[Question] Support for external backend flow #1971

New Issue

GiteaMirror · 2026-03-13T09:18:01-05:00

GiteaMirror commented

2026-03-13 09:18:01 -05:00

Originally created by @dennzimm on GitHub (Sep 19, 2025).

Hi 👋

We are currently evaluating a migration from next-auth to better-auth and I’m wondering if our use case can be implemented.

According to the docs, “Better Auth requires a database to store user data.” – but in our setup we don’t want Better Auth to manage credentials or validate passwords internally. Instead, we already have an external backend that handles this logic.

Our current flow looks like this:

Email/password login:
1. User enters email/password
2. We call a GraphQL mutation via Apollo
3. The backend responds with { id, token }

Google login:
1. User signs in with Google
2. We send the Google token to our backend via GraphQL mutation
3. Backend validates and responds with { id, token }

Question:
• Can Better Auth be configured to work in this way, i.e. delegating the actual login logic to our backend (via custom API calls) while still handling sessions, middleware, etc.?
• Or is the database and internal password/social provider logic mandatory for Better Auth to function?

Thanks in advance for clarifying 🙏

Originally created by @dennzimm on GitHub (Sep 19, 2025). Hi 👋 We are currently evaluating a migration from next-auth to better-auth and I’m wondering if our use case can be implemented. According to the docs, “Better Auth requires a database to store user data.” – but in our setup we don’t want Better Auth to manage credentials or validate passwords internally. Instead, we already have an external backend that handles this logic. Our current flow looks like this: Email/password login: 1. User enters email/password 2. We call a GraphQL mutation via Apollo 3. The backend responds with { id, token } Google login: 1. User signs in with Google 2. We send the Google token to our backend via GraphQL mutation 3. Backend validates and responds with { id, token } Question: • Can Better Auth be configured to work in this way, i.e. delegating the actual login logic to our backend (via custom API calls) while still handling sessions, middleware, etc.? • Or is the database and internal password/social provider logic mandatory for Better Auth to function? Thanks in advance for clarifying 🙏

GiteaMirror added the question label 2026-03-13 09:18:01 -05:00

GiteaMirror closed this issue

2026-03-13 09:18:02 -05:00

GiteaMirror commented

2026-03-13 09:18:03 -05:00

@dosubot[bot] commented on GitHub (Sep 19, 2025):

Hi @dennzimm! I'm Dosu and I’m helping the better-auth team.

Better Auth can delegate authentication logic (like email/password or Google login) to your external backend using custom plugins and API forwarding, while still handling sessions and middleware. For example, you can use the customSession plugin to fetch session data from your backend, or configure the generic OAuth plugin to use custom endpoints and user info logic for social providers. This lets you forward login requests and session validation to your backend as needed.

However, Better Auth still requires a database for session and user data management—even if you externalize credential validation. The internal adapter expects to perform CRUD operations on user/session models, and session validation relies on querying this database. There’s no supported way to run Better Auth in a fully stateless or database-less mode, and minimal user/session records will still be created and managed internally (source).

You can forward auth-related API calls from your frontend to your backend (for example, via Next.js API routes), and use Better Auth’s session management and middleware features on top of your external authentication logic (source). Just keep in mind that the database requirement is mandatory for session and user tracking, even if you don’t use the built-in credential or provider logic.

To reply, just mention @dosu.

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

@dosubot[bot] commented on GitHub (Sep 19, 2025):  Hi @dennzimm! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the better-auth team.  Better Auth can delegate authentication logic (like email/password or Google login) to your external backend using custom plugins and API forwarding, while still handling sessions and middleware. For example, you can use the `customSession` plugin to fetch session data from your backend, or configure the generic OAuth plugin to use custom endpoints and user info logic for social providers. This lets you forward login requests and session validation to your backend as needed. However, Better Auth still requires a database for session and user data management—even if you externalize credential validation. The internal adapter expects to perform CRUD operations on user/session models, and session validation relies on querying this database. There’s no supported way to run Better Auth in a fully stateless or database-less mode, and minimal user/session records will still be created and managed internally ([source](https://github.com/better-auth/better-auth/blob/57510365a393bca2f6a37e50c43571651b121978/packages/better-auth/src/adapters/adapter-factory/index.ts)). You can forward auth-related API calls from your frontend to your backend (for example, via Next.js API routes), and use Better Auth’s session management and middleware features on top of your external authentication logic ([source](https://github.com/better-auth/better-auth/issues/4044)). Just keep in mind that the database requirement is mandatory for session and user tracking, even if you don’t use the built-in credential or provider logic.  *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/6b848309-f12a-439d-aee7-a68fbc8f17a6?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/6b848309-f12a-439d-aee7-a68fbc8f17a6?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/6b848309-f12a-439d-aee7-a68fbc8f17a6?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/6b848309-f12a-439d-aee7-a68fbc8f17a6?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/6b848309-f12a-439d-aee7-a68fbc8f17a6?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/6b848309-f12a-439d-aee7-a68fbc8f17a6?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/6b848309-f12a-439d-aee7-a68fbc8f17a6?feedback_type=other)</sup>  [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github) [![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot) [![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/4771)

