[GH-ISSUE #1143] Not compatible with Cloudflare Workers or edge environments #8615

New Issue

GiteaMirror · 2026-04-13T03:44:31-05:00

GiteaMirror commented

2026-04-13 03:44:31 -05:00

Originally created by @enqqi on GitHub (Jan 5, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/1143

Is this suited for github?

Yes, this is suited for github

To Reproduce

bun create hono@latest my-app (select workers template)
Setup better-auth for hono follow official better-auth docs
While setting it up, the documentation specifies that Better-Auth expects a specific export in a specific directory.
Here is where the first problem starts... You cannot follow the prescribed setup in a serverless environment (e.g., Cloudflare Workers) because env or bindings are not globally accessible.
Attempt to work around this limitation:
- Initialize the auth client dynamically in a middleware and set it in the context.
- However, when using this approach, the sign-in and sign-up endpoints return a 500 error. This happens due to the use of this internally by Better-Auth (I think).
- one of the errors was illegal use of this.
- The error occurs because the workaround relies on dynamically creating the auth client as a function, which is incompatible with Better-Auth’s design. Here’s an example of the workaround that triggers the issue:

export const getAuth = (env: Env) => betterAuth({ ... });

Better-Auth requires the auth instance to be a constant and located in a specific directory as per its documentation. This restriction makes it incompatible with the dynamic initialization needed for serverless environments like Cloudflare Workers.

Current vs. Expected behavior

Current Behavior

When attempting to use Better-Auth in edge environments like Cloudflare Workers, unexpected issues occur that prevent seamless integration and functionality.

Immutable Headers Error (500):
- After creating a user or logging in, a 500 error is thrown related to immutable headers.
Incompatibility with Exporting auth as a Function:
- Better-Auth’s internal packages fail to handle auth being exported as a function. This is necessary to dynamically pass secrets and bindings like KV.
- Workaround: Resorted to export const auth = ... and hardcoded sensitive variables (e.g., DB_URL), which is not ideal for security and flexibility.
Custom SecondaryStorage KV Issue:
- Unable to use a custom SecondaryStorage KV because it requires passing the actual KV binding, which is not supported in the current setup.

Expected Behavior

Seamless integration of Better-Auth with edge environments like Cloudflare Workers.
Ability to:
- Export auth as a function to dynamically handle secrets and bindings.
- Pass custom KV bindings for SecondaryStorage without issues.
No immutable header-related errors after user creation or login.

What version of Better Auth are you using?

1.1.10

Provide environment information

OS: macOS 15.2 24C101 arm64 
Host: Mac16,7 
Kernel: 24.2.0 
CPU: Apple M4 Pro 
GPU: Apple M4 Pro 
Memory: 4946MiB / 49152MiB

Which area(s) are affected? (Select all that apply)

Backend, Package

Auth config (if applicable)

Yes, I have nodejs_compat and als flags


export const auth = betterAuth({
  database: drizzleAdapter(drizzle(env.DB_URL), {
    provider: 'pg'
  }),
  baseURL: env.BASE_URL,
  secret: env.BASE_URL,
  plugins: [openAPI()],
  emailAndPassword: {
    enabled: true,
  },
  secondaryStorage: {
    get: env.AuthKV.get,
    set: (k, v) => env.AuthKV.put(k, v),
    delete: env.AuthKV.delete,
  }
})

Additional context

Global Variables or Storage:

While AsyncLocalStorage (similar to what Next.js uses) could be a potential solution, it requires a function context. Since this is not a function-based approach, store/context remains undefined.

Possible Solutions

Allow Better-Auth to be initialized as a function that accepts secrets and bindings as parameters, enabling dynamic initialization.
Provide a mechanism to use global variables in edge environments.
Explore leveraging AsyncLocalStorage or a similar approach to maintain context across asynchronous calls.

For further ideas, this discussion offers useful insights.

Originally created by @enqqi on GitHub (Jan 5, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/1143 ### Is this suited for github? - [X] Yes, this is suited for github ### To Reproduce 1. `bun create hono@latest my-app` (select workers template) 2. Setup better-auth for hono follow official better-auth [docs](https://www.better-auth.com/docs/integrations/hono) 3. While setting it up, the documentation specifies that Better-Auth expects a specific export in a [specific directory](https://www.better-auth.com/docs/installation#create-a-better-auth-instance). 4. Here is where the first problem starts... You cannot follow the prescribed setup in a serverless environment (e.g., Cloudflare Workers) because env or bindings are not globally accessible. 5. Attempt to work around this limitation: - Initialize the auth client dynamically in a middleware and set it in the context. - However, when using this approach, the sign-in and sign-up endpoints return a 500 error. This happens due to the use of this internally by Better-Auth (I think). - one of the errors was illegal use of `this`. - The error occurs because the workaround relies on dynamically creating the auth client as a function, which is incompatible with Better-Auth’s design. Here’s an example of the workaround that triggers the issue: ```typescript export const getAuth = (env: Env) => betterAuth({ ... }); ``` 7. Better-Auth requires the auth instance to be a constant and located in a specific directory as per its documentation. This restriction makes it incompatible with the dynamic initialization needed for serverless environments like Cloudflare Workers. ### Current vs. Expected behavior ## Current Behavior When attempting to use Better-Auth in edge environments like Cloudflare Workers, unexpected issues occur that prevent seamless integration and functionality. 1. **Immutable Headers Error (500):** - After creating a user or logging in, a 500 error is thrown related to immutable headers. 2. **Incompatibility with Exporting `auth` as a Function:** - Better-Auth’s internal packages fail to handle `auth` being exported as a function. This is necessary to dynamically pass secrets and bindings like KV. - **Workaround:** Resorted to `export const auth = ...` and hardcoded sensitive variables (e.g., `DB_URL`), which is not ideal for security and flexibility. 3. **Custom `SecondaryStorage` KV Issue:** - Unable to use a custom `SecondaryStorage` KV because it requires passing the actual KV binding, which is not supported in the current setup. ## Expected Behavior 1. Seamless integration of Better-Auth with edge environments like Cloudflare Workers. 2. Ability to: - Export `auth` as a function to dynamically handle secrets and bindings. - Pass custom KV bindings for `SecondaryStorage` without issues. 3. No immutable header-related errors after user creation or login. ### What version of Better Auth are you using? 1.1.10 ### Provide environment information ```bash OS: macOS 15.2 24C101 arm64 Host: Mac16,7 Kernel: 24.2.0 CPU: Apple M4 Pro GPU: Apple M4 Pro Memory: 4946MiB / 49152MiB ``` ### Which area(s) are affected? (Select all that apply) Backend, Package ### Auth config (if applicable) ```typescript Yes, I have nodejs_compat and als flags export const auth = betterAuth({ database: drizzleAdapter(drizzle(env.DB_URL), { provider: 'pg' }), baseURL: env.BASE_URL, secret: env.BASE_URL, plugins: [openAPI()], emailAndPassword: { enabled: true, }, secondaryStorage: { get: env.AuthKV.get, set: (k, v) => env.AuthKV.put(k, v), delete: env.AuthKV.delete, } }) ``` ### Additional context **Global Variables or Storage:** - While `AsyncLocalStorage` (similar to what Next.js uses) could be a potential solution, it requires a function context. Since this is not a function-based approach, store/context remains undefined. ### Possible Solutions - Allow Better-Auth to be initialized as a function that accepts secrets and bindings as parameters, enabling dynamic initialization. - Provide a mechanism to use global variables in edge environments. - Explore leveraging `AsyncLocalStorage` or a similar approach to maintain context across asynchronous calls. For further ideas, [this discussion](https://x.com/wesbos/status/1749974802050261339) offers useful insights.

