---
title: Better Auth API
description: Generated public TypeScript reference for @relkit/better-auth.
search:
  exclude: true
sidebar:
  icon: braces
---

{/* Generated by apps/docs/scripts/generate.ts. Do not edit. */}

## Common APIs

- [defineBetterAuthService](/docs/api/better-auth#definebetterauthservice)

For configuration and examples, read [auth](/docs/modules/auth), [better auth](/docs/modules/auth/better-auth), [sessions](/docs/modules/auth/sessions).

For a complete workflow, follow [email password sign in](/guides/auth/email-password-sign-in).

## Frontend usage

[Sign in from the browser](/docs/modules/auth/clients) shows the client side of this capability.

## Public imports

- `@relkit/better-auth` — 7 exports
- `@relkit/better-auth/react` — 3 exports
- `@relkit/better-auth/drizzle` — 19 exports

## All exported APIs

Names link to their complete contracts. Re-exports share their original contract; legacy exports keep their separate identity. Examples link to the API's inline sample, a maintained repository usage, or the shared module walkthrough.

| API                                                                                                        | Kind  | Import from                                          | Example                                                                                                                |
| ---------------------------------------------------------------------------------------------------------- | ----- | ---------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| [activateBetterAuthService](/docs/api/better-auth#activatebetterauthservice)                               | Value | `@relkit/better-auth/drizzle`                        | [API example](/docs/api/better-auth#activatebetterauthservice)                                                         |
| [AuthConfiguration](/docs/api/better-auth#authconfiguration-interface)                                     | Type  | `@relkit/better-auth/drizzle`                        | [Source example](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/tests/auth/auth-test-layer.ts#L19)   |
| [AuthFactory](/docs/api/better-auth#authfactory-class)                                                     | Value | `@relkit/better-auth/drizzle`                        | [Source example](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/tests/auth/auth-test-layer.ts#L23)   |
| [AuthFactoryInterface](/docs/api/better-auth#authfactoryinterface-interface)                               | Type  | `@relkit/better-auth/drizzle`                        | [Module example](/docs/modules/auth)                                                                                   |
| [authFactoryLiveLayer](/docs/api/better-auth#authfactorylivelayer)                                         | Value | `@relkit/better-auth/drizzle`                        | [API example](/docs/api/better-auth#authfactorylivelayer)                                                              |
| [AuthFailure](/docs/api/better-auth#authfailure-class)                                                     | Value | `@relkit/better-auth/drizzle`                        | [Source example](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/tests/auth/auth-test.types.ts#L13)   |
| [authLiveLayer](/docs/api/better-auth#authlivelayer)                                                       | Value | `@relkit/better-auth/drizzle`                        | [Source example](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/tests/auth/examples.ts#L39)          |
| [AuthService](/docs/api/better-auth#authservice-class)                                                     | Value | `@relkit/better-auth/drizzle`                        | [Source example](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/tests/auth/acquisition.test.ts#L114) |
| [AuthServiceInterface](/docs/api/better-auth#authserviceinterface-interface)                               | Type  | `@relkit/better-auth/drizzle`                        | [Module example](/docs/modules/auth)                                                                                   |
| [authServiceLayer](/docs/api/better-auth#authservicelayer)                                                 | Value | `@relkit/better-auth/drizzle`                        | [API example](/docs/api/better-auth#authservicelayer)                                                                  |
| [BETTER_AUTH_HANDLER](/docs/api/better-auth#better_auth_handler-2)                                         | Value | `@relkit/better-auth`, `@relkit/better-auth/drizzle` | [Source example](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/tests/service.test.ts#L31)           |
| [BetterAuthActivationOptions](/docs/api/better-auth#betterauthactivationoptions-interface)                 | Type  | `@relkit/better-auth/drizzle`                        | [Module example](/docs/modules/auth)                                                                                   |
| [BetterAuthClientLike](/docs/api/better-auth#betterauthclientlike-interface)                               | Type  | `@relkit/better-auth/react`                          | [Module example](/docs/modules/auth)                                                                                   |
| [BetterAuthHandler](/docs/api/better-auth#betterauthhandler-type-alias)                                    | Type  | `@relkit/better-auth`, `@relkit/better-auth/drizzle` | [Module example](/docs/modules/auth)                                                                                   |
| [BetterAuthRegistration](/docs/api/better-auth#betterauthregistration-interface)                           | Type  | `@relkit/better-auth`, `@relkit/better-auth/drizzle` | [Module example](/docs/modules/auth)                                                                                   |
| [BetterAuthRelkitClientProvider](/docs/api/better-auth#betterauthrelkitclientprovider)                     | Value | `@relkit/better-auth/react`                          | [API example](/docs/api/better-auth#betterauthrelkitclientprovider)                                                    |
| [BetterAuthRelkitClientProviderProps](/docs/api/better-auth#betterauthrelkitclientproviderprops-interface) | Type  | `@relkit/better-auth/react`                          | [Module example](/docs/modules/auth)                                                                                   |
| [BetterAuthServiceDescriptor](/docs/api/better-auth#betterauthservicedescriptor-interface)                 | Type  | `@relkit/better-auth`, `@relkit/better-auth/drizzle` | [Module example](/docs/modules/auth)                                                                                   |
| [BetterAuthServiceOptions](/docs/api/better-auth#betterauthserviceoptions-type-alias-1)                    | Type  | `@relkit/better-auth`                                | [Module example](/docs/modules/auth)                                                                                   |
| [BetterAuthServiceOptions](/docs/api/better-auth#betterauthserviceoptions-type-alias)                      | Type  | `@relkit/better-auth/drizzle`                        | [Module example](/docs/modules/auth)                                                                                   |
| [defineBetterAuthService](/docs/api/better-auth#definebetterauthservice-1)                                 | Value | `@relkit/better-auth`, `@relkit/better-auth/drizzle` | [API example](/docs/api/better-auth#definebetterauthservice-1)                                                         |
| [generateBetterAuthOpenApi](/docs/api/better-auth#generatebetterauthopenapi-1)                             | Value | `@relkit/better-auth/drizzle`                        | [API example](/docs/api/better-auth#generatebetterauthopenapi-1)                                                       |
| [InferBetterAuthSession](/docs/api/better-auth#inferbetterauthsession-type-alias)                          | Type  | `@relkit/better-auth`, `@relkit/better-auth/drizzle` | [Module example](/docs/modules/auth)                                                                                   |

