does Better Auth support Breached Password Detection security feature?
Better Auth supports Breached Password Detection security feature. The Have I Been Pwned plugin rejects compromised passwords at sign-up and password change using k-anonymity (only a 5-character hash prefix is sent). Sentinel also checks passwords at sign-in. Read more
Does Better Auth support Credential Guard (Dark Web Monitoring) security feature?
Better Auth partially supports Credential Guard (Dark Web Monitoring) security feature. Sentinel in Better Auth Infrastructure detects credential stuffing from failed-login velocity and issues a proof-of-work challenge or a block. There is no dark-web credential monitoring. Read more
Does Better Auth support Tenant Access Control List (IP ACL) security feature?
Better Auth partially supports Tenant Access Control List (IP ACL) security feature. Sentinel in Better Auth Infrastructure supports country allow/deny lists and suspicious IP blocking. No TLS-fingerprint-based restrictions are documented. Read more
Does Better Auth support Device Fingerprinting security feature?
Better Auth supports Device Fingerprinting security feature. Sentinel uses a client-sent visitor ID (X-Visitor-Id header) for credential stuffing, free-trial abuse and device tracking detections. Read more
Does Better Auth support Per-Organization Branding multi-tenancy?
Better Auth does not support Per-Organization Branding multi-tenancy. No hosted pages to brand; the application owns all UI and can theme it per organization itself.
Does Better Auth support Per-Organization MFA Policy multi-tenancy?
Better Auth does not support Per-Organization MFA Policy multi-tenancy. The organization plugin has no per-organization MFA policy. Organization hooks can be used to enforce one in application code. Read more
Does Better Auth support Hosted / Universal Login Page branding feature?
Better Auth does not support Hosted / Universal Login Page branding feature. No hosted login page. Better Auth is headless: sign-in, consent and account-selection screens are built in the application.
Does Better Auth support Embedded / Native Login Components branding feature?
Better Auth supports Embedded / Native Login Components branding feature. Authentication runs in the host application on its own domain with a typed client SDK; there is no redirect to a vendor domain. Read more
Does Better Auth support White-Label / Full Brand Removal branding feature?
Better Auth supports White-Label / Full Brand Removal branding feature. No vendor branding anywhere in the flow, since every screen and email is part of the host application.
Does Better Auth support Localization / i18n branding feature?
Better Auth partially supports Localization / i18n branding feature. The i18n plugin translates API error messages (22 built-in languages, detection by header, cookie, session or callback). UI and email copy are owned by the application. Read more
Does Better Auth support Prebuilt UI Components (SDK) branding feature?
Better Auth does not support Prebuilt UI Components (SDK) branding feature. No official pre-built UI component kit; the client SDK is headless. Community UI libraries exist. Read more
Does Better Auth support Login / Auth Analytics Dashboard analytics?
Better Auth supports Login / Auth Analytics Dashboard analytics. The Better Auth Infrastructure dashboard provides user, organization and session analytics and activity tracking. The open-source library does not include analytics. Read more
Does Better Auth support GDPR: Data Export (Portability) compliance?
Better Auth partially supports GDPR: Data Export (Portability) compliance. No dedicated export endpoint. All user data lives in the application-owned database and can be exported by the application. Read more
Does Better Auth support GDPR: Right to be Forgotten (User Deletion) compliance?
Better Auth supports GDPR: Right to be Forgotten (User Deletion) compliance. Account deletion (disabled by default) authorized by password, fresh session or an emailed verification link, with beforeDelete/afterDelete hooks. Deletion is a hard delete. Read more
Does Better Auth support Consent Management compliance?
Better Auth partially supports Consent Management compliance. OAuth consent for third-party clients can be listed, updated and revoked per user, with skip_consent for trusted clients. No privacy or marketing consent management. Read more
Does Better Auth support Region Deployment compliance?
Better Auth supports Region Deployment compliance. The library runs wherever the host application is deployed, so data residency is determined by the application and database hosting.
Does Better Auth support Private Cloud Deployment compliance?
Better Auth supports Private Cloud Deployment compliance. Runs inside the application on any cloud or on-premises infrastructure. There is no separate Better Auth server to deploy.
Does Better Auth support SDK Coverage developer integration?
Better Auth partially supports SDK Coverage developer integration. TypeScript/JavaScript only. A framework-agnostic client plus official integrations for the frameworks listed. There is no SDK for non-JavaScript backends. Read more
Does Better Auth support Management API developer integration?
Better Auth supports Management API developer integration. Server-side auth.api exposes every endpoint as a typed function, and the admin and organization plugins cover user, session, organization, member and role management. There is no separate remotely hosted management API to authenticate against. Read more
Does Better Auth support Authentication API Rate Limits developer integration?
Better Auth supports Authentication API Rate Limits developer integration. Configurable rate limiting (default 100 requests per 10 seconds in production) with per-route rules, wildcards, memory/database/secondary storage and custom storage. Server-side auth.api calls are exempt. Read more
Does Better Auth support Actions / Extensibility Pipeline developer integration?
Better Auth supports Actions / Extensibility Pipeline developer integration. Request hooks (before/after), database hooks, per-plugin lifecycle hooks, and a plugin system for adding endpoints, schema and client behavior. Read more
Does Better Auth support TypeScript Support in Extensibility developer integration?
