github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 14:21:55 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

Backend API usage outside of request scope. #1365

New Issue
Closed
opened 2026-03-13 08:35:02 -05:00 by GiteaMirror · 7 comments
GiteaMirror commented 2026-03-13 08:35:02 -05:00
Owner
Copy Link

Originally created by @l0gicgate on GitHub (Jun 16, 2025).

All of the auth.api methods require you to pass headers.

Is there a way to use the internal APIs in a backend context bypassing the need for auth/headers?

Imagine I want to create an Organization using a CLI, there is no request context.

How would I achieve this?

Example:

import { auth } from '@/lib/auth';

const CreateOrganizationCommand = ({ name, slug }: { name: string; slug: string }) => {
  // Create organization logic
  await auth.api.createOrganization({ 
    body: {
      name,
      slug,
    }, 
    headers: null // DO NOT HAVE ACCESS TO HEADERS IN THIS CONTEXT
  });
};

I'm looking for similar functionality available via the internalAdapter:

Image

Originally created by @l0gicgate on GitHub (Jun 16, 2025). All of the `auth.api` methods require you to pass `headers`. Is there a way to use the internal APIs in a backend context bypassing the need for auth/headers? Imagine I want to create an Organization using a CLI, there is no request context. How would I achieve this? Example: ```ts import { auth } from '@/lib/auth'; const CreateOrganizationCommand = ({ name, slug }: { name: string; slug: string }) => { // Create organization logic await auth.api.createOrganization({ body: { name, slug, }, headers: null // DO NOT HAVE ACCESS TO HEADERS IN THIS CONTEXT }); }; ``` I'm looking for similar functionality available via the `internalAdapter`: ![Image](https://github.com/user-attachments/assets/2fa8aab9-6cd7-47ff-ba62-e2859e3b5bba)
GiteaMirror added the question label 2026-03-13 08:35:02 -05:00
GiteaMirror commented 2026-03-13 08:35:03 -05:00
Author
Owner
Copy Link

@Kinfe123 commented on GitHub (Jun 19, 2025):

You can use the Bearer plugin to support Authorization: Bearer headers for token-based auth. you can call with those actions by passing a headers with bearer token like this -

headers: new Headers({
   authorization: `Bearer ${token}`,
}),
@Kinfe123 commented on GitHub (Jun 19, 2025): You can use the Bearer plugin to support Authorization: Bearer <token> headers for token-based auth. you can call with those actions by passing a headers with bearer token like this - ``` headers: new Headers({ authorization: `Bearer ${token}`, }), ```
GiteaMirror commented 2026-03-13 08:35:03 -05:00
Author
Owner
Copy Link

@l0gicgate commented on GitHub (Jun 19, 2025):

@Kinfe123, as the post states. In this context, think of a CLI, there is no header available to pass and there is no request.

I'm asking for similar functionality that's available via the auth.$context.internalAdapter:

Image

@l0gicgate commented on GitHub (Jun 19, 2025): @Kinfe123, as the post states. In this context, think of a CLI, there is no header available to pass and there is no request. I'm asking for similar functionality that's available via the `auth.$context.internalAdapter`: ![Image](https://github.com/user-attachments/assets/63435949-e446-493c-80b0-de9c12ed3f75)
GiteaMirror commented 2026-03-13 08:35:04 -05:00
Author
Owner
Copy Link

@Kinfe123 commented on GitHub (Jun 19, 2025):

i mean if you got the token stored when authenticated once. you can use that to include it on your bearer token just like curl request.

@Kinfe123 commented on GitHub (Jun 19, 2025): i mean if you got the token stored when authenticated once. you can use that to include it on your bearer token just like curl request.
GiteaMirror commented 2026-03-13 08:35:05 -05:00
Author
Owner
Copy Link

@l0gicgate commented on GitHub (Jun 19, 2025):

@Knife123 I understand that this is a possibility.