## `activation.ts`

Binds lazy auth declarations to shared or isolated managed native owners.
Failed shared acquisition is evicted; successful owners borrow the database lifecycle and preserve native settlement.

### activateBetterAuthService

Binds native auth to an acquired database and its declared ALL route.

**Example**

```ts
import {
  activateBetterAuthService,
  defineBetterAuthService,
  type AuthConfiguration,
} from "@relkit/better-auth/drizzle";
async function handleNativeAuth(database: AuthConfiguration["database"]): Promise<Response> {
  const service = defineBetterAuthService({ baseURL: "http://localhost" });
  const auth = await activateBetterAuthService(service, database, "/api/auth", { isolated: true });
  return auth.handler(new Request("http://localhost/api/auth/get-session"));
}
// The application retains database ownership until admitted work completes.
```

**Signature**

```ts
declare const activateBetterAuthService: <Options extends BetterAuthServiceOptions>(
  service: BetterAuthServiceDescriptor<Options>,
  database: AuthDatabase,
  basePath: string,
  options?: BetterAuthActivationOptions,
) => Promise<Auth<any>>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/activation.ts#L42)

### authNativeAdapter

**Signature**

```ts
declare const authNativeAdapter: (
  owner: BetterAuthRuntime<BetterAuthServiceOptions>["activation"] & {},
  native: Auth<any>,
) => Auth<any>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/activation.ts#L19)

### runAuthPromise

**Signature**

```ts
declare const runAuthPromise: <A, E, R, ER>(
  runtime: ManagedRuntime.ManagedRuntime<R, ER>,
  effect: Effect.Effect<A, E, R>,
  options?: Effect.RunOptions,
  operation?: string,
) => Promise<A>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/activation.ts#L18)

## `activation.types.ts`

Acquisition policy for authentication bound to an independently owned database.

### BetterAuthActivationOptions (interface)

Acquisition policy for authentication bound to an independently owned database.

**Signature**

```ts
export interface BetterAuthActivationOptions {
  /** Creates native auth without replacing the descriptor's shared handler target. */
  readonly isolated?: boolean;
}
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/activation.types.ts#L2)

## `auth-database.ts`

Borrows database admission and resolves its existing native declaration brand.

