Tokens for apps and services

Two of Better Auth's plugins, for clients that can't use the session cookie.

export default defineNuxtConfig({
  betterAuthUi: {
    bearer: true,
    jwt: true
  }
})

Bearer tokens

For native apps, other servers, and signed-in devices. Every sign-in returns the session token in a set-auth-token response header. Send it back as Authorization: Bearer <token>, and Better Auth treats it as the session:

export default defineEventHandler(async (event) => {
  // Works with the cookie or the Authorization header.
  const session = await serverAuth(event).api.getSession({ headers: event.headers })
  return session?.user
})

bearer: { requireSignature: true } accepts only signed tokens. No migration needed.

JWTs

For other services that need to know who's signed in, without asking your app. GET /api/auth/token (or the set-auth-jwt header on get-session) gives a short-lived JWT with the user in its payload. Services verify it with your public keys at /api/auth/jwks, which the admin's configuration page shows.

export default defineNuxtConfig({
  betterAuthUi: {
    jwt: {
      expirationTime: '15m'
    }
  }
})

Run Better Auth's migrations after turning it on: it adds a jwks table.