919: Better Auth With Better Auth  ## Metadata - Author: [[Syntax - Tasty Web Development Treats]] - Full Title: 919: Better Auth With Better Auth - Category: #podcasts - URL: https://share.snipd.com/episode/c1367543-fa94-4110-8596-6145178d84ee ## Document Notes ## Highlights - **Scott Tolinski's Auth Experience** - Scott Tolinski shared his experience rolling his own authentication system for Level Up tutorials without much difficulty. - He noted that although it wasn't impossible, it required significant knowledge and careful implementation to avoid security pitfalls. Transcript: Scott Tolinski They—it's an inflammation steroid. So let me tell you, my history with auth is I've frequently rolled my own auth. I wrote my own auth for Level Up tutorials because in the initial time that the platform was built, it was built in Meteor. And when I moved it to React and just React and my own database Mongo, I was like, oh, shoot, I was using Meteor's auth. So now I got to build an auth that's similar to Meteor's, but my own. So I rolled my own, I built it from scratch. And it wasn't impossible. I learned a lot. Did it take more than a day? No, absolutely not. But did it take a lot of knowledge and requirements? Yeah. A lot of times people are like, don't even consider rolling your own off. It is a treacherous path of demons and ways it's not. You follow a few simple steps. You follow some best practices. Bingo, bango. You got an auth. ([Time 0:00:58](https://share.snipd.com/snip/d4c4fb61-e3b3-45a9-a592-4a797aff6264)) - **Evolution of Web Authentication** - Web authentication has evolved significantly beyond email and password with new options like passkeys and phone number logins. - This shift drastically improves user experience and security but increases complexity for developers. Transcript: Scott Tolinski But the dialogue for me has changed a little bit in terms of like what auth actually is as the years have gone by. And that has led me to actually want to use other platforms for my auth instead of rolling my own. We'll talk about that as we go. But if you chose to roll your own auth, you're going to make sure you have some really good knowledge about how your site is working at all times. And to that, you need something like Sentry. S-E forward slash syntax is the best place to get total visibility into your site. And Sentry has a new feature called Sear, which allows you to get to the root cause of issues on your site quickly and easily using AI. And I gotta say, man, Sentry has done such a good job of being like, let's figure out how AI works inside of our application, rather than like Sentry as a whole as an application rather Than like oh we'll just put a chatbot in the app right because that's like the solution that so many different companies come up with these days oh you need AI let's throw a chatbot in the App or an autocomplete or something like that so Sentry has done such a good job experimenting and I gotta say this is just one of a handful of incredible tools that Sentry is constantly Putting out so check them out at Sentry.io music so why has my thoughts on auth changed over the years because what 10 years ago eight years ago what was auth right auth you might have had Login with google you might have had login with github if you're a developer you had email and password that was primarily the main you had 2fa on some sites uh and that 2fa could be text Message it could be uh your authenticator app or any of that stuff yeah you didn't have pass keys uh you didn't have enter your phone number and we'll send you a text message and now your Account is tied to your phone number or whatever like you do on tiktok or whatever you didn't have that qr code sign in with your phone and now the tv app is then authenticated. Yeah. Wes Bos You have to type it all in. I love that, by the way. Man, whenever I have to sign in to something and it says just pull your phone out and scan this code. Yes, please. ([Time 0:01:50](https://share.snipd.com/snip/a335229c-0679-4475-ab97-5f970e93f051)) - **Prefer Self-Hosted Auth Solutions** - Avoid relying solely on paid authentication services if you want full control and prefer hosting your own infrastructure. - Consider platforms like Better Auth that integrate with your database and give you host control. Transcript: Scott Tolinski It has only gotten harder and more complicated. And so what are your choices? Your choices are to one, use like a paid service. Like a paid service, there's several like very popular paid services out there to do. Auth that have been around for a while. You have like Auth0 has been around for a while. They sponsored Syntax at some point. They're a very reliable application platform for hosting. Wes Bos Clerk's pretty popular right now as well. Scott Tolinski Clerk is popular. The thing that I have a holdup with these is it's like, I like hosting my stuff. I like hosting my stuff where I host all my other stuff. I like it to be part of my database. I don't want to have to pay for a service. I don't want to have to rely on another server for my authentication system if my authentication system is a part of my current site. I just don't want to have that. There's other ones. Lucia was a really popular one for a little bit of rolling your own auth. It's deprecated now. I always appreciated Lucia existing, but it still felt like you were doing a lot of work to get auth ([Time 0:04:37](https://share.snipd.com/snip/7be3941e-88c5-4a8e-88ba-043b4d9d396d)) - **Better Auth's Versatility** - Better Auth supports multiple modern authentication flows including session-based and JWT-based auth. - It works seamlessly with major frameworks and databases, making it versatile for developers. Transcript: Scott Tolinski Alone. It's its own thing, right? There's next auth, which I don't know if you know this, but next auth became auth.js. Or at least, yes, they have opened it up to be more than just next.js. It works with all of the stuff. They have example apps with SvelteKit. This to me seems like a nice option. This is kind of interesting looking for a hosted alternative, clerk. You know, I don't have anything bad to say about auth js. But when I learned about better auth, this was the first auth platform for me, that made me say, I gotta use this thing, because it does everything. And it does absolutely everything. And it connects very well to the tools that