### databaseServiceOf

Reads the established native brand; auth never acquires another database owner.

**Signature**

```ts
declare const databaseServiceOf: (
  activation: AuthDatabase,
) => Parameters<typeof drizzleRuntimeOf>[0];
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/auth-database.ts#L12)

### withAuthWork

Keeps SQLite serialization and owner drain admission around the complete SDK call.

**Signature**

```ts
declare const withAuthWork: <A, E, R>(
  database: AuthDatabase,
  effect: Effect.Effect<A, E, R>,
) => Effect.Effect<A, DrizzleFailure | E, R>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/auth-database.ts#L7)

## `auth-native-adapter.ts`

Projects native SDK callables through the existing admitted auth service.

## `auth-run.ts`

Preserves auth failures, mixed causes and native leases at the Promise boundary.

## `auth.errors.ts`

### AuthFailure (class)

Typed authentication boundary failure retaining the original SDK exception.

**Signature**

```ts
declare class AuthFailure
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/auth.errors.ts#L4)

## `auth.factory.ts`

Constructs selected native Better Auth after metadata preflight at the SDK boundary.
Factory failures retain their native cause and redact secret-bearing arguments from operation telemetry.

### AuthFactory (class)

Replaceable native SDK factory; auth service acquisition owns async initialization.

**See**

- `authFactoryLiveLayer` for composition with the owned auth service.

**Signature**

```ts
declare class AuthFactory
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/auth.factory.ts#L20)

### authFactoryLiveLayer

Production SDK construction layer; acquiring the factory does not create auth.

**Example**

```ts
import { Layer } from "effect";
import {
  authFactoryLiveLayer,
  authServiceLayer,
  type AuthConfiguration,
} from "@relkit/better-auth/drizzle";
function createAuthLayer(configuration: AuthConfiguration) {
  return authServiceLayer(configuration).pipe(Layer.provide(authFactoryLiveLayer));
}
```

**Signature**

```ts
declare const authFactoryLiveLayer: Layer.Layer<AuthFactory, never, never>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/auth.factory.ts#L35)

### makeAuthFactory

Gives substituted factory implementations the same observable operation contract.

**See**

- `authFactoryLiveLayer` for factory provisioning at service acquisition.

**Signature**

```ts
declare const makeAuthFactory: (create: AuthFactoryInterface["create"]) => AuthFactoryInterface;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/auth.factory.ts#L62)

## `auth.schemas.ts`

### AuthBasePath

Auth route prefixes exclude trailing slashes and dynamic route markers.

**Signature**

```ts
declare const AuthBasePath: Schema.String;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/auth.schemas.ts#L4)

## `auth.service.ts`

Owns admitted native authentication acquisition, handler calls and API dispatch.
Database leases cover uncancellable SDK settlement; the database owner retains release authority.

### AuthService (class)

Native auth service; each method admits DB work and retains SDK completion.

**See**

- `authServiceLayer` for ownership and a checked composition example.

**Signature**

```ts
declare class AuthService
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/auth.service.ts#L23)

### authLiveLayer

Builds the production authentication service with the native Better Auth factory.

**See**

- `authServiceLayer` for the checked execution and ownership example.

