better-auth-security-best-practices
better auth security best practices
What it does
- Rejects default/placeholder secrets in production
- Warns if shorter than 32 characters or entropy below 120 bits
- Generate: openssl rand -base64 32
- Never commit secrets to version control
- [ ] Secret: Use a strong, unique secret (32+ characters, high entropy)
- [ ] HTTPS: Ensure baseURL uses HTTPS
- [ ] Trusted Origins: Configure all valid origins (frontend, mobile apps)
Requirements & configuration
- Only enable if you need authentication sharing and trust all subdomains.
Configuration: BETTER_AUTH_SECRETAUTH_SECRETBETTER_AUTH_TRUSTED_ORIGINS
Derived from the skill's own SKILL.md documentation · extracted 2026-07-23
better-auth-security-best-practices FAQ
What does the better-auth-security-best-practices skill do?
Configure rate limiting, manage auth secrets, set up CSRF protection, define trusted origins, secure sessions and cookies, encrypt OAuth tokens, track IP addresses, and implement audit logging for Better Auth. Use when users need to secure their auth setup, prevent brute force attacks, or harden a Better Auth deployment. Rejects default/placeholder secrets in production Warns if shorter than 32 characters or entropy below 120 bits
What does better-auth-security-best-practices require?
Only enable if you need authentication sharing and trust all subdomains. Configuration keys: BETTER_AUTH_SECRET, AUTH_SECRET, BETTER_AUTH_TRUSTED_ORIGINS.
How do I install better-auth-security-best-practices?
Run: npx -y skills add https://github.com/better-auth/skills --skill better-auth-security-best-practices --agent claude-code — the source lives at github.com/better-auth/skills.
Maintain better-auth-security-best-practices?
Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.
[](https://getagentictools.com/skills/better-auth-skills-better-auth-security-best-practices?ref=badge) npx agentictools info skills/better-auth-skills-better-auth-security-best-practices The second line is the CLI lookup for this page — handy in READMEs and docs.
Related skills
skill-vetter Pre-install security vetting for OpenClaw skills using a structured red-flag checklist.
firestore-security-rules-auditor Automated security auditor for Firestore rules using red-team methodology and structured scoring.
clerk Intelligent router that directs authentication tasks to specialized Clerk skills based on your framework and use case.
best-practices Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practice…
two-factor-authentication-best-practices Multi-factor authentication with TOTP, OTP, backup codes, and trusted device management for Better Auth.
nestjs-best-practices 40 NestJS best practices organized by priority across architecture, dependency injection, security, and performance.