better-auth

Authentication for Cloudflare Workers with D1 uses better-auth paired with either Drizzle ORM or Kysely adapters. Install dependencies, configure your D1 database, wire up the auth framework in your Workers service, and initialize session management. Note: there is no direct d1Adapter—use Drizzle or Kysely as your database layer.

Yes. Better-auth is a self-hosted TypeScript authentication framework for Cloudflare Workers that replaces Clerk or Auth.js. It includes social providers, email/password, magic links, 2FA, passkeys, organizations, and RBAC, with built-in migration guides from both platforms.

Better-auth supports social providers (Google, GitHub, Microsoft), email/password with verification, magic links, two-factor authentication, passkeys, and organization-based RBAC. It handles session management, OAuth flows, CORS configuration, and JWT token processing natively.

Yes. Better-auth provides adapters for both Drizzle ORM and Kysely with D1. Choose either based on your preference; Drizzle is recommended, but Kysely is fully supported. Both integrate directly with Cloudflare D1 databases.

Yes. Better-auth includes organization and multi-tenant support with role-based access control (RBAC) and permissions. Configure organization structures, assign roles, and enforce permissions natively within the framework.

Better-auth provides migration guides from both Auth.js and Clerk. Key differences: it's self-hosted on Cloudflare Workers, uses Drizzle or Kysely for D1, and requires manual environment configuration. Session handling and OAuth flows migrate with minimal refactoring.