GiteaMirror commented

2026-03-13 09:18:05 -05:00

@ping-maxwell commented on GitHub (Sep 19, 2025):

is the database and internal password/social provider logic mandatory for Better Auth to function?

Yeah sorry these are mandatory. For password logic we do have the ability for you to configure the hashing functions and stuff like that, but nothing to the extend of logic being ran from another service

@ping-maxwell commented on GitHub (Sep 19, 2025): > is the database and internal password/social provider logic mandatory for Better Auth to function? Yeah sorry these are mandatory. For password logic we do have the ability for you to configure the hashing functions and stuff like that, but nothing to the extend of logic being ran from another service

GiteaMirror commented

2026-03-13 09:18:06 -05:00

@dennzimm commented on GitHub (Sep 19, 2025):

Yeah sorry these are mandatory. For password logic we do have the ability for you to configure the hashing functions and stuff like that, but nothing to the extend of logic being ran from another service

Thanks for clarifying 🙂

Based on your answer, I think for our use case better-auth is not really a fit. Would you agree that in this scenario it makes more sense to stick with next-auth/Auth.js or something lighter like iron-session + arctic?

Maybe I can try out better-auth in another project where the scenario fits. ☺️

@dennzimm commented on GitHub (Sep 19, 2025): > Yeah sorry these are mandatory. For password logic we do have the ability for you to configure the hashing functions and stuff like that, but nothing to the extend of logic being ran from another service Thanks for clarifying 🙂 Based on your answer, I think for our use case better-auth is not really a fit. Would you agree that in this scenario it makes more sense to stick with next-auth/Auth.js or something lighter like iron-session + arctic? Maybe I can try out better-auth in another project where the scenario fits. ☺️

GiteaMirror commented

2026-03-13 09:18:07 -05:00

@ping-maxwell commented on GitHub (Sep 19, 2025):

If all you need is sessions & a way to handle oauth then yeah something lighter should do the job for you.

(FYI there are plans to support stateless auth in the future, though the password logic thing will likely remain the same)

@ping-maxwell commented on GitHub (Sep 19, 2025): If all you need is sessions & a way to handle oauth then yeah something lighter should do the job for you. (FYI there are plans to support stateless auth in the future, though the password logic thing will likely remain the same)

GiteaMirror commented

2026-03-13 09:18:07 -05:00

@dennzimm commented on GitHub (Sep 19, 2025):

If all you need is sessions & a way to handle oauth then yeah something lighter should do the job for you.

(FYI there are plans to support stateless auth in the future, though the password logic thing will likely remain the same)

Thank you 😊. Good to know about the future plans for stateless auth. I’ll keep an eye on it.

@dennzimm commented on GitHub (Sep 19, 2025): > If all you need is sessions & a way to handle oauth then yeah something lighter should do the job for you. > > (FYI there are plans to support stateless auth in the future, though the password logic thing will likely remain the same) Thank you 😊. Good to know about the future plans for stateless auth. I’ll keep an eye on it.

GiteaMirror commented

2026-03-13 09:18:07 -05:00

@moiseshp commented on GitHub (Oct 27, 2025):

Hello @dennzimm , I’m in the same dilemma because, according to the Better Auth documentation, Auth.js has practically been left as a legacy library. In that sense, I’m exploring alternatives since I’m facing the same use case. Did you happen to find any alternative?

On the other hand, in the context of Next.js, I came across this library: https://github.com/vvo/iron-session.

