better-auth-best-practices

Better Auth's rate limiter defaults to enabled when NODE_ENV is production, but Vercel sets NODE_ENV=production on every deployment including previews. Parallel Playwright workers burst past the sign-in rate cap. Fix by scoping on VERCEL_ENV === "production" instead.

Never return ctx.session directly, since it leaks Better Auth's internal session shape across package boundaries and breaks UI type inference on upgrades. Define an app-owned SessionDTO in the router and narrow the session before returning it.

No. Cookie cache is a read-through cache that only stores built-in session fields. Any custom fields added via session.additionalFields are re-fetched from the database or secondaryStorage on every request, which is intended behavior.

Adding or removing a plugin changes the expected database schema, but the app boots fine with a stale schema and only fails on the first plugin-specific write. Re-run npx @better-auth/cli generate or migrate after every plugin change.

Use the ORM model name, not the underlying table name. If your Prisma or Drizzle model User maps to table users, set modelName to "user". Passing the table name can fail silently in some adapter paths.

Yes. A -beta.N pin for better-auth or @better-auth/* packages in a lockfile is a supply-chain risk unless it is a deliberate mid-migration pin with a tracking note. Beta APIs change without stable compatibility guarantees, so flag beta pins in review.