Overview

supastarter uses Better Auth for authentication. It provides a comprehensive set of authentication features out of the box:

• Email/password login
• Social OAuth (Google, GitHub)
• Magic link authentication
• Passkey support (WebAuthn)
• Two-factor authentication (TOTP)
• Organization management with invitations
• Admin role and admin UI

The authentication configuration is located in packages/auth/auth.ts and the feature flags are in packages/auth/config.ts.

Upgrading to Better Auth 1.7

Better Auth 1.7 keeps provider-scoped account identity with account.identityStrategy: "provider-id" (for example local:credential, local:oauth:google, local:oauth:github). Better Auth 1.7.2 briefly required an account.issuer column and unique (issuer, accountId) index; 1.7.3 no longer writes issuer, and the kit removes that column so the adapter schema check passes. If you already applied the 1.7.2 column, drop the unique index and the issuer column, then run pnpm --filter @repo/database push. See the Better Auth 1.7 migration guide and the Nuxt kit CHANGELOG for the SQL.