Audit log and activity

The audit log

On by default. Every successful admin action is recorded, with:

• who did it, and to whom, with names and emails as they were, so deleted users stay readable;
• details such as the ban reason;
• the IP and browser it came from.

It records creating, editing, banning and unbanning users, role and password changes, deletions, signing sessions out, impersonation, removing sign-in methods, and more. It has its own Audit log page, filterable by action, and an Activity card on each user's page.

export default defineNuxtConfig({
  betterAuthUi: {
    admin: {
      auditLog: true,
      // Days entries are kept; 0 keeps them forever.
      auditLogRetentionDays: 30
    }
  }
})

Older entries are hidden, and deleted as new ones are written.

Users' own activity

Also on by default (auditUserEvents), the same log records:

• sign-ups and sign-ins, with their method (email, GitHub, a verification link, …);
• failed sign-ins, for real accounts only (typed-in emails without one aren't stored);
• sign-outs, password reset requests and changes, and email verification.

Every sign-in method counts. Events that look an account up by email are recorded after the response, so they can't reveal through timing whether the account exists. One write per event.

Last sign-in

From those events, the users list and each user's page show when they last signed in. It needs no extra writes, so it only knows sign-ins within the log's retention: older ones show as "Not in the last 30 days".

Last active and online now

Opt-in. A "Last active" column and detail on users, and an "Online now" card on the home page:

export default defineNuxtConfig({
  betterAuthUi: {
    admin: {
      activityTracking: { enabled: true, updateInterval: 5 * 60 * 1000 }
    }
  }
})

When Better Auth checks a signed-in user's session (their pages load), the module records the time in its own adminUserActivity table: at most once per user per updateInterval (5 minutes by default) on each server, after the response.