GiteaMirror added the locked bug labels 2026-04-13 03:44:31 -05:00

GiteaMirror closed this issue

2026-04-13 03:44:31 -05:00

GiteaMirror commented

2026-04-13 03:44:33 -05:00

@kziemski commented on GitHub (Jan 6, 2025):

Less of a bug more of a feature enhancement and documentation issue.
I have react-router , better-auth, cloudlfare d1 and secondary storage with KV working in one.
Going to redo it as its own endpoint using hono.
but actually the frameworks get in the way.

@kziemski commented on GitHub (Jan 6, 2025): Less of a bug more of a feature enhancement and documentation issue. I have react-router , better-auth, cloudlfare d1 and secondary storage with KV working in one. Going to redo it as its own endpoint using hono. but actually the frameworks get in the way.

GiteaMirror commented

2026-04-13 03:44:33 -05:00

@enqqi commented on GitHub (Jan 6, 2025):

Could you please share your better-auth export (hide any sensitive info) just curious as to how did you pass secrets to the better-auth config @kziemski I think react-router gets deployed to Cloudflare pages not workers?

@enqqi commented on GitHub (Jan 6, 2025): Could you please share your better-auth export (hide any sensitive info) just curious as to how did you pass secrets to the better-auth config @kziemski I think react-router gets deployed to Cloudflare pages not workers?

GiteaMirror commented

2026-04-13 03:44:34 -05:00

@kumardeo commented on GitHub (Jan 7, 2025):

one of the errors was illegal use of this.

I am not sure, I think this is because of the following where you forgot to bind actual contexts for env.AuthKV.get and env.AuthKV.delete methods:

  secondaryStorage: {
    get: env.AuthKV.get,
    set: (k, v) => env.AuthKV.put(k, v),
    delete: env.AuthKV.delete,
  }

This should be something like:

  secondaryStorage: {
    get: env.AuthKV.get.bind(env.AuthKV),
    set: (k, v) => env.AuthKV.put(k, v),
    delete: env.AuthKV.delete.bind(env.AuthKV),
  }

Or:

  secondaryStorage: {
    get: (k) => env.AuthKV.get(k),
    set: (k, v) => env.AuthKV.put(k, v),
    delete: (k) => env.AuthKV.delete(k),
  }

@kumardeo commented on GitHub (Jan 7, 2025): > one of the errors was illegal use of `this`. I am not sure, I think this is because of the following where you forgot to bind actual contexts for `env.AuthKV.get` and `env.AuthKV.delete` methods: ``` secondaryStorage: { get: env.AuthKV.get, set: (k, v) => env.AuthKV.put(k, v), delete: env.AuthKV.delete, } ``` This should be something like: ``` secondaryStorage: { get: env.AuthKV.get.bind(env.AuthKV), set: (k, v) => env.AuthKV.put(k, v), delete: env.AuthKV.delete.bind(env.AuthKV), } ``` Or: ``` secondaryStorage: { get: (k) => env.AuthKV.get(k), set: (k, v) => env.AuthKV.put(k, v), delete: (k) => env.AuthKV.delete(k), } ```

GiteaMirror commented

2026-04-13 03:44:34 -05:00

@enqqi commented on GitHub (Jan 7, 2025):

Thank you for the help! 😄 Just to clarify, env isn’t actually available in this context—it was only included for illustrative purposes. Unfortunately, I can’t access env at the top level in CF workers as required by better-auth.

@enqqi commented on GitHub (Jan 7, 2025): Thank you for the help! 😄 Just to clarify, `env` isn’t actually available in this context—it was only included for illustrative purposes. Unfortunately, I can’t access env at the top level in CF workers as required by better-auth.

