APIs & Data Architecture Auth & Security

21. Modern Authentication, Passkeys & Better Auth

Implement passwordless biometric passkeys, secure HttpOnly cookie session rotation, and modular authentication plugins with Better Auth.

better-auth.ts

typescript

import { betterAuth } from 'better-auth';
import { passkey } from 'better-auth/plugins/passkey';
import { drizzleAdapter } from 'better-auth/adapters/drizzle';
import { db } from '#lib/server/db';
export const auth = betterAuth({
  database: drizzleAdapter(db, { provider: 'pg' }),
  emailAndPassword: { enabled: true },
  session: {
    cookieCache: { enabled: true, maxAge: 300 },
    cookie: {
      httpOnly: true, // Immune to JavaScript XSS exfiltration
      secure: true,   // HTTPS only
      sameSite: 'lax'
    }
  },
  plugins: [
    passkey({
      rpID: 'web-engine26.pages.dev',
      rpName: 'Web Engine 2026'
    })
  ]
});

Modern Authentication, Passkeys & Better Auth

Better Auth provides a comprehensive TypeScript authentication runtime with passwordless WebAuthn passkeys, HttpOnly cookie rotation, and organisation multi-tenancy.

Passkeys (WebAuthn): Asymmetric public-private keypairs anchored in hardware secure enclaves (TouchID, FaceID, Windows Hello) that are immune to phishing.
HttpOnly Session Cookies: Completely isolated from client JavaScript (document.cookie), protecting session tokens against XSS exfiltration.
Schema Ownership: Better Auth creates native Drizzle tables in your own database without third-party auth vendor lock-in.

Better Auth Session Visualiser Unauthenticated

Select Authentication Strategy:

WebAuthn Hardware Handshake Public-Key Cryptography