you you know, and love. So when you get through it, yeah, like works with all your frameworks, multi factor authentication, you know, has support for OAuth or email and password, members and invitation has A ton of plugins works with all of the good stuff. Built-in rate limiter. Wes Bos That's another thing I had to write myself as well. Scott Tolinski That's nice. So when we go through this, I'll show you a little bit about what's so cool ([Time 0:07:34](https://share.snipd.com/snip/08916252-f208-4104-89dc-65267a766a10)) - **Utilize Better Auth Plugins and Security** - Use Better Auth's built-in plugins for features like two-factor authentication, phone number OTP, and magic link to simplify your implementation. - Leverage rate limiting and CAPTCHA integration to enhance security against abuse. Transcript: Scott Tolinski Yeah. Wes Bos Oh, and there's captcha integration, which is, is key as well. Cause I was, I was thinking about like looking at the rate limiting. I was like, yeah, rate limiting is, is one part of it. You know, you don't want people hitting your signup endpoints too often, but then there's also, you have to throw a captcha there when people are trying to sign in. Scott Tolinski There's even like update user functions and stuff like that, which, ah, yes. Delete user, update user. Very refreshing. It's very refreshing. And I'm just like, you know, so many times when you see things like this, there's a lot of big promises made and under delivered. This thing is flown so far under the radar to me that by the time I'm seeing it, it is a full grown ass man of a package. It is got everything in here. Social sign ons, you could sign in with Roblox if you want to sign in with Roblox. You can do that. Let's sign in with any of this stuff, hugging face or any of these things. The database integration, it works with MySQL, SQLite, Postgres. It has adapters ([Time 0:13:43](https://share.snipd.com/snip/1416956c-49a5-4c08-b9f7-25fbc40deaca)) - **Personal Auth Admin Implementation** - Scott Tolinski recounted writing user impersonation and banning systems himself. - He emphasized Better Auth’s admin functions make such tasks easy out of the box. Transcript: Scott Tolinski To have in it. Oftentimes, you're writing that yourself. I've written an impersonation system. I've written a banning and unbanning. I called it the ban hammer. It was pretty fun to use, but I would have rather not have to write it myself. That's for sure. Wes Bos You said there's a whole banning system? Yes. Scott Tolinski Yes, banning and unbanning. Imperson creating and managing from an admin side of things wow so yeah is this it this doesn't get into like roles and and access does it roles it gets into setting roles uh really yes Setting roles uh set roles but it whole access controls built in? Brother, I'm telling you, this thing absolutely rules. And then MCP. MCP plugin lets you act as an OAuth provider for MCP clients if you need that. Dude, it's too much stuff in here in terms of like, it just does it all dang all. Single support, single sign-on. Bearer tokens, like you said, CAPTCHA. There's a feature in here that can check for have I been pwned database to know if your password has been involved in any sort of data leaks. Multi-session, active multiple sessions ([Time 0:17:56](https://share.snipd.com/snip/408cf4cd-809e-4533-86ad-c598749d5cf3)) - **Open Source with Hosted Option** - Better Auth offers an open-source core with a separately managed hosted product providing unified user dashboards. - This allows developers to use a robust free solution while optionally adopting premium features if needed. Transcript: Scott Tolinski But the product does not take away from the open source side of things. So like, what does like, where is that product? Wes Bos Um, uh, you can't even find it. That's good. Yeah. Scott Tolinski Which is funny because I I've actually, I've signed up for the, wow. Interesting. They just have this, I've signed up for it at some point to join the waitlist. So the product is a managed version, essentially, like clerk or something like that, if you don't want to add it into your stack. But it also includes all of the things that you would need, like for sending email and SMS. So you're not having to bring your own email, you're not having to bring your own sms service hook it up to twilio or whatever right you're not having to bring all that stuff it includes All of that so it's just like hey we we've given you the components you can hook it up to your own stuff but now and in here here's one that you'll notice a unified dashboard to manage users And user analytics so it's giving you that analytics dashboard. Wes Bos And- Oh, that's what I was just talking about, that UI component. That's probably going to be one of ([Time 0:22:50](https://share.snipd.com/snip/c115e9a4-de20-43c0-96aa-1a096cebdaf7)) - **Choose Better Auth Over Custom Auth** - Consider adopting Better Auth for all your authentication needs as it removes the pain of writing your own system. - Its extensive features and plugins cover most use-cases making custom implementations unnecessary. Transcript: Scott Tolinski Their entire docs done in Markdown for LLM consumption. So if you're the type of person who wants to just pass this into cursor and have it available to reference, they got you on that too. So LLMs.txt is one of my new favorite things that a lot of folks are doing to give you just quickly and easily consumable documentation and text form. And they got that too. So Dan, if you need if you need if you need a new off solution in your life that like, doesn't provide a lot of pain, man, this is not an ad. Obviously, they're not making any money even yet. There's no product. But I've used it. I've been to the edge and back. I've tried it. It was great. I used it for two different types of offflows. It was easy to change between them. I changed between them in a couple minutes, just random migration, changed some code around, saved my JWT or whatever. And now I'm in with a JWT-based auth if I want it. Docs are very nice and easily consumable. And there's just a lot of good stuff here. So I don't have any additional thoughts other than better auth truly is like the thing that's made me reconsider writing my own auth and I will be using this going forward. And ([Time 0:25:10](https://share.snipd.com/snip/0e782f82-e517-4485-bdce-cb1395b6a1cc))