GiteaMirror commented

2026-04-13 03:44:35 -05:00

@darrenbutcher commented on GitHub (Jan 8, 2025):

Was having the same issue outline in 1. Immutable Headers with Hono & Expo (specifically onRequest). After doing alot of digging, as per the Hono Proxy docs, needed to clone the request object. The original expo (server) plugin sets the headers directly which causes the error. Bases on a solution I found elsewhere I decided to create my own plugin based on the original (the key bit):

    async onRequest(request, ctx) {
      // If the request has an "origin" header, do nothing
      if (request.headers.get("origin")) {
        return
      }

      // Get the "expo-origin" header
      const expoOrigin = request.headers.get("expo-origin")
      // If there's no "expo-origin" header, do nothing
      if (!expoOrigin) {
        return
      }

      // Clone the original request to ensure the body is not used multiple times
      const clonedRequest = request.clone()

      // Clone the headers and set the "origin" header to the value of "expo-origin"
      const newHeaders = new Headers(clonedRequest.headers)
      newHeaders.set("origin", expoOrigin)

      // Create a new Request object with updated headers and the cloned body
      // https://hono.dev/examples/proxy Hono TIP on Immutable headers
      const updatedRequest = new Request(clonedRequest, {
        headers: newHeaders,
      })

      return {
        request: updatedRequest,
      }
    }

Hope this helps @enzojs and anyone else having this issue.

@darrenbutcher commented on GitHub (Jan 8, 2025): Was having the same issue outline in 1. Immutable Headers with Hono & Expo (specifically onRequest). After doing alot of digging, as per the Hono Proxy docs, needed to `clone the request object`. The original expo (server) plugin sets the headers directly which causes the error. Bases on a solution I found elsewhere I decided to create my own plugin based on the original (the key bit): ```js async onRequest(request, ctx) { // If the request has an "origin" header, do nothing if (request.headers.get("origin")) { return } // Get the "expo-origin" header const expoOrigin = request.headers.get("expo-origin") // If there's no "expo-origin" header, do nothing if (!expoOrigin) { return } // Clone the original request to ensure the body is not used multiple times const clonedRequest = request.clone() // Clone the headers and set the "origin" header to the value of "expo-origin" const newHeaders = new Headers(clonedRequest.headers) newHeaders.set("origin", expoOrigin) // Create a new Request object with updated headers and the cloned body // https://hono.dev/examples/proxy Hono TIP on Immutable headers const updatedRequest = new Request(clonedRequest, { headers: newHeaders, }) return { request: updatedRequest, } } ``` Hope this helps @enzojs and anyone else having this issue.

GiteaMirror commented

2026-04-13 03:44:36 -05:00

@kziemski commented on GitHub (Jan 8, 2025):

Could you please share your better-auth export (hide any sensitive info) just curious as to how did you pass secrets to the better-auth config @kziemski I think react-router gets deployed to Cloudflare pages not workers?

apologies @enzojs came back up for air after i was working on some timing issues unrelated.

first off auth.local.ts for the migrate.

import { createSQLiteDB } from '@miniflare/shared';
import { D1Database, D1DatabaseAPI } from '@miniflare/d1';
import type { D1Database as D1DatabaseType } from '@cloudflare/workers-types'
import { Database } from 'better-sqlite3';
import { db as genDBConnection } from './app/lib/db';
import { auth as authServer } from './app/lib/auth.server';
const local_db = await createSQLiteDB(
    '<path to the local wrangler db.sqlite>'
)
const db = new D1Database(new D1DatabaseAPI(local_db)) as unknown as D1DatabaseType;
const local_db_connection = genDBConnection(db);
export const auth = authServer(local_db_connection,null, {
    baseURL: 'http://localhost:8787',
    secret: 'secret',
})

then workers/app.ts

import '../worker-configuration.d.ts'
import { createRequestHandler } from "react-router";
import { type AuthType, loadContext } from "./load-context";

declare global {
  interface CloudflareEnvironment extends Env {}
}

const defaultHandler = {
  async fetch(request: RequestType, env: Env, ctx: ExecutionContext) {
    const args = {request, env, ctx};
    const _loadContext = loadContext(args);
    if(request.url.includes("/api/auth")) {
        return _loadContext.auth.handler(_request)
    } else {
        return requestHandler(_request,_loadContext )
    }
  } 
} 

const requestHandler = createRequestHandler(
  // @ts-expect-error - virtual module provided by React Router at build time
  () => import("virtual:react-router/server-build"),
  import.meta.env.MODE
);

export default defaultHandler;

then workers/load-context.ts

import { AppLoadContext } from "react-router";
import { type AuthType as _AuthType, auth } from "../app/lib/auth.server"
import { db as dbGen } from "../app/lib/db"
import  { type Kysely, type Dialect } from "kysely";
export type AuthType = _AuthType;
import { type ExecutionContext } from "@cloudflare/workers-types";

// type AuthType = export (db: DB, kv: KVNamespace | null, _settings: Partial<BetterAuthOptions>): ReturnType<typeof betterAuth>

declare module "react-router" {
    export interface AppLoadContext {
      cloudflare: {
        env: CloudflareEnvironment;
        ctx: ExecutionContext;
      };
      auth: AuthType;
    }
  }
let db: Kysely<Dialect> | null = null;
let authInstance: AuthType | null = null;
export type MyExecutionContext = ExecutionContext;

export function loadContext<R,E extends Env,C extends ExecutionContext >({request, env,ctx}: {request: R, env: E, ctx: C}): AppLoadContext {
  const _d1db = env.AUTH
  if(authInstance === null) {
    if(db === null)  {
      db = dbGen(_d1db)
    }
    authInstance = auth(db, env.AUTH_STORE,{ secret: env.BETTER_AUTH_SECRET || process.env.BETTER_AUTH_SECRET, } )
  }
  
  return {
    cloudflare: { env, ctx },
    auth: authInstance,
  }
}

then the vite.config.ts

import { reactRouter } from "@react-router/dev/vite";
import { cloudflareDevProxy } from '@react-router/dev/vite/cloudflare'
import autoprefixer from "autoprefixer";
import tailwindcss from "tailwindcss";
import { defineConfig } from "vite";
import tsconfigPaths from "vite-tsconfig-paths";
import { type MyExecutionContext, loadContext } from "./workers/load-context.ts";
import { sentryVitePlugin } from "@sentry/vite-plugin";

export default defineConfig(({ isSsrBuild, ...configOptions }) => {
  
  return {
    define: {
      ...(isSsrBuild? {
        'process.env.BETTER_AUTH_SECRET': JSON.stringify(process?.env?.BETTER_AUTH_SECRET || '')
      } : {}),
    },
    server: {
      port: 8787,
    },
    build: {
      rollupOptions: isSsrBuild
        ? {
          input: {
            "assets/server-build.js": "virtual:react-router/server-build",
            "worker-entry.js": "./workers/app.ts",