Better Auth supports TypeScript Support in Extensibility developer integration. All hooks, callbacks and plugins are written in TypeScript in the host application with end-to-end inferred types. Read more
Does Better Auth support Custom Domain developer integration?
Better Auth supports Custom Domain developer integration. Authentication is served from the application's own domain. Better Auth Infrastructure additionally offers a custom dashboard domain as a $25/month add-on. Read more
Does Better Auth support Deploy CLI (Infrastructure as Code) developer integration?
Better Auth partially supports Deploy CLI (Infrastructure as Code) developer integration. The Better Auth CLI generates and migrates the database schema, but it does not export or import tenant configuration. Configuration lives in application code and is deployed with it. Read more
Does Better Auth support Terraform Provider developer integration?
Better Auth does not support Terraform Provider developer integration. No Terraform provider. Configuration is application code.
Does Better Auth support Custom Database Connections developer integration?
Better Auth supports Custom Database Connections developer integration. Bring your own database: PostgreSQL, MySQL, SQLite, MS SQL, MongoDB, and Drizzle/Prisma/Kysely adapters, plus community adapters and a guide for writing custom adapters. Stateless (database-less) sessions and secondary storage such as Redis are supported. Read more
Does Better Auth support Native Webhook Support developer integration?
Better Auth does not support Native Webhook Support developer integration. No outbound webhooks. Request and database hooks run in-process and can call any HTTP endpoint. Read more
Does Better Auth support Universal Login / Hosted Login Page Customization developer integration?
Better Auth does not support Universal Login / Hosted Login Page Customization developer integration. There is no hosted login page to customize; the application owns the UI.
Does Better Auth support Custom Email Provider (SMTP) developer integration?
Better Auth supports Custom Email Provider (SMTP) developer integration. Email is sent through application-provided callbacks (sendVerificationEmail, sendResetPassword, sendMagicLink, sendVerificationOTP and others), so any provider can be used. Better Auth Infrastructure also offers a managed email service. Read more
Does Better Auth support Email Templates developer integration?
Better Auth partially supports Email Templates developer integration. Core library sends no templated email; the application renders its own. Better Auth Infrastructure Pro adds hosted email templates. Read more
Does Better Auth support Custom OIDC Claims / Token Enrichment developer integration?
Better Auth supports Custom OIDC Claims / Token Enrichment developer integration. The OAuth Provider plugin supports customIdTokenClaims, customAccessTokenClaims, customUserInfoClaims and customTokenResponseFields. The JWT plugin supports a custom payload. Read more
Does Better Auth support No-Code Auth Flow Builder / Orchestration feature?
Better Auth does not support No-Code Auth Flow Builder / Orchestration feature. No visual flow builder; flows are code.
Does Better Auth support Identity Verification / Document Proofing feature?
Better Auth does not support Identity Verification / Document Proofing feature. No built-in identity proofing or document verification.
Does Better Auth support Decentralized / Verifiable Credentials feature?
Better Auth does not support Decentralized / Verifiable Credentials feature. No W3C Verifiable Credentials or DID support. Sign In With Ethereum (SIWE) is available as a wallet-based sign-in method. Read more
Does Better Auth support Built-in Billing / Subscription Management feature?
Better Auth supports Built-in Billing / Subscription Management feature. Payment plugins for Stripe, Polar, Autumn, Dodo Payments, Creem, Chargebee and Commet link customers and subscriptions to users and organizations. Read more
Does Better Auth support Agentic AI / MCP Server Authentication feature?
Better Auth supports Agentic AI / MCP Server Authentication feature. The MCP plugin and OAuth Provider (resource indicators, DPoP, Client ID Metadata Documents) support OAuth for MCP servers and AI agents. The Agent Auth plugin implements the Agent Auth Protocol (agent registration, capability grants, user approval via device authorization or CIBA, signed short-lived agent JWTs) but is under heavy development and may change. Read more
Does Better Auth support Post-Quantum Digital Signature Algorithms post-quantum cryptography feature?
Better Auth does not support Post-Quantum Digital Signature Algorithms post-quantum cryptography feature. The JWT plugin signs with EdDSA (default), ES256/ES512, RS256 and PS256, and the OAuth provider accepts the classical RS/PS/ES/EdDSA algorithms. No ML-DSA, SLH-DSA or FN-DSA support is documented. Read more
Does Better Auth support Post-Quantum Token & Data Encryption post-quantum cryptography feature?
Better Auth does not support Post-Quantum Token & Data Encryption post-quantum cryptography feature. No ML-KEM or HPKE token encryption is documented.
Does Better Auth support Post-Quantum Certificate & mTLS Support post-quantum cryptography feature?
Better Auth does not support Post-Quantum Certificate & mTLS Support post-quantum cryptography feature. No post-quantum or hybrid certificate support is documented; the library does not terminate mTLS.
Does Better Auth support Post-Quantum Stateful Hash Signatures post-quantum cryptography feature?
Better Auth does not support Post-Quantum Stateful Hash Signatures post-quantum cryptography feature. No NIST SP 800-208 stateful hash-based signature support is documented.
Compare with other providers
Note: The current data is based on provider documentation/experience and may not be 100% accurate.