# Better Auth

> My first pick for serious apps on Postgres. Your users live in your own database, it does more than Cognito, and it costs nothing per user.

- Verdict: My default
- Vendor: Open source (MIT), part of Vercel since July 2026
- Layer: [Accounts, identity and cost](https://cloudlesslabs.com/stack/layers/accounts.md). Job: Authentication library, users in your Postgres
- Last reviewed: 19 October 2026, by Nicolas Dao (Cloudless Labs, Sydney)
- Web page: https://cloudlesslabs.com/stack/better-auth/. The whole stack in one file: https://cloudlesslabs.com/stack/brief.md

The biggest problem with Cognito isn't a missing feature, it's that you end up with two user stores: users in Cognito and users in Postgres, kept in sync by triggers. Better Auth puts them in one place, the database you already pay for, so it's free forever and every user is one JOIN away from their data.

It also does more than Cognito out of the box: email and password with reset, social sign-in (Google, Microsoft, GitHub and more), passkeys, MFA, magic links, organisations with roles, enterprise SSO and SCIM.

The price is ownership: you build the login screens, wire the emails to Resend, host it on a Lambda, and patch it every week. For a serious app on Postgres, that's a trade I'll take.

## Use it when

- A serious app on Postgres that you expect to grow: one user table, in the database you already pay for, joined with everything else.
- You need what Cognito doesn't have: organisations and teams, magic links, enterprise SSO without per-user fees, SCIM.
- Data must stay in Australia: users sit wherever your Neon or Aurora database is.

## Don't use it when

- A small internal app or admin panel that just needs sign-in working today: Cognito does it with less to build.
- Nobody will patch it: a library you own is a library you update, weekly.
- The client needs an auth vendor's SOC 2 report: a library has none of its own.

## Pricing

Free (MIT), with no per-user fee. You pay only for the Lambda and the Postgres you already run. Optional hosted extras (Better Auth Infrastructure): Pro $20 a month with one self-serve SSO connection, then $50 a month per extra connection.

## Gotchas, with fixes

- **Gotcha:** There's no hosted login page. Better Auth gives you the endpoints and a client SDK, not the screens.
  **Fix:** Build sign-in, sign-up and reset-password pages in your app (a day with Claude Code), or use a ready-made component kit if the front end is React. They match your design, which Cognito's pages never quite do.
- **Gotcha:** It doesn't send email. Password reset, verification and magic links produce a link and wait for you.
  **Fix:** Pass it to Resend in a few lines (sendResetPassword, sendVerificationEmail, sendMagicLink).
- **Gotcha:** 27 security advisories in 2026 (3 critical), many in the young SSO and SCIM plugins. Other open-source auth projects had similar years.
  **Fix:** Pin exact versions, let Renovate or Dependabot open update PRs, and run a weekly scheduled agent that checks the repo's security advisories and opens the upgrade. Enable only the plugins you use.
- **Gotcha:** Letting users register their own SSO providers caused most of the 2026 SSO advisories (account takeover through unproven domains).
  **Fix:** Register SSO providers only from your own server code, require DNS domain verification, turn on requireTimestamps for SAML, and keep implicit account linking off.
- **Gotcha:** Its JWT plugin signs EdDSA by default, which API Gateway JWT authorizers and IAM don't accept.
  **Fix:** Configure RS256. Then Workers, API Gateway and Cognito identity pools all accept its tokens.
- **Gotcha:** Google Workspace can't push users to custom apps over SCIM.
  **Fix:** Google sign-in works; for Google directory sync, use another tool (Ory Polis or WorkOS) or invite users by domain.

## Instead, consider

- [Amazon Cognito](https://cloudlesslabs.com/stack/aws-cognito/index.md): Small internal apps and admin panels: everything out of the box, free below 10,000 monthly users.

## Worked examples

- [Better Auth or Cognito?](https://cloudlesslabs.com/stack/guides/sign-in/index.md): Which sign-in should my app use, and what do I actually get for free?

## Where it fits

- [Sign-in and identity](https://cloudlesslabs.com/stack/use-cases/sign-in.md): pick 1. First pick for a serious app on Postgres: users in your own database, one store, more features than Cognito, no per-user fee. You build the screens and wire the emails.

## Sources

- [Better Auth documentation](https://www.better-auth.com/docs)
- [Better Auth pricing (Infrastructure)](https://better-auth.com/pricing)
- [Better Auth security advisories](https://github.com/better-auth/better-auth/security/advisories)

## Related

- [Accounts, identity and cost](https://cloudlesslabs.com/stack/layers/accounts.md): every tool in this layer, with its verdict
- [The whole stack in one file](https://cloudlesslabs.com/stack/brief.md): every use case and tool, for questions that span many
- [Map of every Markdown file on cloudlesslabs.com, with what each one answers](https://ask.cloudlesslabs.com)