          },
          treeshake: 'safest',
          output: {
            format: 'esm',
          }
        }
        : undefined,
    },
    css: {
      postcss: {
        plugins: [tailwindcss, autoprefixer],
      },
    },
    ssr: {

      target: "webworker",
      noExternal: true,
      external: ['node:async_hooks'],
      resolve: {
        conditions: ["workerd", "browser"],
        // conditions: ["workerd"],
      },
      optimizeDeps: {
        include: [
          "react",
          "react/jsx-runtime",
          "react/jsx-dev-runtime",
          "react-dom",
          "react-dom/server",
          "react-router",
        ],
      },
    },
    plugins: [
      cloudflareDevProxy({
        getLoadContext({ request,context}) {
          const { env, ctx } = context.cloudflare;
          const { props = {}, waitUntil = () => {}, passThroughOnException = () => {}, ...rest} = ctx as any;
          const _ctx: MyExecutionContext = {
            props: {},
            waitUntil: () => {},
            passThroughOnException: () => {},
            ...rest,
          }
          return loadContext({ request, env, ctx: _ctx })
        },
      }),
      reactRouter(),
      {
        // This plugin is required so both `index.js` / `worker.js can be
        // generated for the `build` config above
        name: "react-router-cloudflare-workers",
        config: () => ({
          build: {
            rollupOptions: isSsrBuild
              ? {
                  output: {
                    entryFileNames: "[name]",
                  },
                }
              : undefined,
          },
        }),
      },
      tsconfigPaths(),
    ],
  }
});

finally the wrangler.toml

name = "worker name"
compatibility_date = "2024-11-18"
compatibility_flags = ["nodejs_compat"]
main = "./build/server/worker-entry.js"
assets = { directory = "./build/client/" }
... rest of the config for d1,secrets etc

@kziemski commented on GitHub (Jan 8, 2025): > Could you please share your better-auth export (hide any sensitive info) just curious as to how did you pass secrets to the better-auth config @kziemski I think react-router gets deployed to Cloudflare pages not workers? apologies @enzojs came back up for air after i was working on some timing issues unrelated. first off auth.local.ts for the migrate. ``` import { createSQLiteDB } from '@miniflare/shared'; import { D1Database, D1DatabaseAPI } from '@miniflare/d1'; import type { D1Database as D1DatabaseType } from '@cloudflare/workers-types' import { Database } from 'better-sqlite3'; import { db as genDBConnection } from './app/lib/db'; import { auth as authServer } from './app/lib/auth.server'; const local_db = await createSQLiteDB( '<path to the local wrangler db.sqlite>' ) const db = new D1Database(new D1DatabaseAPI(local_db)) as unknown as D1DatabaseType; const local_db_connection = genDBConnection(db); export const auth = authServer(local_db_connection,null, { baseURL: 'http://localhost:8787', secret: 'secret', }) ``` then workers/app.ts ``` import '../worker-configuration.d.ts' import { createRequestHandler } from "react-router"; import { type AuthType, loadContext } from "./load-context"; declare global { interface CloudflareEnvironment extends Env {} } const defaultHandler = { async fetch(request: RequestType, env: Env, ctx: ExecutionContext) { const args = {request, env, ctx}; const _loadContext = loadContext(args); if(request.url.includes("/api/auth")) { return _loadContext.auth.handler(_request) } else { return requestHandler(_request,_loadContext ) } } } const requestHandler = createRequestHandler( // @ts-expect-error - virtual module provided by React Router at build time () => import("virtual:react-router/server-build"), import.meta.env.MODE ); export default defaultHandler; ``` then workers/load-context.ts ``` import { AppLoadContext } from "react-router"; import { type AuthType as _AuthType, auth } from "../app/lib/auth.server" import { db as dbGen } from "../app/lib/db" import { type Kysely, type Dialect } from "kysely"; export type AuthType = _AuthType; import { type ExecutionContext } from "@cloudflare/workers-types"; // type AuthType = export (db: DB, kv: KVNamespace | null, _settings: Partial<BetterAuthOptions>): ReturnType<typeof betterAuth> declare module "react-router" { export interface AppLoadContext { cloudflare: { env: CloudflareEnvironment; ctx: ExecutionContext; }; auth: AuthType; } } let db: Kysely<Dialect> | null = null; let authInstance: AuthType | null = null; export type MyExecutionContext = ExecutionContext; export function loadContext<R,E extends Env,C extends ExecutionContext >({request, env,ctx}: {request: R, env: E, ctx: C}): AppLoadContext { const _d1db = env.AUTH if(authInstance === null) { if(db === null) { db = dbGen(_d1db) } authInstance = auth(db, env.AUTH_STORE,{ secret: env.BETTER_AUTH_SECRET || process.env.BETTER_AUTH_SECRET, } ) } return { cloudflare: { env, ctx }, auth: authInstance, } } ``` then the vite.config.ts ``` import { reactRouter } from "@react-router/dev/vite"; import { cloudflareDevProxy } from '@react-router/dev/vite/cloudflare' import autoprefixer from "autoprefixer"; import tailwindcss from "tailwindcss"; import { defineConfig } from "vite"; import tsconfigPaths from "vite-tsconfig-paths"; import { type MyExecutionContext, loadContext } from "./workers/load-context.ts"; import { sentryVitePlugin } from "@sentry/vite-plugin"; export default defineConfig(({ isSsrBuild, ...configOptions }) => { return { define: { ...(isSsrBuild? { 'process.env.BETTER_AUTH_SECRET': JSON.stringify(process?.env?.BETTER_AUTH_SECRET || '') } : {}), }, server: { port: 8787, }, build: { rollupOptions: isSsrBuild ? { input: { "assets/server-build.js": "virtual:react-router/server-build", "worker-entry.js": "./workers/app.ts", }, treeshake: 'safest', output: { format: 'esm', } } : undefined, }, css: { postcss: { plugins: [tailwindcss, autoprefixer], }, }, ssr: { target: "webworker", noExternal: true, external: ['node:async_hooks'], resolve: { conditions: ["workerd", "browser"], // conditions: ["workerd"], }, optimizeDeps: { include: [ "react", "react/jsx-runtime", "react/jsx-dev-runtime", "react-dom", "react-dom/server", "react-router", ], }, }, plugins: [ cloudflareDevProxy({ getLoadContext({ request,context}) { const { env, ctx } = context.cloudflare; const { props = {}, waitUntil = () => {}, passThroughOnException = () => {}, ...rest} = ctx as any; const _ctx: MyExecutionContext = { props: {}, waitUntil: () => {}, passThroughOnException: () => {}, ...rest, } return loadContext({ request, env, ctx: _ctx }) }, }), reactRouter(), { // This plugin is required so both `index.js` / `worker.js can be // generated for the `build` config above name: "react-router-cloudflare-workers", config: () => ({ build: { rollupOptions: isSsrBuild ? { output: { entryFileNames: "[name]", }, } : undefined, }, }), }, tsconfigPaths(), ], } }); ``` finally the wrangler.toml ``` name = "worker name" compatibility_date = "2024-11-18" compatibility_flags = ["nodejs_compat"] main = "./build/server/worker-entry.js" assets = { directory = "./build/client/" } ... rest of the config for d1,secrets etc ```