**Signature**

```ts
declare const authLiveLayer: (
  configuration: AuthConfiguration,
) => Layer.Layer<AuthService, AuthFailure | DrizzleFailure, never>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/auth.service.ts#L146)

### authServiceLayer

Acquires authentication against a borrowed Drizzle owner using a supplied factory.

**Example**

```ts
import { Effect } from "effect";
import { AuthService, authLiveLayer, type AuthConfiguration } from "@relkit/better-auth/drizzle";
async function handleAuth(configuration: AuthConfiguration): Promise<Response> {
  const program = Effect.flatMap(AuthService, (auth) =>
    auth.handler(new Request("http://localhost/api/auth/session")),
  );
  return Effect.runPromise(program.pipe(Effect.provide(authLiveLayer(configuration))));
}
```

**Signature**

```ts
declare const authServiceLayer: (
  configuration: AuthConfiguration,
) => Layer.Layer<AuthService, AuthFailure | DrizzleFailure, AuthFactory>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/auth.service.ts#L43)

## `auth.types.ts`

Describes the selected Drizzle authentication bridge using actual native SDK contracts.
Portable lazy declarations remain in declaration.types so backend root consumers avoid this adapter closure.

### AuthConfiguration (interface)

Runtime dependencies captured once when constructing a native auth service.

**Signature**

```ts
export interface AuthConfiguration {
  readonly options: BetterAuthServiceOptions;
  readonly database: AuthDatabase;
  readonly basePath: string;
}
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/auth.types.ts#L31)

### AuthDatabase (type alias)

Borrowed database; its Drizzle owner remains solely responsible for disposal.

**Signature**

```ts
type AuthDatabase = DrizzleActivation<DrizzleServiceDescriptor<any, any, any, any>>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/auth.types.ts#L28)

### AuthFactoryInterface (interface)

Replaceable SDK construction contract; expected SDK failures retain their cause.

**Signature**

```ts
export interface AuthFactoryInterface {
  /**
   * Constructs native auth during service acquisition.
   * @param options - Native options including the owner-supplied database adapter.
   * @returns Lazy factory effect retaining expected SDK failures as AuthFailure.
   */
  readonly create: (options: BetterAuthOptions) => Effect.Effect<Auth<any>, AuthFailure>;
}
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/auth.types.ts#L38)

### AuthServiceInterface (interface)

Effect-native operations sharing one native SDK instance and database admission.

**Signature**

```ts
export interface AuthServiceInterface {
  /**
   * Executes native routing while holding borrowed database admission.
   * @param request - Unmodified native Request, including its cancellation signal.
   * @returns Lazy response effect; SDK failures retain their original cause.
   */
  readonly handler: (request: Request) => Effect.Effect<Response, AuthFailure | DrizzleFailure>;

  /**
   * Executes a native endpoint with its original arguments and callable metadata.
   * @param method - Native API property; diagnostics normalize it to bounded labels.
   * @param args - Native arguments passed without inspecting sensitive payloads.
   * @returns Lazy opaque native result, with admission and SDK typed failures.
   */
  readonly api: (
    method: string,
    args: readonly unknown[],
  ) => Effect.Effect<unknown, AuthFailure | DrizzleFailure>;
}
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/auth.types.ts#L48)

### BetterAuthHandler

**Signature**

```ts
declare const BetterAuthHandler: BetterAuthHandler<Session>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/auth.types.ts#L16)

### BetterAuthRegistration

**Signature**

```ts
declare const BetterAuthRegistration: BetterAuthRegistration;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/auth.types.ts#L17)

### BetterAuthRuntime (interface)

Server-only declaration state: the managed owner, rather than a mutable Promise.

**Signature**

```ts
export interface BetterAuthRuntime<Options extends BetterAuthServiceOptions> {
  readonly options: Options;
  activation: ManagedRuntime.ManagedRuntime<AuthService, AuthFailure | DrizzleFailure> | undefined;
  handle: ((request: Request) => Promise<Response>) | undefined;
}
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/auth.types.ts#L72)

### BetterAuthServiceDescriptor

**Signature**

```ts
declare const BetterAuthServiceDescriptor: BetterAuthServiceDescriptor<Options>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/auth.types.ts#L18)

### BetterAuthServiceOptions (type alias)

Native options; RELKIT supplies database and the route-derived base path.

**Signature**

```ts
type BetterAuthServiceOptions = DeclarationOptions & {
  readonly drizzle?: Omit<DrizzleAdapterConfig, "provider">;
};
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/auth.types.ts#L23)

### InferBetterAuthSession

**Signature**

```ts
declare const InferBetterAuthSession: InferBetterAuthSession<Handler>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/auth.types.ts#L19)

## `declaration.types.ts`

Lazy authentication declarations independent of a database adapter or browser.

