Skip to main content
Achromatic
Live demo
General
Configuration

Authentication Configuration

Configure authentication settings, redirects, and CORS.

Open MarkdownFull AI corpusFeedback

The authentication configuration file (config/auth.config.ts) contains settings for authentication, session management, redirects, and CORS.

Configuration File

config/auth.config.ts
import { env } from '@/lib/env';
import { getBaseUrl } from '@/lib/utils';

const origins = Array.from(
  new Set(
    [
      getBaseUrl(),
      env.NEXT_PUBLIC_SITE_URL,
      env.NEXT_PUBLIC_VERCEL_URL
        ? `https://${env.NEXT_PUBLIC_VERCEL_URL}`
        : undefined,
      env.NEXT_PUBLIC_VERCEL_BRANCH_URL
        ? `https://${env.NEXT_PUBLIC_VERCEL_BRANCH_URL}`
        : undefined,
      env.NEXT_PUBLIC_VERCEL_PROJECT_PRODUCTION_URL
        ? `https://${env.NEXT_PUBLIC_VERCEL_PROJECT_PRODUCTION_URL}`
        : undefined,
      env.NEXT_PUBLIC_NODE_ENV === 'development'
        ? 'http://localhost:3000'
        : undefined
    ].filter(Boolean) as string[]
  )
);

export const authConfig = {
  redirectAfterSignIn: '/dashboard',
  redirectAfterLogout: '/',
  sessionCookieMaxAge: 60 * 60 * 24 * 30,
  verificationExpiresIn: 60 * 60 * 24 * 14,
  minimumPasswordLength: 8,
  trustedOrigins: origins,
  // Controls signup links and the starter signup page
  // This does not block Better Auth's signup endpoint
  enableSignup: true,
  enableSocialLogin: true,
  enablePasskeys: true,
  cors: {
    allowedOrigins: [...origins, /^https:\/\/.*\.vercel\.app$/],
    allowedMethods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
    allowedHeaders: [
      'Authorization',
      'Content-Type',
      'Accept',
      'Origin',
      'X-Requested-With',
      'Access-Control-Request-Method',
      'Access-Control-Request-Headers',
      'X-CSRF-Token',
      'Accept-Version',
      'Content-Length',
      'Content-MD5',
      'Date',
      'X-Api-Version',
      'cf-connecting-ip',
      'cf-ipcountry',
      'cf-ray',
      'cf-visitor',
      'x-vercel-id',
      'x-vercel-deployment-url',
      'x-vercel-proxied-for',
      'X-Forwarded-For',
      'X-Forwarded-Host',
      'X-Forwarded-Proto',
      'X-Real-IP',
      'Connection',
      'Host',
      'User-Agent',
      'Referer'
    ],
    maxAge: 86_400
  }
} satisfies AuthConfig;

Configuration Options

Redirects

  • redirectAfterSignIn: Where users are redirected after successful sign in (default: "/dashboard")
  • redirectAfterLogout: Where users are redirected after logout (default: "/")

Session Management

  • sessionCookieMaxAge: Maximum age of the session cookie in seconds (default: 30 days)
  • verificationExpiresIn: How long email verification links are valid in seconds (default: 14 days)

Password Requirements

  • minimumPasswordLength: Minimum password length required (default: 8)

Trusted Origins

  • trustedOrigins: Array of trusted origins for authentication requests
    • Automatically includes base URL, Vercel URLs, and localhost in development
    • Used for CSRF protection and secure authentication

Signup and Login

  • enableSignup: Whether the starter auth cards show signup links and the signup page opens without a valid, pending invitation (default: true)
  • enableSocialLogin: Whether the starter UI shows social login buttons (default: true)
  • enablePasskeys: Whether the passkey plugin endpoints, sign-in button and account-management card are available (default: true)

CORS Configuration

The cors object configures Cross-Origin Resource Sharing:

  • allowedOrigins: Array of allowed origins (includes trusted origins and Vercel preview URLs)
  • allowedMethods: HTTP methods allowed in CORS requests
  • allowedHeaders: HTTP headers allowed in CORS requests
  • maxAge: Maximum age for preflight requests in seconds (default: 24 hours)

Use Cases

Gate the Starter Signup Page

To hide signup links in the starter auth cards and gate the starter signup page by invitation:

config/auth.config.ts
export const authConfig = {
  // ... other config
  enableSignup: false
};

The signup page validates that the supplied invitation exists, is pending and has not expired. enableSignup is not a server-side policy for Better Auth's signup endpoint. A production invitation-only product must add server-side invitation validation and review every enabled signup path, including OAuth.

Hide Social Login Buttons

To hide the starter's OAuth buttons and connected accounts card:

config/auth.config.ts
export const authConfig = {
  // ... other config
  enableSocialLogin: false
};

This flag does not unregister the configured OAuth provider or disable Better Auth's OAuth routes. Remove the provider from lib/auth/index.ts and its credentials from the environment if you want to disable the provider itself.

Disable Passkeys

To remove both passkey UI and server endpoints:

config/auth.config.ts
export const authConfig = {
  // ... other config
  enablePasskeys: false
};

Unlike the social-login display flag, enablePasskeys conditionally registers the Better Auth passkey plugin. Existing passkey rows can remain in the database if you temporarily disable the feature.

Custom Redirects

To customize redirect paths:

config/auth.config.ts
export const authConfig = {
  // ... other config
  redirectAfterSignIn: '/dashboard',
  redirectAfterLogout: '/auth/sign-in'
};

Adjust Session Duration

To change session cookie duration:

config/auth.config.ts
export const authConfig = {
  // ... other config
  sessionCookieMaxAge: 60 * 60 * 24 * 7 // 7 days instead of 30
};

Stricter Password Requirements

To require longer passwords:

config/auth.config.ts
export const authConfig = {
  // ... other config
  minimumPasswordLength: 12 // Require 12 characters minimum
};

Type Definitions

The configuration uses TypeScript types for type safety:

config/auth.config.ts
export type CorsConfig = {
  allowedOrigins: (string | RegExp)[];
  allowedMethods: string[];
  allowedHeaders: string[];
  maxAge: number;
};

export type AuthConfig = {
  redirectAfterSignIn: string;
  redirectAfterLogout: string;
  sessionCookieMaxAge: number;
  verificationExpiresIn: number;
  minimumPasswordLength: number;
  trustedOrigins: string[];
  enableSignup: boolean;
  enableSocialLogin: boolean;
  cors: CorsConfig;
};

Using the Configuration

Import and use the configuration in your code:

lib/auth/redirects.ts
import { authConfig } from '@/config/auth.config';

export function getSignInRedirect() {
  return authConfig.redirectAfterSignIn;
}
lib/auth/validation.ts
import { authConfig } from '@/config/auth.config';

export function validatePassword(password: string) {
  if (password.length < authConfig.minimumPasswordLength) {
    throw new Error(
      `Password must be at least ${authConfig.minimumPasswordLength} characters`
    );
  }
}