Authentication Overview

VibeKit uses Better Auth in packages/auth for all authentication and session handling.

How it works

1. Client requests: Forms in apps/web/modules/saas/auth call Better Auth client methods or tRPC endpoints.
2. Session storage: Sessions are persisted in the PostgreSQL UserSession table using the Prisma adapter.
3. Session cookies: Better Auth issues an HTTP-only, secure auth_session cookie to the browser.
4. Server validation: Server components and tRPC context read and validate the session cookie on each request.

// packages/auth/lib/auth.ts
export const auth = betterAuth({
  baseURL: getBaseUrl(),
  secret: process.env.BETTER_AUTH_SECRET,
  database: prismaAdapter(db, { provider: "postgresql" }),
  emailAndPassword: {
    enabled: true,
    autoSignIn: false,
    requireEmailVerification: true,
    password: {
      hash: hashPassword,
      verify: ({ hash, password }) => verifyPassword(hash, password),
    },
  },
  // ... plugins and options
});

Session types

packages/auth exports inferred TypeScript session types:

• Session: The raw session object containing expiration, IP address, and token.
• SessionUser: The active user record containing id, email, name, role, avatarUrl, and onboardingComplete.

Explore available sign-in options in Authentication Methods.

Connect external AI clients through scoped, read-only MCP access. Apply the OAuth migration before starting the updated app.