### BetterAuthDeclarationRuntime (interface)

Database-independent state populated by the explicitly selected server bridge.

**Signature**

```ts
export interface BetterAuthDeclarationRuntime<Options extends BetterAuthServiceOptions> {
  readonly options: Options;
  activation: object | undefined;
  handle: ((request: Request) => Promise<Response>) | undefined;
}
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/declaration.types.ts#L38)

### BetterAuthHandler (type alias)

Native route handler retaining inferred session and user types.

**Signature**

```ts
type BetterAuthHandler<Session = unknown> = RawHttpHandler & {
  readonly [BETTER_AUTH_HANDLER]: BetterAuthRegistration;
  readonly __session?: Session;
};
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/declaration.types.ts#L20)

### BetterAuthRegistration (interface)

Frozen registration used by route discovery without acquiring native auth.

**Signature**

```ts
export interface BetterAuthRegistration {
  readonly kind: "better-auth";
  readonly service: BetterAuthServiceDescriptor<any>;
}
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/declaration.types.ts#L14)

### BetterAuthServiceDescriptor (interface)

Lazy authoring declaration whose identity survives isolated activation.

**Signature**

```ts
export interface BetterAuthServiceDescriptor<
  Options extends BetterAuthServiceOptions,
> extends ReturnType<typeof createDescriptorBase<"service", string>> {
  readonly capability: { readonly kind: "better-auth" };
  readonly handler: BetterAuthHandler<Auth<Options>["$Infer"]["Session"]>;
}
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/declaration.types.ts#L30)

### BetterAuthServiceOptions (type alias)

Native options; activation supplies the database and route-derived base path.

**Signature**

```ts
type BetterAuthServiceOptions = Omit<BetterAuthOptions, "database" | "basePath"> & {
  readonly database?: never;
  readonly basePath?: never;
};
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/declaration.types.ts#L8)

### InferBetterAuthSession (type alias)

Projects the session inferred by a lazy authentication handler.

**Signature**

```ts
type InferBetterAuthSession<Handler> =
  Handler extends BetterAuthHandler<infer Session> ? Session : never;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/declaration.types.ts#L26)

## `dependencies.ts`

Checks selected native authentication requirements without evaluating the SDK.

### checkNativeAuthDependencies

Resolves peers from this installed adapter, independently of the invoking CLI cache.

**Signature**

```ts
declare const checkNativeAuthDependencies: () => Effect.Effect<void, AuthFailure, never>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/dependencies.ts#L11)

## `drizzle.ts`

Native Better Auth borrowing the selected Drizzle owner's lifetime and admission.

### AuthConfiguration

**Signature**

```ts
declare const AuthConfiguration: AuthConfiguration;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/drizzle.ts#L15)

### AuthFactory

**Signature**

```ts
declare const AuthFactory: typeof AuthFactory;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/drizzle.ts#L6)

### AuthFactoryInterface

**Signature**

```ts
declare const AuthFactoryInterface: AuthFactoryInterface;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/drizzle.ts#L17)

### AuthFailure

**Signature**

```ts
declare const AuthFailure: typeof AuthFailure;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/drizzle.ts#L5)

### AuthService

**Signature**

```ts
declare const AuthService: typeof AuthService;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/drizzle.ts#L7)

### AuthServiceInterface

**Signature**

```ts
declare const AuthServiceInterface: AuthServiceInterface;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/drizzle.ts#L16)

### BETTER_AUTH_HANDLER

**Signature**

```ts
declare const BETTER_AUTH_HANDLER: unique symbol;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/drizzle.ts#L2)

### BetterAuthActivationOptions

**Signature**

```ts
declare const BetterAuthActivationOptions: BetterAuthActivationOptions;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/drizzle.ts#L8)

### BetterAuthHandler

**Signature**

```ts
declare const BetterAuthHandler: BetterAuthHandler<Session>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/drizzle.ts#L12)