GiteaMirror commented

2026-04-13 03:44:36 -05:00

@kziemski commented on GitHub (Jan 8, 2025):

apologies dumped this in here and did some rough edits. this is for react-router i'll rework it for hono in a little bit but you should be able to work out any issues you might have related to cf.

@kziemski commented on GitHub (Jan 8, 2025): apologies dumped this in here and did some rough edits. this is for react-router i'll rework it for hono in a little bit but you should be able to work out any issues you might have related to cf.

GiteaMirror commented

2026-04-13 03:44:38 -05:00

@zhawtof commented on GitHub (Jan 21, 2025):

@kziemski I'm not exactly sure what your code is doing, but I also would love to see what you're doing in auth.server since that seems to be the part that involves the heavy lifting of converting.

Also running into the same Cloudflare Workers issue as @enzojs

@zhawtof commented on GitHub (Jan 21, 2025): @kziemski I'm not exactly sure what your code is doing, but I also would love to see what you're doing in `auth.server` since that seems to be the part that involves the heavy lifting of converting. Also running into the same Cloudflare Workers issue as @enzojs

GiteaMirror commented

2026-04-13 03:44:38 -05:00

@kziemski commented on GitHub (Jan 21, 2025):

//auth.server.ts
// more or less the following

import { betterAuth, type BetterAuthOptions } from "better-auth"
import { passkey } from "better-auth/plugins/passkey"
import { anonymous, magicLink, emailOTP, multiSession, jwt, admin, organization, openAPI } from "better-auth/plugins"
import { expo } from "@better-auth/expo";
import type { DB } from "./db"


export const auth = (db: DB, kv: KVNamespace | null, { trustedOrigins = [], socialProviders : defaultSocialProviders = {}, ...settings }: Partial<BetterAuthOptions>): ReturnType<typeof betterAuth> => {
    const socialProviders = {
        ...defaultSocialProviders,
        
    }
    return betterAuth({
        socialProviders,
        ...settings,
        ...(kv !== null ? {
            secondaryStorage: {
                async get(key: string) {
                    return await kv.get(key);
                },
                async set(key: string, value: string) {
                    await kv.put(key, value);
                },
                async delete(key: string) {
                    await kv.delete(key);
                },
            }
        } : {}),
        trustedOrigins: [...new Set([...trustedOrigins, 'http://localhost:8787', 'http://localhost'])],
        account: {
            accountLinking: {
                enabled: true,
            },
        },
        database: {
            db,
            type: 'sqlite',
        },
        emailAndPassword: {
            enabled: true,
            autoSignIn: true,
        },
        // rateLimit: {
        //     window: 10,
        //     max: 100,
        // },
        session: {
            expiresIn: 60 * 60 * 24 * 7,
            updateAge: 60 * 60 * 24,
            cookieCache: {
                enabled: true,
                maxAge: 5 * 60 // Cache duration in seconds
            }

        },
        plugins: [
            anonymous(),
            magicLink({
                sendMagicLink: async ({ email, url, token }) => {
                    console.log('Sending magic link to', email, 'with url', url, 'and token', token)
                }
            }),
            emailOTP({
                sendVerificationOTP: async ({ email, type }) => {
                    console.log('Sending verification OTP to', email, 'with type', type)
                }
            }),
            multiSession(),
            jwt(),
            passkey(),
            admin(),
            organization(),
            openAPI(),
            expo(),
        ]
    });
}

export type AuthType = ReturnType<typeof auth>;
export type Session = AuthType['$Infer']['Session']

