better-auth

Configure self-hosted authentication for Cloudflare Workers with D1.

1|Updated Jan 15, 2026
One-click install
npx skills add https://github.com/Pallepadehat/agentkit --skill better-auth-pallepadehat
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: better-auth
Source: https://github.com/Pallepadehat/agentkit/tree/main/.agent/skills/better-auth
Command: npx skills add https://github.com/Pallepadehat/agentkit --skill better-auth-pallepadehat

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires better-auth, drizzle-orm, drizzle-kit, @cloudflare/workers-types, hono, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

Self-hosted authentication for Cloudflare Workers with D1, enabling full control over security, data, and multi-tenant SaaS patterns without vendor lock-in.

Core Features & Use Cases

  • Cloudflare Workers + D1 support using Drizzle ORM or Kysely adapters
  • 15+ plugins including 2FA, RBAC, organizations, migration guides, and social providers
  • Framework integrations (TanStack Start, Expo) and React client patterns
  • Migration guidance from Clerk and Auth.js, plus comprehensive API reference
  • Database setup with D1 or PostgreSQL schemas and 80+ auto-generated endpoints

Quick Start

Install dependencies, wire up Drizzle/Kysely for D1, configure environment keys (BETTER_AUTH_SECRET and BETTER_AUTH_URL), and run your Cloudflare Worker to expose /api/auth/* endpoints.

Frequently Asked Questions about better-auth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up self-hosted authentication for Cloudflare Workers with D1?

Self-hosted authentication for Cloudflare Workers uses better-auth with D1, Drizzle ORM or Kysely, and nodejs_compat compatibility flags. Install dependencies, configure Drizzle or Kysely for D1, set BETTER_AUTH_SECRET and BETTER_AUTH_URL environment variables, then deploy to expose 80+ auto-generated /api/auth/* endpoints.

Can I migrate from Clerk or Auth.js to a self-hosted solution on Cloudflare?

Yes, better-auth provides migration guidance from Clerk and Auth.js to self-hosted authentication on Cloudflare Workers with D1. The Skill includes comprehensive migration patterns and maintains full control over security and user data without vendor lock-in.

What authentication features does better-auth support for multi-tenant SaaS?

Better-auth supports 15+ plugins including RBAC, organizations, 2FA, passkeys, and OAuth providers. These plugins enable multi-tenant SaaS patterns, role-based access control, and advanced security features within a single self-hosted authentication system on Cloudflare Workers.

Does better-auth work with Drizzle ORM and Kysely for D1 databases?

Better-auth requires Drizzle ORM or Kysely adapters to work with Cloudflare D1. Both ORMs are fully supported, allowing you to choose your preferred D1 query builder while running on Cloudflare Workers with nodejs_compat enabled.

What are the deployment requirements for running better-auth on Cloudflare Workers?

Better-auth runs on Cloudflare Workers with D1 and requires nodejs_compat in compatibility flags, Drizzle or Kysely ORM configured for D1, environment variables (BETTER_AUTH_SECRET, BETTER_AUTH_URL), and optionally integrates with TanStack Start and Expo for client-side authentication.

Can I use OAuth providers and social authentication with better-auth?

Better-auth includes plugins for OAuth providers and social authentication as part of its 15+ plugin ecosystem. Configure social providers alongside core features like 2FA and passkeys to build comprehensive authentication on Cloudflare Workers with full data control.