### BetterAuthRegistration

**Signature**

```ts
declare const BetterAuthRegistration: BetterAuthRegistration;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/drizzle.ts#L11)

### BetterAuthServiceDescriptor

**Signature**

```ts
declare const BetterAuthServiceDescriptor: BetterAuthServiceDescriptor<Options>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/drizzle.ts#L14)

### BetterAuthServiceOptions

**Signature**

```ts
declare const BetterAuthServiceOptions: BetterAuthServiceOptions;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/drizzle.ts#L10)

### InferBetterAuthSession

**Signature**

```ts
declare const InferBetterAuthSession: InferBetterAuthSession<Handler>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/drizzle.ts#L13)

### activateBetterAuthService

**Signature**

```ts
declare const activateBetterAuthService: <Options extends BetterAuthServiceOptions>(
  service: BetterAuthServiceDescriptor<Options>,
  database: AuthDatabase,
  basePath: string,
  options?: BetterAuthActivationOptions,
) => Promise<Auth<any>>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/drizzle.ts#L3)

### authFactoryLiveLayer

**Signature**

```ts
declare const authFactoryLiveLayer: Layer<AuthFactory, never, never>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/drizzle.ts#L6)

### authLiveLayer

**Signature**

```ts
declare const authLiveLayer: (
  configuration: AuthConfiguration,
) => Layer<AuthService, AuthFailure | DrizzleFailure, never>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/drizzle.ts#L7)

### authServiceLayer

**Signature**

```ts
declare const authServiceLayer: (
  configuration: AuthConfiguration,
) => Layer<AuthService, AuthFailure | DrizzleFailure, AuthFactory>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/drizzle.ts#L7)

### defineBetterAuthService

**Signature**

```ts
declare const defineBetterAuthService: <const Options extends BetterAuthServiceOptions>(
  options: Options,
) => BetterAuthServiceDescriptor<Options>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/drizzle.ts#L2)

#### Backend and frontend example

**Backend** — these maintained files define the operation used by the frontend below.

```ts title="examples/auth-drizzle/src/services/auth/service.ts"
/** Configures email/password Better Auth against the sole database, borrowing URL and secret from server configuration. */
import { defineBetterAuthService } from "@relkit/better-auth";

export default defineBetterAuthService({
  baseURL: process.env.BETTER_AUTH_URL ?? "http://127.0.0.1:3000",
  // Better Auth reads BETTER_AUTH_SECRET from the server process environment.
  emailAndPassword: { enabled: true },
});
```

```ts title="examples/auth-drizzle/src/routes/api/auth/[[...auth]]/route.ts"
/** Mounts native Better Auth once for all methods and protects the declared account, order and MCP paths. */
import { defineRoute } from "@relkit/app/routes";
import auth from "@app/services/auth/service.js";

export const ALL = defineRoute({
  handler: auth.handler,
  auth: { protected: ["/account/*", "/orders/*", "/mcp"] },
});
```

**Frontend**

Once the service and `/api/auth` mount are running, use Better Auth's browser client for sign-in.
First complete the [frontend auth installation](/docs/modules/auth/clients#create-a-browser-auth-client):

```ts title="src/auth-client.ts — frontend"
import { createAuthClient } from "better-auth/client";

// Browser code: use the public backend origin, never the server secret or service.
export const authClient = createAuthClient({
  baseURL: "http://127.0.0.1:3000",
  basePath: "/api/auth",
  fetchOptions: { credentials: "include" },
});

export async function signIn(email: string, password: string) {
  const { data, error } = await authClient.signIn.email({ email, password });
  if (error !== null) throw new Error(error.message ?? "Sign-in failed");
  return data;
}
```

`emailAndPassword` on the service enables this `signIn.email` operation. Keep the public URL and
mount aligned with your backend, allow the browser to manage session cookies, and handle rejected
requests in the calling UI. These native auth endpoints are not RELKIT-generated RPC operations.
Never import the server service, database, or secret into the browser.

For application route hooks after sign-in, use
[`BetterAuthRelkitClientProvider`](/docs/api/better-auth#betterauthrelkitclientprovider) as shown in
[React authentication](/docs/modules/client/authentication). Follow the
[sign-in guide](/guides/auth/email-password-sign-in) for the complete flow.

### generateBetterAuthOpenApi

**Signature**

```ts
declare const generateBetterAuthOpenApi: (
  auth: Pick<Auth, "$context">,
  instrumentation?: Context<never>,
) => Promise<JsonValue>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/drizzle.ts#L4)

## `index.ts`

Lazy authentication authoring; select /drizzle for native database activation. @packageDocumentation

### defineBetterAuthService

Defines lazy authentication using the application's Drizzle database.