@kziemski commented on GitHub (Jan 21, 2025): ``` //auth.server.ts // more or less the following import { betterAuth, type BetterAuthOptions } from "better-auth" import { passkey } from "better-auth/plugins/passkey" import { anonymous, magicLink, emailOTP, multiSession, jwt, admin, organization, openAPI } from "better-auth/plugins" import { expo } from "@better-auth/expo"; import type { DB } from "./db" export const auth = (db: DB, kv: KVNamespace | null, { trustedOrigins = [], socialProviders : defaultSocialProviders = {}, ...settings }: Partial<BetterAuthOptions>): ReturnType<typeof betterAuth> => { const socialProviders = { ...defaultSocialProviders, } return betterAuth({ socialProviders, ...settings, ...(kv !== null ? { secondaryStorage: { async get(key: string) { return await kv.get(key); }, async set(key: string, value: string) { await kv.put(key, value); }, async delete(key: string) { await kv.delete(key); }, } } : {}), trustedOrigins: [...new Set([...trustedOrigins, 'http://localhost:8787', 'http://localhost'])], account: { accountLinking: { enabled: true, }, }, database: { db, type: 'sqlite', }, emailAndPassword: { enabled: true, autoSignIn: true, }, // rateLimit: { // window: 10, // max: 100, // }, session: { expiresIn: 60 * 60 * 24 * 7, updateAge: 60 * 60 * 24, cookieCache: { enabled: true, maxAge: 5 * 60 // Cache duration in seconds } }, plugins: [ anonymous(), magicLink({ sendMagicLink: async ({ email, url, token }) => { console.log('Sending magic link to', email, 'with url', url, 'and token', token) } }), emailOTP({ sendVerificationOTP: async ({ email, type }) => { console.log('Sending verification OTP to', email, 'with type', type) } }), multiSession(), jwt(), passkey(), admin(), organization(), openAPI(), expo(), ] }); } export type AuthType = ReturnType<typeof auth>; export type Session = AuthType['$Infer']['Session'] ```

GiteaMirror commented

2026-04-13 03:44:39 -05:00

@enqqi commented on GitHub (Feb 4, 2025):

It would be fine if you could export an auth function that returns the better auth instance, but that is not the case as I mentioned in point 5 of my reproduction steps

@enqqi commented on GitHub (Feb 4, 2025): It would be fine if you could export an auth function that returns the better auth instance, but that is not the case as I mentioned in point 5 of my reproduction steps

GiteaMirror commented

2026-04-13 03:44:40 -05:00

@Kylar13 commented on GitHub (Feb 4, 2025):

It would be fine if you could export an auth function that returns the better auth instance, but that is not the case as I mentioned in point 5 of my reproduction steps

It's my understanding that you can definetly make it a function that returns the instance, but then the CLI wont work.
My current workaround for that is the following:

// AppLoadContext is provided by react-router, and has the cloudflare object if configured for deploy on workers
export const getAuth = ({ context }: { context: AppLoadContext }) =>
  betterAuth({
    // rest of your config
    socialProviders: {
      google: {
        enabled: true,
        clientId: context.cloudflare.env.GOOGLE_CLIENT_ID as string, // <-- Access vars from context
        clientSecret: context.cloudflare.env.GOOGLE_CLIENT_SECRET as string,
      },
    },
  });

// Uncomment this if you need to run any better-auth CLI commands
// Run commands using `dotenv -e .dev.vars -- npx @better-auth/cli <command>`

// export const auth = betterAuth({
//    // rest of your config
//    socialProviders: {
//      google: {
//        enabled: true,
//        clientId: process.env.GOOGLE_CLIENT_ID as string, // <-- Access vars from env, and load dotenv in script
//        clientSecret: process.env.GOOGLE_CLIENT_SECRET as string,
//      },
//    },
// });

You do need to install dotenv-cli for this to work, and you can set up a script "better-auth": "dotenv -e .dev.vars -- npx @better-auth/cli", and run it using pnpm better-auth migrate, for example

Not the most comfortable workaround, but it gets the job done, and you don't really need to run the CLI that often.

This is what a sample loader/action would look like using the function approach:

export const loader = async ({ request, context }: Route.LoaderArgs) => {
  const auth = await getAuth({ context }).api.getSession({
    headers: request.headers,
  })
  if (!auth.session) {
    return redirect("/sign-up");
  }
  return { data: "Your data" };
};

@Kylar13 commented on GitHub (Feb 4, 2025): > It would be fine if you could export an auth function that returns the better auth instance, but that is not the case as I mentioned in point 5 of my reproduction steps It's my understanding that you can definetly make it a function that returns the instance, but then the CLI wont work. My current workaround for that is the following: ``` // AppLoadContext is provided by react-router, and has the cloudflare object if configured for deploy on workers export const getAuth = ({ context }: { context: AppLoadContext }) => betterAuth({ // rest of your config socialProviders: { google: { enabled: true, clientId: context.cloudflare.env.GOOGLE_CLIENT_ID as string, // <-- Access vars from context clientSecret: context.cloudflare.env.GOOGLE_CLIENT_SECRET as string, }, }, }); // Uncomment this if you need to run any better-auth CLI commands // Run commands using `dotenv -e .dev.vars -- npx @better-auth/cli <command>` // export const auth = betterAuth({ // // rest of your config // socialProviders: { // google: { // enabled: true, // clientId: process.env.GOOGLE_CLIENT_ID as string, // <-- Access vars from env, and load dotenv in script // clientSecret: process.env.GOOGLE_CLIENT_SECRET as string, // }, // }, // }); ``` You do need to install `dotenv-cli` for this to work, and you can set up a script `"better-auth": "dotenv -e .dev.vars -- npx @better-auth/cli",` and run it using `pnpm better-auth migrate`, for example Not the most comfortable workaround, but it gets the job done, and you don't really need to run the CLI that often. This is what a sample loader/action would look like using the function approach: ``` export const loader = async ({ request, context }: Route.LoaderArgs) => { const auth = await getAuth({ context }).api.getSession({ headers: request.headers, }) if (!auth.session) { return redirect("/sign-up"); } return { data: "Your data" }; }; ```

GiteaMirror commented

2026-04-13 03:44:41 -05:00

@kumardeo commented on GitHub (Feb 4, 2025):

When I need my env exposed to process.env I use AsyncLocalStorage API to achieve this. The same approach is used in @cloudflare/next-on-pages or @opennext/cloudflare.