@moiseshp commented on GitHub (Oct 27, 2025): Hello @dennzimm , I’m in the same dilemma because, according to the Better Auth documentation, Auth.js has practically been left as a legacy library. In that sense, I’m exploring alternatives since I’m facing the same use case. Did you happen to find any alternative? On the other hand, in the context of Next.js, I came across this library: [https://github.com/vvo/iron-session](https://github.com/vvo/iron-session).

GiteaMirror commented

2026-03-13 09:18:08 -05:00

@dennzimm commented on GitHub (Oct 28, 2025):

Hello @dennzimm , I’m in the same dilemma because, according to the Better Auth documentation, Auth.js has practically been left as a legacy library. In that sense, I’m exploring alternatives since I’m facing the same use case. Did you happen to find any alternative?

On the other hand, in the context of Next.js, I came across this library: https://github.com/vvo/iron-session.

Hey @moiseshp 🙂

I haven’t found a solid alternative yet. For now, we’re still using NextAuth v4, but I don’t think that’s a long-term solution given its current maintenance status.

I also looked into iron-session, but I’m not entirely sure how much would have to be implemented manually — things like session handling, token validation, refresh logic, and other features that libraries such as Auth.js or Better Auth usually provide out of the box.

Have you tried iron-session yourself? I’m curious if it actually feels like a good alternative in practice.

@dennzimm commented on GitHub (Oct 28, 2025): > Hello @dennzimm , I’m in the same dilemma because, according to the Better Auth documentation, Auth.js has practically been left as a legacy library. In that sense, I’m exploring alternatives since I’m facing the same use case. Did you happen to find any alternative? > > On the other hand, in the context of Next.js, I came across this library: [https://github.com/vvo/iron-session](https://github.com/vvo/iron-session). > Hey @moiseshp 🙂 I haven’t found a solid alternative yet. For now, we’re still using NextAuth v4, but I don’t think that’s a long-term solution given its current maintenance status. I also looked into iron-session, but I’m not entirely sure how much would have to be implemented manually — things like session handling, token validation, refresh logic, and other features that libraries such as Auth.js or Better Auth usually provide out of the box. Have you tried iron-session yourself? I’m curious if it actually feels like a good alternative in practice.

GiteaMirror commented

2026-03-13 09:18:08 -05:00

@moiseshp commented on GitHub (Oct 30, 2025):

Hello @dennzimm

I haven’t tried it yet, but I’m seriously considering using it for several reasons. One of them is that Next.js recommends or suggests it in the documentation as a valid feature for managing sessions — it’s not an authentication library per se. Likewise, I haven’t found a solution similar to the Auth.js library, but Better-Auth, based on its implementation logic, doesn’t yet allow me to integrate it with an external backend.

@moiseshp commented on GitHub (Oct 30, 2025): Hello @dennzimm I haven’t tried it yet, but I’m seriously considering using it for several reasons. One of them is that Next.js [recommends](https://nextjs.org/docs/app/guides/authentication#session-management) or suggests it in the documentation as a valid feature for managing sessions — it’s not an authentication library per se. Likewise, I haven’t found a solution similar to the Auth.js library, but Better-Auth, based on its implementation logic, doesn’t yet allow me to integrate it with an external backend.

GiteaMirror commented

2026-03-13 09:18:09 -05:00

@better-auth-agent[bot] commented on GitHub (Oct 30, 2025):

Better Auth is built around the idea of owning both the authentication logic and the session management through its own database-backed approach. That means for production use—with proper session persistence and reliable credential handling—a database connection is mandatory. Even though the package does offer some flexibility (for example, you can provide custom password verification or use social providers), there isn’t an out‐of‐the‐box mode that delegates the entire login process completely to an external backend.

In your scenario, even if you write a custom credentials provider that calls your external API (and you could do that), you will still need to have Better Auth manage the resulting session data and user records in its own database. The memory adapter (which might seem like an option to avoid a database) is only recommended for development and is not safe for production environments.

So, in summary:
• You can try to integrate with your external API via custom logic (e.g., within a credentials provider), but you’ll still need to hook into Better Auth’s session and account management that relies on a database. [1][2]
• Fully bypassing the internal authentication logic (i.e., not using the database at all) isn’t supported currently. [3]

For your next steps, consider:

Evaluating if you can adapt your external flow into a custom provider function that calls your backend, then updates the Better Auth session—keeping in mind that you must supply a production-ready database for session persistence.
Reviewing whether you might relax on having your external backend solely handle authentication, or if you’re amenable to a hybrid solution where Better Auth manages sessions while your backend still does credential validation via custom hooks.

