Authentication

Better Auth owns identity and session behavior. The application composes its public APIs and does not copy upstream authentication source.

auth.ts

export const auth = betterAuth({
  basePath: "/api/auth",
  emailAndPassword: { enabled: true, requireEmailVerification: true },
  plugins: [organization({ teams: { enabled: true } })],
});

Production requires a canonical HTTPS origin, an independent secret, verified email delivery, and an explicit trusted-origin list.