// src/worker.ts
const cloudflareALSPromise = Promise.all([import('node:async_hooks'), import('node:process') as unknown as Promise<{ env: object }>])
	.then(([{ AsyncLocalStorage }, { env }]) => {
		const cloudflareALS = new AsyncLocalStorage<{
			env: object;
			ctx: ExecutionContext;
			cf?: IncomingRequestCfProperties<unknown>;
		}>();

		Object.setPrototypeOf(
			env,
			new Proxy(
				{},
				{
					ownKeys: (target) => Reflect.ownKeys(cloudflareALS.getStore()?.env ?? env),
					getOwnPropertyDescriptor: (target, ...args) => Reflect.getOwnPropertyDescriptor(cloudflareALS.getStore()?.env ?? env, ...args),
					get: (target, property) => Reflect.get(cloudflareALS.getStore()?.env ?? env, property),
					set: (target, property, value) => Reflect.set(cloudflareALS.getStore()?.env ?? env, property, value),
				}
			)
		);

		return cloudflareALS;
	})
	.catch(() => {
		throw new Error('Failed to proxy process.env, nodejs_compat flag is not enabled');
	});

export default {
	async fetch(request, env, ctx) {
		return (await cloudflareALSPromise).run({ env, ctx, cf: request.cf }, async () => {
			return (await import('./app')).default.fetch(request, env, ctx);
		});
	},
	async scheduled(controller, env, ctx) {
		return (await cloudflareALSPromise).run({ env, ctx }, async () => {
			return (await import('./app')).default.scheduled(controller, env, ctx);
		});
	},
} satisfies ExportedHandler<Env>;

Warning

We need to dynamically import src/app.ts inside handlers as shown above

Tip

We will write our actual code in src/app.ts and not in src/worker.ts

// src/app.ts
import { Hono } from 'hono';
import { auth } from './lib/auth';

// you can access env here :)
console.log(process.env.BETTER_AUTH_SECRET);

const app = new Hono<{
	Bindings: Env;
}>().on(["POST", "GET"], "/api/auth/**", (c) => auth.handler(c.req.raw));

export default {
	fetch: app.fetch,
	async scheduled(controller, env, ctx) {},
} satisfies ExportedHandler<Env>;

// src/lib/auth.ts
import { betterAuth } from 'better-auth';
import { drizzleAdapter } from 'better-auth/adapters/drizzle';
import { db } from '../db/db';

export const auth = betterAuth({
	secret: process.env.BETTER_AUTH_SECRET,
	baseURL: process.env.BETTER_AUTH_URL,
	database: drizzleAdapter(db, { provider: 'sqlite' }),
});

// package.json
{
  // ...
  "scripts": {
    // ...
    "auth:generate": "pnpx @better-auth/cli@latest generate --output=src/db/schema/auth.ts --y"
  }
}

// wrangler.json
{
	"$schema": "node_modules/wrangler/config-schema.json",
	"name": "my-workers-app",
	"main": "src/worker.ts",
	"compatibility_date": "2025-01-29",
	"compatibility_flags": ["nodejs_compat"],
	"dev": {
		"port": 3000
	},
	"observability": {
		"enabled": true
	},
	"d1_databases": [{ "binding": "DB", "database_name": "xxxxx", "database_id": "xxxxx" }]
}

@kumardeo commented on GitHub (Feb 4, 2025): When I need my `env` exposed to `process.env` I use `AsyncLocalStorage` API to achieve this. The same approach is used in `@cloudflare/next-on-pages` or `@opennext/cloudflare`. ```typescript // src/worker.ts const cloudflareALSPromise = Promise.all([import('node:async_hooks'), import('node:process') as unknown as Promise<{ env: object }>]) .then(([{ AsyncLocalStorage }, { env }]) => { const cloudflareALS = new AsyncLocalStorage<{ env: object; ctx: ExecutionContext; cf?: IncomingRequestCfProperties<unknown>; }>(); Object.setPrototypeOf( env, new Proxy( {}, { ownKeys: (target) => Reflect.ownKeys(cloudflareALS.getStore()?.env ?? env), getOwnPropertyDescriptor: (target, ...args) => Reflect.getOwnPropertyDescriptor(cloudflareALS.getStore()?.env ?? env, ...args), get: (target, property) => Reflect.get(cloudflareALS.getStore()?.env ?? env, property), set: (target, property, value) => Reflect.set(cloudflareALS.getStore()?.env ?? env, property, value), } ) ); return cloudflareALS; }) .catch(() => { throw new Error('Failed to proxy process.env, nodejs_compat flag is not enabled'); }); export default { async fetch(request, env, ctx) { return (await cloudflareALSPromise).run({ env, ctx, cf: request.cf }, async () => { return (await import('./app')).default.fetch(request, env, ctx); }); }, async scheduled(controller, env, ctx) { return (await cloudflareALSPromise).run({ env, ctx }, async () => { return (await import('./app')).default.scheduled(controller, env, ctx); }); }, } satisfies ExportedHandler<Env>; ``` > [!WARNING] > We need to dynamically import `src/app.ts` inside handlers as shown above > [!TIP] > We will write our actual code in `src/app.ts` and not in `src/worker.ts` ```typescript // src/app.ts import { Hono } from 'hono'; import { auth } from './lib/auth'; // you can access env here :) console.log(process.env.BETTER_AUTH_SECRET); const app = new Hono<{ Bindings: Env; }>().on(["POST", "GET"], "/api/auth/**", (c) => auth.handler(c.req.raw)); export default { fetch: app.fetch, async scheduled(controller, env, ctx) {}, } satisfies ExportedHandler<Env>; ``` ```typescript // src/lib/auth.ts import { betterAuth } from 'better-auth'; import { drizzleAdapter } from 'better-auth/adapters/drizzle'; import { db } from '../db/db'; export const auth = betterAuth({ secret: process.env.BETTER_AUTH_SECRET, baseURL: process.env.BETTER_AUTH_URL, database: drizzleAdapter(db, { provider: 'sqlite' }), }); ``` ```jsonc // package.json { // ... "scripts": { // ... "auth:generate": "pnpx @better-auth/cli@latest generate --output=src/db/schema/auth.ts --y" } } ``` ```jsonc // wrangler.json { "$schema": "node_modules/wrangler/config-schema.json", "name": "my-workers-app", "main": "src/worker.ts", "compatibility_date": "2025-01-29", "compatibility_flags": ["nodejs_compat"], "dev": { "port": 3000 }, "observability": { "enabled": true }, "d1_databases": [{ "binding": "DB", "database_name": "xxxxx", "database_id": "xxxxx" }] } ```