My point is that internal functionality should be available without auth server side.

I have looked at the internals and I see there is tight coupling to the session. I think is a bad architectural choice.

There should be a layer of abstraction for sourcing the data and providing it to an operation which should be agnostic to the origin of the data.

In HTTP endpoints the data can be sourced from the session/headers, but for internal use you should be able to use manual input.

Example:
7c728248dc/packages/better-auth/src/plugins/organization/routes/crud-org.ts (L93-L212)

This could all be abstracted away and made available for internal use.

@l0gicgate commented on GitHub (Jun 19, 2025): @Knife123 I understand that this is a possibility. My point is that internal functionality should be available without auth server side. I have looked at the internals and I see there is tight coupling to the session. I think is a bad architectural choice. There should be a layer of abstraction for sourcing the data and providing it to an operation which should be agnostic to the origin of the data. In HTTP endpoints the data can be sourced from the session/headers, but for internal use you should be able to use manual input. Example: https://github.com/better-auth/better-auth/blob/7c728248dcf5aae23cc4aa7c8807a6b2a008e317/packages/better-auth/src/plugins/organization/routes/crud-org.ts#L93-L212 This could all be abstracted away and made available for internal use.
GiteaMirror commented 2026-03-13 08:35:05 -05:00
Author
Owner
Copy Link

@Kinfe123 commented on GitHub (Jun 19, 2025):

This is more of a server-to-server mechanism. I was suggesting token-based auth as an opt-out approach, so that the request can be treated as coming from a client by including those tokens. This isn’t something we’ve implemented or focused on yet, but we’d love to support it in the future. Ideally making API keys work well for server-to-server communication.

@Kinfe123 commented on GitHub (Jun 19, 2025): This is more of a server-to-server mechanism. I was suggesting token-based auth as an opt-out approach, so that the request can be treated as coming from a client by including those tokens. This isn’t something we’ve implemented or focused on yet, but we’d love to support it in the future. Ideally making API keys work well for server-to-server communication.
GiteaMirror commented 2026-03-13 08:35:06 -05:00
Author
Owner
Copy Link

@dxptqhtlutehvlyxcmtg commented on GitHub (Oct 25, 2025):

I agree 100% with @l0gicgate. As soon as the situation dawned on me I came to see if anyone else was surprised by this, and sure enough.

It wouldn't be acceptable to interact with any other local library via HTTP. Imagine needing to call fetch to trim a string or something.

Also, Better Auth is sometimes positioned as a replacement for 3rd-party remote auth services. And yet here we are interacting with a local library, where the caller is in the same scope as the provider, as if it's a remote server.

@dxptqhtlutehvlyxcmtg commented on GitHub (Oct 25, 2025): I agree 100% with @l0gicgate. As soon as the situation dawned on me I came to see if anyone else was surprised by this, and sure enough. It wouldn't be acceptable to interact with any other local library via HTTP. Imagine needing to call `fetch` to trim a string or something. Also, Better Auth is sometimes positioned as a replacement for 3rd-party remote auth services. And yet here we are interacting with a local library, where the caller is in the same scope as the provider, as if it's a remote server.
GiteaMirror commented 2026-03-13 08:35:06 -05:00
Author
Owner
Copy Link

@R5dan commented on GitHub (Oct 25, 2025):

@l0gicgate @dxptqhtlutehvlyxcmtg Better Auth now has an API Keys plugin. You also might want to consider the Device Authentication plugin, which allows you to add authentication for things like CLIs with better auth. This does not allow for access sever side without auth but does work for the cli as mentioned above.

@R5dan commented on GitHub (Oct 25, 2025): @l0gicgate @dxptqhtlutehvlyxcmtg Better Auth now has an API Keys plugin. You also might want to consider the Device Authentication plugin, which allows you to add authentication for things like CLIs with better auth. This does not allow for access sever side without auth but does work for the cli as mentioned above.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label question
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#1365
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?