Agent skill · security · aiskillstore
configuring-better-auth
Implement OAuth 2.1 / OIDC authentication using Better Auth with MCP assistance. Use when setting up a centralized auth server (SSO provider), implementing SSO clients in Next.js apps, configuring PKCE flows, or managing tokens with JWKS verification. Uses Better Auth MCP for guided setup. NOT when using simple session-only auth without OAuth/OIDC requirements.
Why this skill is useful
Adds specific commands and configuration patterns for implementing OAuth 2.1 / OIDC with Better Auth that the AI wouldn't reliably generate on its own.
What it needs
Requires npm installed locally. Requires better-auth account access. About 3k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Better Auth OAuth/OIDC Implement centralized authentication with Better Auth - either as an auth server or SSO client. MCP Server Setup Better Auth provides an MCP server powered by Chonkie for guided configuration: Or in settings.json: When to Use the MCP Task Use MCP? ------ ---------- Initial Better Auth setup Yes - guided configuration Adding OIDC provider plugin Yes - generates correct config Troubleshooting auth issues Yes - can analyze setup Understanding auth flow Yes - explains concepts Writing custom middleware No - use patterns below --- Architecture Overview --- Quick Start: Auth Server Setup Core Configuration Register OAuth Clients See references/auth-server-setup.md for complete setup with JWKS, email verification, and admin dashboard. --- Quick Start: SSO Client Integration Environment Variables PKCE Auth Flow Token Exchange (API Route) See references/sso-client-integration.md for JWKS verification, token refresh, and global logout. --- PKCE Utilities --- Key Patterns 1. Token Storage Store tokens in httpOnly cookies (not localStorage) Use SameSite=Lax for CSRF protection 2. Token Refresh 3. JWKS Verification 4. Global Logout --- Common Pitfalls Issue Solution ------- ---------- PKCE verifier lost after redirect Store in httpOnly cookie before redirect Token in localStorage Use httpOnly cookies instead JWKS fetch fails Check CORS on auth server Consent screen loops Ensure consent page saves decision --- Verification Run: python3 scripts/verify.py Expected: ✓ configuring-better-auth skill ready If Verification Fails 1. Check: references/ folder has both setup files 2. Stop and report if still failing References references/auth-server-setup.md - Complete auth server with OIDC provider references/sso-client-integration.md - Full SSO client implementation
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/configuring-better-auth