**Throws**

TypeError When options is not an object or specifies database/basePath.

**Example**

```ts
import { defineBetterAuthService } from "@relkit/better-auth";
const auth = defineBetterAuthService({
  baseURL: "http://127.0.0.1:3000",
  emailAndPassword: { enabled: true },
});
const handler = auth.handler;
```

**Signature**

```ts
declare const defineBetterAuthService: <const Options extends BetterAuthServiceOptions>(
  options: Options,
) => BetterAuthServiceDescriptor<Options>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/index.ts#L43)

Since v0.0.5

#### Backend and frontend example

**Backend** — these maintained files define the operation used by the frontend below.

```ts title="examples/auth-drizzle/src/services/auth/service.ts"
/** Configures email/password Better Auth against the sole database, borrowing URL and secret from server configuration. */
import { defineBetterAuthService } from "@relkit/better-auth";

export default defineBetterAuthService({
  baseURL: process.env.BETTER_AUTH_URL ?? "http://127.0.0.1:3000",
  // Better Auth reads BETTER_AUTH_SECRET from the server process environment.
  emailAndPassword: { enabled: true },
});
```

```ts title="examples/auth-drizzle/src/routes/api/auth/[[...auth]]/route.ts"
/** Mounts native Better Auth once for all methods and protects the declared account, order and MCP paths. */
import { defineRoute } from "@relkit/app/routes";
import auth from "@app/services/auth/service.js";

export const ALL = defineRoute({
  handler: auth.handler,
  auth: { protected: ["/account/*", "/orders/*", "/mcp"] },
});
```

**Frontend**

Once the service and `/api/auth` mount are running, use Better Auth's browser client for sign-in.
First complete the [frontend auth installation](/docs/modules/auth/clients#create-a-browser-auth-client):

```ts title="src/auth-client.ts — frontend"
import { createAuthClient } from "better-auth/client";

// Browser code: use the public backend origin, never the server secret or service.
export const authClient = createAuthClient({
  baseURL: "http://127.0.0.1:3000",
  basePath: "/api/auth",
  fetchOptions: { credentials: "include" },
});

export async function signIn(email: string, password: string) {
  const { data, error } = await authClient.signIn.email({ email, password });
  if (error !== null) throw new Error(error.message ?? "Sign-in failed");
  return data;
}
```

`emailAndPassword` on the service enables this `signIn.email` operation. Keep the public URL and
mount aligned with your backend, allow the browser to manage session cookies, and handle rejected
requests in the calling UI. These native auth endpoints are not RELKIT-generated RPC operations.
Never import the server service, database, or secret into the browser.

For application route hooks after sign-in, use
[`BetterAuthRelkitClientProvider`](/docs/api/better-auth#betterauthrelkitclientprovider) as shown in
[React authentication](/docs/modules/client/authentication). Follow the
[sign-in guide](/guides/auth/email-password-sign-in) for the complete flow.

### BETTER_AUTH_HANDLER

**Signature**

```ts
declare const BETTER_AUTH_HANDLER: unique symbol;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/index.ts#L13)

### BetterAuthHandler

**Signature**

```ts
declare const BetterAuthHandler: BetterAuthHandler<Session>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/index.ts#L17)

### BetterAuthRegistration

**Signature**

```ts
declare const BetterAuthRegistration: BetterAuthRegistration;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/index.ts#L16)

### BetterAuthServiceDescriptor

**Signature**

```ts
declare const BetterAuthServiceDescriptor: BetterAuthServiceDescriptor<Options>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/index.ts#L19)

### BetterAuthServiceOptions

**Signature**

