Purpose
The Better Auth factory configures sessions, Organizations, admin, passkeys, two-factor, Expo and MCP OAuth. Request scope shares the authorized database/auth instance through one HTTP invocation. Outcome modules normalize sign-in and challenge results. client-ip is the one rule for the client address used by rate limits and audit: cf-connecting-ip on Workers, otherwise TRUSTED_PROXY_HEADER/TRUSTED_PROXIES when a Node deploy configures them, else the socket address. An invalid header name or proxy count is logged and ignored: the socket address is used, never a guessed hop (runtime switches).
Public exports
| Subpath | Target |
|---|---|
. | ./src/index.ts |
./admin-audit | ./src/admin-audit.ts |
./client-ip | ./src/client-ip.ts |
./errors | ./src/errors.ts |
./request-scope | ./src/request-scope.ts |
./server-session | ./src/server-session.ts |
./session-outcome | ./src/session-outcome.ts |
./two-factor-outcome | ./src/two-factor-outcome.ts |
These paths come from packages/auth/package.json. A . entry is the package root. Conditional targets distinguish platform or type resolution; consumers should import the subpath, not its source file.
How to extend
Change the factory for server behavior and the outcome modules for shared interpretations. Test revoked sessions, bans, impersonation and Organization membership. Do not export client constants through a server entry.
Read the identity and request scope guide for the full flow.