better-auth

Implement better-auth authentication for Cloudflare Workers with D1.

Updated Jan 18, 2026
One-click install
npx skills add https://github.com/csim-sg/yacc --skill better-auth-csim-sg
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: better-auth
Source: https://github.com/csim-sg/yacc/tree/main/.opencode/skills/better-auth
Command: npx skills add https://github.com/csim-sg/yacc --skill better-auth-csim-sg

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill provides a complete, self-hosted authentication and authorization solution for TypeScript projects, focusing on Cloudflare Workers with D1 support, and offering a vendor-independent alternative to Clerk or Auth.js.

Core Features & Use Cases

  • Production-ready authentication: Includes email/password, magic links, 2FA, passkeys, and social providers (Google, GitHub, Microsoft, Apple).
  • Cloudflare D1 integration: First-class adapter support for serverless environments and multi-tenant RBAC features.
  • Use Case: Build a secure SaaS app with orgs, teams, and granular access control while keeping data self-hosted.

Quick Start

Use the skill to scaffold a Cloudflare Worker with D1-backed auth, configure OAuth providers, and integrate with a frontend via client hooks. This will guide you through setting up the database, secret management, and sample routes.

Frequently Asked Questions about better-auth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up authentication for Cloudflare Workers using D1?

You set up authentication for Cloudflare Workers with D1 by using better-auth and its first-class D1 adapter. This skill guides you through database migrations, secret management, and configuring OAuth providers within a serverless environment.

Does better-auth support multi-tenant RBAC and organizations on D1?

Multi-tenant RBAC and organizations are fully supported on Cloudflare D1. You can build secure SaaS applications with teams and granular access control while keeping your authentication data completely self-hosted.

What is the best self-hosted alternative to Clerk for TypeScript SaaS apps?

A robust self-hosted alternative to Clerk for TypeScript apps is better-auth paired with Cloudflare D1. It provides vendor-independent authentication features including 2FA, passkeys, social providers, and multi-tenant RBAC without external vendor lock-in.

Can I use passkeys and 2FA with a self-hosted authentication system?

Passkeys and 2FA are fully supported in a self-hosted authentication system using better-auth. It enables these advanced security mechanisms alongside social OAuth providers like Google, GitHub, Microsoft, and Apple for robust identity verification.

How do I integrate Next.js API routes with a Cloudflare D1 auth backend?

Next.js API routes integrate with a Cloudflare D1 auth backend through better-auth patterns covering server and client boundaries. This includes React client hooks and middleware protection to maintain secure session management across your stack.

How do I protect routes with middleware when using self-hosted TS auth?

Route protection with middleware in a self-hosted TS auth setup uses better-auth integration patterns. It provides guided configurations for React client integration and middleware enforcement to secure application routes based on active session validity.