```ts
declare const BetterAuthServiceOptions: BetterAuthServiceOptions;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/index.ts#L15)

### InferBetterAuthSession

**Signature**

```ts
declare const InferBetterAuthSession: InferBetterAuthSession<Handler>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/index.ts#L18)

## `openapi-projection.ts`

Validates native schema JSON, prefixes mounted paths and component identities,
and removes token requirements from browser-session documentation. This pure
projection is called by AuthOpenApi; malformed metadata throws at that adapter.

### projectAuthOpenApi

Detaches and projects one native OpenAPI document without changing SDK metadata.

**Throws**

TypeError When the metadata is not JSON or lacks paths.

**Signature**

```ts
declare const projectAuthOpenApi: <Input>(document: Input, basePath?: string) => JsonValue;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/openapi-projection.ts#L16)

## `openapi.ts`

Generates native authentication documentation through a typed, observable
service. The activated SDK supplies endpoint metadata; projection does not
acquire a database or install the plugin's public schema/reference routes.
The exported Promise function is the server compatibility boundary.

### AuthOpenApi (class)

Native metadata projection with no request identity or database ownership.

**Signature**

```ts
declare class AuthOpenApi
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/openapi.ts#L19)

### generateBetterAuthOpenApi

Projects native core and plugin endpoints for RELKIT's shared API reference.

**Example**

```ts
const schema = await generateBetterAuthOpenApi(auth);
```

**Signature**

```ts
declare const generateBetterAuthOpenApi: (
  auth: Pick<Auth, "$context">,
  instrumentation?: Context.Context<never>,
) => Promise<JsonValue>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/openapi.ts#L65)

## `react.ts`

### BetterAuthClientLike

**Signature**

```ts
declare const BetterAuthClientLike: BetterAuthClientLike<Session>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/react.ts#L6)

### BetterAuthRelkitClientProvider

Remounts the RELKIT client whenever native authentication identity changes.

**Example**

```ts
import { createElement } from "react";
import { createAuthClient } from "better-auth/react";
import { BetterAuthRelkitClientProvider } from "@relkit/better-auth/react";
const authClient = createAuthClient();
const provider = createElement(BetterAuthRelkitClientProvider, { authClient, children: null });
```

**Signature**

```ts
declare const BetterAuthRelkitClientProvider: <Session>(
  props: BetterAuthRelkitClientProviderProps<Session>,
) => ReactNode;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/react.ts#L24)

### BetterAuthRelkitClientProviderProps

**Signature**

```ts
declare const BetterAuthRelkitClientProviderProps: BetterAuthRelkitClientProviderProps<Session>;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/react.ts#L6)

## `react.types.ts`

### BetterAuthClientLike (interface)

Browser SDK hook contract retaining the native inferred session type.

**Signature**

```ts
export interface BetterAuthClientLike<Session> {
  /**
   * Reads reactive authentication state; hook ownership stays with React.
   * @returns Native session data, loading state and optional SDK error.
   */
  useSession(): {
    readonly data: Session | null | undefined;
    readonly isPending: boolean;
    readonly error?: unknown;
  };
}
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/react.types.ts#L7)

### BetterAuthRelkitClientProviderProps (interface)

Client provider props with a native auth hook; no server runtime dependency.

**Signature**

```ts
export interface BetterAuthRelkitClientProviderProps<Session> extends RelkitClientProviderProps {
  readonly authClient: BetterAuthClientLike<Session>;
}
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/react.types.ts#L23)

## `symbols.ts`

Brands a stable route handler with its owning auth declaration.

### BETTER_AUTH_HANDLER

Brands a stable route handler with its owning auth declaration.

**Signature**

```ts
declare const BETTER_AUTH_HANDLER: unique symbol;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/symbols.ts#L2)

### BETTER_AUTH_RUNTIME

Stores server-only lazy activation state without exposing it publicly.

**Signature**

```ts
declare const BETTER_AUTH_RUNTIME: unique symbol;
```

[Source](https://github.com/rel-kit/relkit/blob/main/packages/better-auth/src/symbols.ts#L5)