Security

Captcha

Bot protection with Better Auth's Captcha plugin: a Cloudflare Turnstile, hCaptcha or reCAPTCHA v2 widget on the forms it guards. Better Auth checks the answer on its server.

export default defineNuxtConfig({
  betterAuthUi: {
    captcha: {
      provider: 'cloudflare-turnstile', // or 'hcaptcha', 'google-recaptcha'
      siteKey: '0x4AAA…'
    }
  }
})

BETTER_AUTH_CAPTCHA_SECRET_KEY=0x4AAA…

Which forms it guards

By default, the forms that can create an account or send something:

• signing up (/sign-up/email);
• asking for a sign-in link (/sign-in/magic-link);
• asking for a code by email (/email-otp/send-verification-otp);
• asking for a code by text (/phone-number/send-otp).

Choose your own with endpoints, for example to guard signing in and password resets as well:

export default defineNuxtConfig({
  betterAuthUi: {
    captcha: {
      provider: 'cloudflare-turnstile',
      siteKey: '0x4AAA…',
      endpoints: ['/sign-up/email', '/sign-in/email', '/request-password-reset']
    }
  }
})

The widget is loaded in the browser only.

Breached passwords

With haveIBeenPwned: true, Better Auth's Have I Been Pwned plugin refuses passwords found in data breaches, at sign-up, password changes and resets. The forms say the password will be checked.

export default defineNuxtConfig({
  betterAuthUi: {
    haveIBeenPwned: true
  }
})

Security alerts

Emails to an account's owner when something sensitive happens to it, each with a link to where they can act. They go through the module's emails, so emails.send must be set.

export default defineNuxtConfig({
  betterAuthUi: {
    // All of them:
    securityAlerts: true,
    // Or pick:
    // securityAlerts: { newSignIn: true, passwordChanged: true }
  }
})

• "A device the account hasn't used before" compares the browser and OS ("Chrome on Windows") with the account's other sessions and, with the audit log on, its last 100 sign-ins. It's a hint, not a fingerprint: a second Windows PC with Chrome counts as known.
• No alerts in an account's first two minutes (signing up signs in), when an admin impersonates someone, or to guests.
• With two-factor on, the sign-in alert comes after the code, when the sign-in really completes.
• Times are written in UTC, in the emails' language.