Iskra API Reference
    Preparing search index...

    Interface AuthConfig

    interface AuthConfig {
        authMode?: "oidc" | "email";
        basePath?: string;
        baseURL?: string;
        cookieCacheMaxAge?: number;
        disableCSRFCheck?: boolean;
        enableEmailPassword?: boolean;
        enableSelfRegistration?: boolean;
        oidcConfig?: {
            authorizationEndpoint?: string;
            clientId: string;
            clientSecret: string;
            discoveryEndpoint?: string;
            issuer: string;
            jwksEndpoint?: string;
            mapping?: {
                email?: string;
                emailVerified?: string;
                extraFields?: Record<string, string>;
                id?: string;
                image?: string;
                name?: string;
            };
            pkce?: boolean;
            providerId?: string;
            scopes?: string[];
            tokenEndpoint?: string;
            userinfoEndpoint?: string;
        };
        rateLimit?: false
        | { max?: number; maxKeys?: number; windowMs?: number };
        secret: string;
        socialProviders?: SocialProviders;
        trustedOrigins?: string[];
    }
    Index
    authMode? basePath? baseURL? cookieCacheMaxAge? disableCSRFCheck? enableEmailPassword? enableSelfRegistration? oidcConfig? rateLimit? secret socialProviders? trustedOrigins?
    authMode?: "oidc" | "email"
    basePath?: string
    baseURL?: string
    cookieCacheMaxAge?: number

    Lifetime of better-auth's signed session cookie cache, in seconds (default 300). Sessions are checked against that cookie without a database lookup, so a session revoked by sign-out or "revoke sessions" keeps working this long; lower it to shorten that window.

    disableCSRFCheck?: boolean
    enableEmailPassword?: boolean

    Email/password sign-in. Defaults to authMode === "email", so an OIDC deployment does not also expose an open email/password login.

    enableSelfRegistration?: boolean
    oidcConfig?: {
        authorizationEndpoint?: string;
        clientId: string;
        clientSecret: string;
        discoveryEndpoint?: string;
        issuer: string;
        jwksEndpoint?: string;
        mapping?: {
            email?: string;
            emailVerified?: string;
            extraFields?: Record<string, string>;
            id?: string;
            image?: string;
            name?: string;
        };
        pkce?: boolean;
        providerId?: string;
        scopes?: string[];
        tokenEndpoint?: string;
        userinfoEndpoint?: string;
    }

    Type Declaration

    • OptionalauthorizationEndpoint?: string
    • clientId: string
    • clientSecret: string
    • OptionaldiscoveryEndpoint?: string
    • issuer: string
    • OptionaljwksEndpoint?: string

      Ignored: better-auth takes the JWKS only from the discovery document's jwks_uri; point discoveryEndpoint at a document that has the right one instead.

    • Optionalmapping?: {
          email?: string;
          emailVerified?: string;
          extraFields?: Record<string, string>;
          id?: string;
          image?: string;
          name?: string;
      }

      Claim names to read the user's fields from, instead of the standard ones.

      • Optionalemail?: string
      • OptionalemailVerified?: string

        The claim is read as verified when it is true or "true".

      • OptionalextraFields?: Record<string, string>

        Ignored: extra user fields need better-auth user.additionalFields, which the feature does not declare.

      • Optionalid?: string

        Ignored: better-auth always takes the account's identity from the verified sub claim.

      • Optionalimage?: string
      • Optionalname?: string
    • Optionalpkce?: boolean
    • OptionalproviderId?: string
    • Optionalscopes?: string[]
    • OptionaltokenEndpoint?: string
    • OptionaluserinfoEndpoint?: string
    rateLimit?: false | { max?: number; maxKeys?: number; windowMs?: number }

    Per-client-IP limit on the auth routes (default 20 requests / 15 min, IPv6 clients by /64, at most maxKeys clients tracked: 100 000). Raise it when a backend calls these routes on behalf of many users from one IP (e.g. through the SDKs), or pass false to disable it.

    secret: string
    socialProviders?: SocialProviders

    better-auth's socialProviders option, as is.

    trustedOrigins?: string[]

    Settings
    Member Visibility

    On This Page
    Properties