This should help guide your troubleshooting and migration strategy.

Diagram • Discord • GitHub

@better-auth-agent[bot] commented on GitHub (Oct 30, 2025): Better Auth is built around the idea of owning both the authentication logic and the session management through its own database-backed approach. That means for production use—with proper session persistence and reliable credential handling—a database connection is mandatory. Even though the package does offer some flexibility (for example, you can provide custom password verification or use social providers), there isn’t an out‐of‐the‐box mode that delegates the entire login process completely to an external backend. In your scenario, even if you write a custom credentials provider that calls your external API (and you could do that), you will still need to have Better Auth manage the resulting session data and user records in its own database. The memory adapter (which might seem like an option to avoid a database) is only recommended for development and is not safe for production environments. So, in summary: • You can try to integrate with your external API via custom logic (e.g., within a credentials provider), but you’ll still need to hook into Better Auth’s session and account management that relies on a database. [[1]](https://github.com/better-auth/better-auth/issues/4771)[[2]](https://github.com/better-auth/better-auth/issues/2202) • Fully bypassing the internal authentication logic (i.e., not using the database at all) isn’t supported currently. [[3]](https://github.com/better-auth/better-auth/issues/1426) For your next steps, consider: 1. Evaluating if you can adapt your external flow into a custom provider function that calls your backend, then updates the Better Auth session—keeping in mind that you must supply a production-ready database for session persistence. 2. Reviewing whether you might relax on having your external backend solely handle authentication, or if you’re amenable to a hybrid solution where Better Auth manages sessions while your backend still does credential validation via custom hooks. This should help guide your troubleshooting and migration strategy.  [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)

GiteaMirror commented

2026-03-13 09:18:09 -05:00

@CanRau commented on GitHub (Oct 30, 2025):

This has been shipped as beta https://github.com/better-auth/better-auth/issues/2202

canary docs

I'm currently trying to implement it in a project

@CanRau commented on GitHub (Oct 30, 2025): This has been shipped as beta https://github.com/better-auth/better-auth/issues/2202 [canary docs](https://canary.better-auth.com/docs/concepts/session-management#stateless-with-secondary-storage) I'm currently trying to implement it in a project

GiteaMirror commented

2026-03-13 09:18:11 -05:00

@better-auth-agent[bot] commented on GitHub (Oct 30, 2025):

Yes, you can implement your external backend flow with Better Auth now. Recent beta work has introduced support for delegating authentication to an external API (your custom GraphQL endpoints) while Better Auth continues to manage sessions and middleware. In this configuration, your external backend handles credential validation and returns an { id, token } payload, and Better Auth—especially when using stateless mode with secondary storage—simply manages session logic.

Your next steps are:

Upgrade to the beta/canary release that supports this flow (as noted in the recent beta announcement).
Follow the canary documentation on stateless session management with secondary storage to configure Better Auth without using its internal credentials or social provider logic.
Configure your custom API endpoints so that they integrate with Better Auth’s session API accordingly.

This should allow you to use your existing external login logic alongside Better Auth's session management features [1], [2].

Diagram • Discord • GitHub

@better-auth-agent[bot] commented on GitHub (Oct 30, 2025): Yes, you can implement your external backend flow with Better Auth now. Recent beta work has introduced support for delegating authentication to an external API (your custom GraphQL endpoints) while Better Auth continues to manage sessions and middleware. In this configuration, your external backend handles credential validation and returns an { id, token } payload, and Better Auth—especially when using stateless mode with secondary storage—simply manages session logic. Your next steps are: 1. Upgrade to the beta/canary release that supports this flow (as noted in the recent beta announcement). 2. Follow the canary documentation on stateless session management with secondary storage to configure Better Auth without using its internal credentials or social provider logic. 3. Configure your custom API endpoints so that they integrate with Better Auth’s session API accordingly. This should allow you to use your existing external login logic alongside Better Auth's session management features [[1]](https://github.com/better-auth/better-auth/issues/4771), [[2]](https://github.com/better-auth/better-auth/issues/2202).  [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)

GiteaMirror referenced this issue

2026-03-13 11:32:32 -05:00

[PR #1971] [MERGED] docs: full babel config example for expo #4097

GiteaMirror referenced this issue

2026-04-13 08:20:00 -05:00

[PR #1971] [MERGED] docs: full babel config example for expo #12344

GiteaMirror referenced this issue

2026-04-15 20:03:37 -05:00

[PR #1971] [MERGED] docs: full babel config example for expo #20998

GiteaMirror referenced this issue

2026-04-17 20:59:19 -05:00

[PR #1971] [MERGED] docs: full babel config example for expo #29698

Sign in to join this conversation.

