github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-24 08:01:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #8163] Login with MagicLink on multiple native apps (on mobile) + web apps (on laptop) #19640

New Issue
Open
opened 2026-04-15 18:55:24 -05:00 by GiteaMirror · 3 comments
GiteaMirror commented 2026-04-15 18:55:24 -05:00
Owner
Copy Link

Originally created by @maelp on GitHub (Feb 26, 2026).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/8163

Is this suited for github?

  • Yes, this is suited for github

Is your feature request related to a problem? Please describe.

I described the issue more generally in this repo https://github.com/daveyplate/better-auth-capacitor/issues/1

My issue is the following:

  • I have multiple web-apps (accessible in browser at app1.domain.com, app2.domain.com) and the corresponding Capacitor-based "native/hybrid apps" (downloadable on the AppStore)
  • those apps must use the same BetterAuth instance, hosted at api.domain.com (and the users are shared)

I want the MagicLink (or forgot password) flows to work BOTH on web and native app, with "Universal Link/deeplink" so that when I click on an email on my phone, it opens directly on the Capacitor app, and when I click on the link in an email on my laptop, it opens in a normal browser

Describe the solution you'd like

I'd like this flow to be easy and configurable, but I don't see any resource about it.

Here is where I stand now, using an approach similar to the plugin at https://github.com/daveyplate/better-auth-capacitor/tree/main but extending it for multiple apps, and doing it both for the web and native app:

First option

If we have a way to tell iOS/Android that api.domain.com/app1-auth/.... should be a "universal link" that opens the app1 app (only), and api.domain.com/app2-auth/.... opens app2 app (only), so that when clicking on the link in the email, the OS is not confused as what app to open.

Once the app is open, I can retrieve the token or whatever from the URL, and do the correct fetch "manually" to the api.domain.com/v1/auth/... URL and set the cookies, a bit like what your plugin is doing I guess

But this means I have to tweak a bit BetterAuth to generate those kind of URLs, or have a whole different BetterAuth instance for each app (but I want my users to be shared...).

Then on the browser app (non-capacitor), eg on my laptop, if I click the link in the email it would open a browser for api.domain.com/... and set the cookie, then it redirects to (eg) app1.domain.com and normally the cookie is set for access to api.domain.com and I should be logged

Second option

I tweak BetterAuth so that the email link for MagicLink is app1.domain.com/magic-link/.../?callbackUrl=... and then:

On mobile, this opens (using the Universal link) in my app, without having anything to do (and I don't have the same issue with the fact that the "api.gouach.com" links of the first option need to "know" which app to open), and I do the same as your plugin: do the fetch locally and get the cookies

Now on web, it seems a bit more complicated? It means my web-app should have a special page to handle app1.domain.com/magic-link/.../?callbackUrl=... and do a fetch to the api.domain.com there with the correct parameters and set the cookies, but most browsers/servers nowadays use the HttpOnly stuff for cookie, so I'm not sure it's even possible?

-> do you have an idea what's the best way to do it?

