Integrates Better Auth with NestJS backends and Next.js App Router frontends using Drizzle ORM and PostgreSQL. Covers database setup, social logins, 2FA, organizations, passkeys, and protected routes.
From developer-kit-typescriptnpx claudepluginhub giuseppe-trisciuoglio/developer-kit --plugin developer-kit-typescriptThis skill is limited to using the following tools:
assets/env.exampleassets/nestjs/auth.controller.tsassets/nestjs/auth.guard.tsassets/nestjs/auth.module.tsassets/nestjs/auth.schema.tsassets/nestjs/auth.service.tsassets/nestjs/database.module.tsassets/nestjs/database.service.tsassets/nextjs/auth-client.tsassets/nextjs/auth-route.tsassets/nextjs/dashboard-page.tsxassets/nextjs/middleware.tsassets/nextjs/sign-in-page.tsxassets/nextjs/use-session.tsreferences/best-practices.mdreferences/examples.mdreferences/mfa-2fa.mdreferences/nestjs-setup.mdreferences/nextjs-setup.mdreferences/passkey.mdSearches, retrieves, and installs Agent Skills from prompts.chat registry using MCP tools like search_skills and get_skill. Activates for finding skills, browsing catalogs, or extending Claude.
Searches prompts.chat for AI prompt templates by keyword or category, retrieves by ID with variable handling, and improves prompts via AI. Use for discovering or enhancing prompts.
Guides agent creation for Claude Code plugins with file templates, frontmatter specs (name, description, model), triggering examples, system prompts, and best practices.
Better Auth is a type-safe authentication framework for TypeScript supporting multiple providers, 2FA, SSO, organizations, and passkeys. This skill covers integration patterns for NestJS backend with Drizzle ORM + PostgreSQL and Next.js App Router frontend.
# Backend (NestJS)
npm install better-auth @auth/drizzle-adapter drizzle-orm pg
npm install -D drizzle-kit
# Frontend (Next.js)
npm install better-auth
See references/nestjs-setup.md for complete backend setup, references/plugins.md for plugin configuration.
Install dependencies
npm install drizzle-orm pg @auth/drizzle-adapter better-auth
npm install -D drizzle-kit
Create Drizzle config (drizzle.config.ts)
import { defineConfig } from 'drizzle-kit';
export default defineConfig({
schema: './src/auth/schema.ts',
out: './drizzle',
dialect: 'postgresql',
dbCredentials: { url: process.env.DATABASE_URL! },
});
Generate and run migrations
npx drizzle-kit generate
npx drizzle-kit migrate
Checkpoint: Verify tables created: psql $DATABASE_URL -c "\dt" should show user, account, session, verification_token tables.
Create database module - Set up Drizzle connection service
Configure Better Auth instance
// src/auth/auth.instance.ts
import { betterAuth } from 'better-auth';
import { drizzleAdapter } from '@auth/drizzle-adapter';
import * as schema from './schema';
export const auth = betterAuth({
database: drizzleAdapter(schema, { provider: 'postgresql' }),
emailAndPassword: { enabled: true },
socialProviders: {
github: {
clientId: process.env.AUTH_GITHUB_CLIENT_ID!,
clientSecret: process.env.AUTH_GITHUB_CLIENT_SECRET!,
}
}
});
Create auth controller
@Controller('auth')
export class AuthController {
@All('*')
async handleAuth(@Req() req: Request, @Res() res: Response) {
return auth.handler(req);
}
}
Checkpoint: Test endpoint GET /auth/get-session returns { session: null } when unauthenticated (no error).
Configure auth client (lib/auth.ts)
import { createAuthClient } from 'better-auth/client';
export const authClient = createAuthClient({
baseURL: process.env.NEXT_PUBLIC_APP_URL!
});
Add middleware (middleware.ts)
import { auth } from '@/lib/auth';
export default auth((req) => {
if (!req.auth && req.nextUrl.pathname.startsWith('/dashboard')) {
return Response.redirect(new URL('/sign-in', req.nextUrl.origin));
}
});
export const config = { matcher: ['/dashboard/:path*'] };
Create sign-in page with form or social buttons
Checkpoint: Navigating to /dashboard when logged out should redirect to /sign-in.
Add plugins from references/plugins.md:
2FA: twoFactor({ issuer: 'AppName', otpOptions: { sendOTP } })
Passkey: passkey({ rpID: 'domain.com', rpName: 'App' })
Organizations: organization({ avatar: { enabled: true } })
Magic Link: magicLink({ sendMagicLink })
SSO: sso({ saml: { enabled: true } })
Checkpoint: After adding plugins, re-run migrations and verify new tables exist.
Input: Display user data in a Next.js Server Component.
// app/dashboard/page.tsx
import { auth } from '@/lib/auth';
import { redirect } from 'next/navigation';
export default async function DashboardPage() {
const session = await auth();
if (!session) {
redirect('/sign-in');
}
return (
<div>
<h1>Welcome, {session.user.name}</h1>
<p>Email: {session.user.email}</p>
</div>
);
}
Output: Renders user info for authenticated users; redirects unauthenticated to sign-in.
Input: User has 2FA enabled and wants to sign in, marking device as trusted.
// Server: Configure 2FA with OTP sending
export const auth = betterAuth({
plugins: [
twoFactor({
issuer: 'MyApp',
otpOptions: {
async sendOTP({ user, otp }, ctx) {
await sendEmail({
to: user.email,
subject: 'Your verification code',
body: `Code: ${otp}`
});
}
}
})
]
});
// Client: Verify TOTP and trust device
const verify2FA = async (code: string) => {
const { data } = await authClient.twoFactor.verifyTotp({
code,
trustDevice: true // Device trusted for 30 days
});
if (data) {
router.push('/dashboard');
}
};
Output: User authenticated; device trusted for 30 days without 2FA prompt.
Input: Enable passkey (WebAuthn) authentication for passwordless login.
// Server
import { passkey } from '@better-auth/passkey';
export const auth = betterAuth({
plugins: [
passkey({
rpID: 'example.com',
rpName: 'My App',
})
]
});
// Client: Register passkey
const registerPasskey = async () => {
const { data } = await authClient.passkey.register({
name: 'My Device'
});
};
// Client: Sign in with autofill
const signInWithPasskey = async () => {
await authClient.signIn.passkey({
autoFill: true, // Browser suggests passkey
});
};
Output: Users can register and authenticate with biometrics, PIN, or security keys.
For more examples (backup codes, organizations, magic link, conditional UI), see references/plugins.md and references/passkey.md.
.env, add to .gitignoreopenssl rand -base64 32 for BETTER_AUTH_SECRETngrok for local testing)email, userId for performancenpx better-auth typegen for full TypeScript coverage.env to .gitignore; never commit OAuth secrets or DB credentialsreferences/nestjs-setup.md - Complete NestJS backend setupreferences/nextjs-setup.md - Complete Next.js frontend setupreferences/plugins.md - Plugin configuration (2FA, passkey, organizations, SSO, magic link)references/mfa-2fa.md - Detailed MFA/2FA guidereferences/passkey.md - Detailed passkey implementationreferences/schema.md - Drizzle schema referencereferences/social-providers.md - Social provider configuration