api-auth-better-auth-drizzle-hono_skill

Overview

This skill documents Better Auth patterns for TypeScript apps using Hono and Drizzle ORM, covering sessions, OAuth, 2FA, passkeys, and multi-tenant organizations. It focuses on type-safe, self-hosted authentication with recommended server patterns, middleware, and operational checks to avoid common security and runtime errors.

How this skill works

The skill shows how to create a single auth instance (betterAuth) connected to a Drizzle adapter, mount the Better Auth handler on /api/auth/*, and expose typed session data to Hono routes using auth.$Infer.Session types. It also documents configuring email/password, OAuth providers, two-factor plugins, organization support, and migration steps required after adding plugins.

When to use it

• Building self-hosted authentication that avoids vendor lock-in
• Projects that need email/password, OAuth, and TOTP-based 2FA in one solution
• Multi-tenant SaaS requiring organization and team management
• TypeScript projects needing type-safe session access in Hono middleware
• Apps that store sessions in a database and require performance tuning (cookieCache, joins)

Best practices

• Mount the Better Auth handler on /api/auth/* before any middleware that depends on session
• Configure CORS before auth routes when client and server are on different origins
• Use environment variables for all secrets (clientId, clientSecret, BETTER_AUTH_SECRET) — never hardcode
• Run npx @better-auth/cli generate, then npx drizzle-kit generate and npx drizzle-kit migrate after adding plugins
• Use auth.$Infer.Session types in middleware for type-safe session and user access

Example use cases

• A React + Hono app with Drizzle-backed sessions and GitHub/Google OAuth providers
• A SaaS platform with organization invitations and role-based access using the organizations plugin
• An app requiring TOTP 2FA and password reset emails with server-side enforcement of password rules
• High-performance sites using cookieCache and experimental joins for faster session queries
• A migration from Auth.js/NextAuth to a self-hosted Better Auth setup for full data control