Describe alternatives you've considered

Not sure

Additional context

No response

Originally created by @maelp on GitHub (Feb 26, 2026). Original GitHub issue: https://github.com/better-auth/better-auth/issues/8163 ### Is this suited for github? - [x] Yes, this is suited for github ### Is your feature request related to a problem? Please describe. I described the issue more generally in this repo https://github.com/daveyplate/better-auth-capacitor/issues/1 My issue is the following: - I have multiple web-apps (accessible in browser at app1.domain.com, app2.domain.com) and the corresponding Capacitor-based "native/hybrid apps" (downloadable on the AppStore) - those apps must use the same BetterAuth instance, hosted at api.domain.com (and the users are shared) I want the MagicLink (or forgot password) flows to work **BOTH** on web and native app, with "Universal Link/deeplink" so that when I click on an email on my phone, it opens directly on the Capacitor app, and when I click on the link in an email on my laptop, it opens in a normal browser ### Describe the solution you'd like I'd like this flow to be easy and configurable, but I don't see any resource about it. Here is where I stand now, using an approach similar to the plugin at https://github.com/daveyplate/better-auth-capacitor/tree/main but extending it for multiple apps, and doing it both for the web and native app: ## First option If we have a way to tell iOS/Android that `api.domain.com/app1-auth/....` should be a "universal link" that opens the app1 app (only), and `api.domain.com/app2-auth/....` opens app2 app (only), so that when clicking on the link in the email, the OS is not confused as what app to open. Once the app is open, I can retrieve the token or whatever from the URL, and do the correct fetch "manually" to the api.domain.com/v1/auth/... URL and set the cookies, a bit like what your plugin is doing I guess But this means I have to tweak a bit BetterAuth to generate those kind of URLs, or have a whole different BetterAuth instance for each app (but I want my users to be shared...). Then on the browser app (non-capacitor), eg on my laptop, if I click the link in the email it would open a browser for `api.domain.com/...` and set the cookie, then it redirects to (eg) `app1.domain.com` and normally the cookie is set for access to `api.domain.com` and I should be logged ## Second option I tweak BetterAuth so that the email link for MagicLink is `app1.domain.com/magic-link/.../?callbackUrl=...` and then: On mobile, this opens (using the Universal link) in my app, without having anything to do (and I don't have the same issue with the fact that the "api.gouach.com" links of the first option need to "know" which app to open), and I do the same as your plugin: do the fetch locally and get the cookies Now on web, it seems a bit more complicated? It means my web-app should have a special page to handle `app1.domain.com/magic-link/.../?callbackUrl=...` and do a fetch to the `api.domain.com` there with the correct parameters and set the cookies, but most browsers/servers nowadays use the HttpOnly stuff for cookie, so I'm not sure it's even possible? -> do you have an idea what's the best way to do it? ### Describe alternatives you've considered Not sure ### Additional context _No response_
GiteaMirror added the platformcredentials labels 2026-04-15 18:55:24 -05:00
GiteaMirror commented 2026-04-15 18:55:26 -05:00
Author
Owner
Copy Link

@maelp commented on GitHub (Feb 26, 2026):

Cross-linked with this issue https://github.com/daveyplate/better-auth-capacitor/issues/1

<!-- gh-comment-id:3965691670 --> @maelp commented on GitHub (Feb 26, 2026): Cross-linked with this issue https://github.com/daveyplate/better-auth-capacitor/issues/1
GiteaMirror commented 2026-04-15 18:55:27 -05:00
Author
Owner
Copy Link

@bytaesu commented on GitHub (Feb 26, 2026):

Hi @maelp,

In sendMagicLink, you have access to things like token and ctx, so you can build platform-specific conditional URLs before sending the email. To support multiple client types, the OAuth Provider plugin could be an option. In setups with multiple servers like this, I think most of the complexity lies on the servers rather than within Better Auth.

Since this isn't an officially supported framework and the setup is fairly complex, we don't have a dedicated guide for this use case. Joining our community may be helpful for further discussion 🙂

<!-- gh-comment-id:3968403326 --> @bytaesu commented on GitHub (Feb 26, 2026): Hi @maelp, In `sendMagicLink`, you have access to things like token and ctx, so you can build platform-specific conditional URLs before sending the email. To support multiple client types, the [OAuth Provider](https://www.better-auth.com/docs/plugins/oauth-provider) plugin could be an option. In setups with multiple servers like this, I think most of the complexity lies on the servers rather than within Better Auth. Since this isn't an officially supported framework and the setup is fairly complex, we don't have a dedicated guide for this use case. Joining our [community](https://www.better-auth.com/community) may be helpful for further discussion 🙂
GiteaMirror commented 2026-04-15 18:55:27 -05:00
Author
Owner
Copy Link

@maelp commented on GitHub (Feb 26, 2026):

@bytaesu thanks! Not sure how the Oauth plugin would be an option for me? I want to use MagicLink, did you have something specific in mind?

<!-- gh-comment-id:3969167532 --> @maelp commented on GitHub (Feb 26, 2026): @bytaesu thanks! Not sure how the Oauth plugin would be an option for me? I want to use MagicLink, did you have something specific in mind?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label credentials platform
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#19640
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?