Overview
Learn more about authentication in the starter kit.
Authentication is a core part of any SaaS application. The Pro Next.js Drizzle starter kit uses Better Auth to handle authentication and provides all the necessary UI for the authentication flow.
Why choose Better Auth? Better Auth is a modern, type-safe authentication solution built for Next.js. It provides a simple API, excellent TypeScript support, and works seamlessly with server components and server actions.
The starter kit comes with pre-configured providers, helper methods and extensions.
Included authentication flows
- Email and password registration with email verification
- Password reset and email-address changes
- Passwordless passkey sign-in with biometric or device-PIN verification
- Google OAuth and trusted account linking
- Database-backed sessions with device revocation
- TOTP two-factor authentication with failed-attempt lockout
- Organization invitations and active-organization sessions
- Administrator bans and impersonation
Two-factor authentication
Users with a credential account can enroll an authenticator app from
Dashboard → Settings → Security. Enrollment requires the current password,
then a valid six-digit TOTP code. After enrollment, password sign-in redirects
to /auth/verify until the TOTP challenge succeeds.
Better Auth stores TOTP secrets and backup codes in the two_factor table. The
current schema also tracks whether setup was verified, failed verification
attempts and the lockout expiry. Apply committed database migrations when
upgrading Better Auth so these security fields exist before deploying the new
application code.
Current two-factor boundaries
The included UI verifies TOTP codes for password sign-in. It does not display recovery codes during enrollment or accept a recovery code on the verification page, even though Better Auth stores backup-code data. Google OAuth and other passwordless sign-in methods are not automatically sent through the TOTP challenge either. Add and test those flows before presenting backup-code recovery or universal 2FA enforcement as supported product behavior.
Passkeys
Users can register, rename and remove passkeys from Dashboard → Settings → Security, then choose Sign in with passkey on the authentication page. The included WebAuthn policy requires user verification through a biometric or device PIN before Better Auth creates a session.
A verified passkey completes the passwordless sign-in flow without an additional TOTP challenge. Password sign-in still follows the user's configured two-factor flow. Read the passkey guide for configuration, migrations, security boundaries and testing guidance.
Keep security state server-controlled
Fields such as twoFactorEnabled, banned,
banReason and onboardingComplete are marked with
input: false. Do not expose them through the generic client user
update API. Change them through an authenticated server procedure or the
corresponding Better Auth endpoint.