Branches Tags

dependabot/npm_and_yarn/demo/electron/demo-minor-patch-227a091249

dependabot/github_actions/github-actions-98f3470200

2026-05-13/ci/stabilize-docker-startup

dependabot/npm_and_yarn/samlify-2.13.0

changeset-release/main

main

2026-05-22/chore/adopt-agents-md

2026-05-22/refactor/string-case-utils

2026-05-14/fix/passkey-verify-error-and-claim

changeset-release/next

client-assertions-main

2026-05-15/ci/fix-sqlite-abi-mismatch

2026-05-15/fix/organization-team-add-cascade

2026-05-15/fix/parse-set-cookie-value-validation

2026-05-13/feat/captcha-wildcard-endpoints

fix/i18n-before-hook-translation

fix/disable-migration-generate

2026-05-07/fix/admin-set-password-upsert

2026-05-10/fix/cookie-drain-order

2026-05-10/feat/hooks-finally

2026-05-09/fix/cookie-drain-order

2026-05-09/feat/hooks-finally

2026-05-08/feat/register-before-send

fix/stripe/subscription-data-merge

2026-05-01/chore/pnpm-v11-harden

chore/pnpm-v11

2026-04-29/feat/google-include-granted-scopes

2026-04-29/fix/oauth-account-scope-semantics

2026-04-27/fix/nextcookies-idempotent-writes

2026-04-26/fix/harden-proxy-host-validation

2026-04-26/refactor/stripe-callback-signature-cleanup

2026-04-26/fix/stripe-subscription-callback-timing

2026-04-11/fix/sveltekit-app-modules

feat/open-api-zod-contract

feat/oauth-provider-backchannel-logout-next

feat/oauth-idp-initiated-bounce

refactor/sign-in-challenges

2026-04-21/fix/oauth-rfc-input-validation

fix/release-notes-new-packages

fix/two-factor-identity-guard

fix/resource

feat/emailpassword-authorize

2026-04-12/security/dynamic-baseurl-proxy-trust-default

feat/oauth-provider-at-hash-v2

fix/release-grep-fallback

claude/address-review-comments-JhFLr

claude/slack-update-stripe-docs-consistency-8Sc0w

feat/async-auth

fix/two-factor-totp-verified-enrollment

feat/plugin-ui

codex/blog-1-6-release-post

2026-04-06/fix/type-any-guards

2026-04-05/chore/downgrade-better-call

2026-04-04/ci/skip-vercel-fork-prs

2026-03-28/ci/add-autofix-ci

chore/release-preview-script

himself65/2026/02/19/role

2026-03-24/fix/update-user-info-on-link

2026-03-20/docs/improve-website

2026-03-20/fix/anonymous-onlinkaccount-expo

2026-02-17/fix/anonymous-link-state

fix/8607-saml-inresponseto

fix/8549-scim-patch-noop

v1.4.x

refactor/migration-snapshot-tests

worktree-magic-link-additional-data

chore/migrate-build-to-rollup

worktree-fix-dynamic-baseurl-8447

2026-03-06/chore/public-api-check

fix/close-8156-regression-test

fix/secondary-storage-json-error-handling

himself65/verification-namespace

cursor/issue-8307-validation-79a3

himself65/2026/01/30/error-mdx

v1.4.x-staging

fix/email-otp-user

fix/restrict-full-organization-access-roles

himself65/2026/02/12/count

himself65/2026/02/04/define-plugin

2026-02-04/feat/add-pluralize

cursor/better-auth-js-integration-ec21

cursor/expo-state-mismatch-394c

2026-02-01/fix/org-update-role-sync-members

cursor/issue-7607-investigation-e146

cursor/email-generation-helper-0ff6

himself65/2026/01/21/avoid-spread-operator

himself65/2026/01/14/cli

claude/slack-add-docs-pr-NMvgO

claude/slack-add-advanced-useplural-WHKYL

feat/hooks-pos

feat/2fa-phone

feat/2fa

fix/rotation

fix/username-check

v1.3.x

refactor/organization

feat/multiple-client-ids-social-providers

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/better-auth#1971