Overview
Modern login methods, Better Auth sessions, and server-side authorization guards.
VibeKit provides an enterprise-ready authentication system powered by Better Auth. Instead of relying on expensive third-party hosted auth widgets, your authentication runs directly inside your application with PostgreSQL session persistence, granular server authorization, and support for passwordless, credential, and OAuth sign-in.
Flexible Modern Login Methods
Choose the exact sign-in experience that fits your product and audience:
- Email and Password: Secure credential login with modern cryptographic password hashing, brute-force throttling, and automated password reset flows.
- Email One-Time Passwords (OTP): Passwordless verification codes sent directly to the user's inbox, eliminating forgotten password support tickets.
- Social OAuth Providers: One-click registration and sign-in with Google, GitHub, Discord, Apple, and other major identity providers.
- Passkeys and WebAuthn: Biometric authentication using Touch ID, Face ID, or hardware security keys for frictionless, phishing-resistant logins.
All auth methods connect to a single unified User record in your database, allowing users to link multiple login methods to the same account.
Ironclad Session Security with Better Auth
Session management in VibeKit is designed to be secure by default:
| Security Feature | Implementation | User Protection |
|---|---|---|
| Server-Side Session Storage | Sessions are stored in PostgreSQL with unique IDs. | Immediate session revocation upon password change or account compromise. |
| HttpOnly Secure Cookies | Browser cookies cannot be read or stolen by malicious client JavaScript. | Full protection against Cross-Site Scripting (XSS) session theft. |
| CSRF and PKCE Protection | Strict SameSite cookie policies and Proof Key for Code Exchange on OAuth. | Prevents Cross-Site Request Forgery and authorization code interception. |
| Rate Limiting | Automated IP and account-level throttling on login endpoints. | Defends against credential stuffing and brute-force password guessing. |
Server-Enforced Route and Data Protection
Hiding a button or navigation link in the user interface is not security. VibeKit enforces strict server-side authorization guards on every request:
- Authentication Gate: tRPC middleware verifies the session cookie and attaches the verified
Userto the request context. - Team Authorization: If an endpoint accesses team data, VibeKit checks that the user is an active member of that team before querying the database.
- Role Checks: Administrative operations verify that the user holds the
OWNERrole or platform admin privileges. - Data Scoping: Database queries automatically filter records by
userIdorteamIdto prevent cross-account data leakage.
Privacy-Preserving Account Recovery
Security best practices require that authentication endpoints never reveal whether an email address is registered. When a user requests a password reset or sign-in code, VibeKit returns identical success responses regardless of whether the account exists, protecting your customers from account enumeration attacks.
Guiding Your Agent to Protect Pages and APIs
Instruct your coding agent to protect routes and API endpoints using VibeKit's authentication helpers:
Create a new server procedure in 'packages/api/features/settings' for updating user notification preferences.
Use 'protectedProcedure' to require an active authenticated session.
Ensure the procedure updates preferences only for the currently authenticated 'ctx.user.id'.
Add a client settings form under 'apps/web/features/settings' that redirects unauthenticated visitors to '/login'.