GiteaMirror commented

2026-04-13 03:44:43 -05:00

@enqqi commented on GitHub (Feb 4, 2025):

I managed to get to make it work! Here is how i did it:

This is a hono auth server deployed to cloudflare workers

auth.ts

import type { AppEnv } from "@/types/Env";
import { betterAuth } from "better-auth";
import { drizzleAdapter } from "better-auth/adapters/drizzle";
import {
  createAuthMiddleware,
  emailOTP,
  jwt,
  openAPI,
} from "better-auth/plugins";
import type { Context } from "hono";

// notice how this is a function that recieves the context
export const getAuth = (c: Context<AppEnv>) =>
  betterAuth({
    database: drizzleAdapter(c.get("db"), {
      provider: "pg",
    }),
    baseURL: c.env.AUTH_BASE_URL,
    secret: c.env.AUTH_SK,
    plugins: [
      openAPI(),
      jwt(),
      emailOTP({
        sendVerificationOTP: async (d, request) => {
          console.log(JSON.stringify(d, null, 2));
        },
      }),
    ],
    hooks: {
      after: createAuthMiddleware(async (ctx) => {
        console.log(ctx)
      }),
    },
    emailAndPassword: {
      enabled: true,
    },
    secondaryStorage: {
      get: c.env.AuthKV.get,
      set: (k, v) => c.env.AuthKV.put(k, v),
      delete: c.env.AuthKV.delete,
    },
    rateLimit: {
      window: 30, // time window in seconds
      max: 40, // max requests in the window
    },
    advanced: {
      cookiePrefix: "yummy",
      // https://www.better-auth.com/docs/integrations/hono#cross-domain-cookies
      crossSubDomainCookies: {
        enabled: true,
      },
      // https://www.better-auth.com/docs/concepts/database#id-generation
      // generateId: o => o.model
    },
    user: {
      modelName: "users",
      fields: {
        name: "full_name",
        emailVerified: "email_verified",
        createdAt: "created_at",
        image: "pfp_url",
        updatedAt: "updated_at",
      },
    },
    jwks: {
      modelName: "jwks",
      fields: {
        privateKey: "private_key",
        publicKey: "public_key",
        createdAt: "created_at",
      },
    },
    session: {
      modelName: "auth_sessions",
      fields: {
        userId: "user_id",
        ipAddress: "ip",
        userAgent: "user_agent",
        expiresAt: "expires_at",
        createdAt: "created_at",
        updatedAt: "updated_at",
      },
    },
    account: {
      modelName: "auth_providers",
      fields: {
        userId: "user_id",
        createdAt: "created_at",
        updatedAt: "updated_at",
        accessTokenExpiresAt: "access_token_exp_at",
        refreshTokenExpiresAt: "refresh_token_exp_at",
        accessToken: "access_token",
        refreshToken: "refresh_token",
        providerId: "sso_provider_id",
        accountId: "sso_account_id",
      },
    },
    verification: {
      modelName: "auth_verifications",
      fields: {
        expiresAt: "expires_at",
        createdAt: "created_at",
        updatedAt: "updated_at",
      },
    },
  });

Then in the routes:

import { Hono } from "hono";
import { cors } from "hono/cors";
import { contextMiddleware } from "./mw/ctx";
import type { AppEnv } from "./types/Env";
import { contextStorage } from "hono/context-storage";
import { getAuth } from "./auth";

const app = new Hono<AppEnv>();

app.use("*", contextMiddleware);

app.use(
  "/api/auth/**",
  cors({
    origin: "http://localhost:8787", // replace with your origin
    allowHeaders: ["Content-Type", "Authorization"],
    allowMethods: ["POST", "GET", "OPTIONS"],
    exposeHeaders: ["Content-Length"],
    maxAge: 600,
    credentials: true,
  }),
);

app.on(["POST", "GET"], "/api/auth/**", (c) => getAuth(c).handler(c.req.raw));

// this is optional since you can get the session from better-auth endpoint
app.get("/session", async (c) => {
  const session = c.get("session"); // ctx.ts to see how this is set
  const user = c.get("user");

  if (!user) return c.body(null, 401);

  return c.json({
    session,
    user,
  });
});

export default app;

ctx.ts

import { getAuth } from "@/auth";
import type { AppEnv } from "@/types/Env";
import { getConnection } from "@cpr/utils";
import { createMiddleware } from "hono/factory";

export const contextMiddleware = createMiddleware<AppEnv>(async (c, next) => {
  // `getConnection` is an internal pkg from my monorepo
  // returns a postgres-js drizzle instance
  const db = getConnection(c.env.DB_URL);
  
  c.set("db", db); // set db to access it in `getAuth`

  // you don't really need any of this last part
  const session = await getAuth(c).api.getSession({
    headers: c.req.raw.headers,
  });

  if (!session) {
    c.set("user", null);
    c.set("session", null);
    return next();
  }

  c.set("user", session.user);
  c.set("session", session.session);
  await next()
});

Caveats:

As @Kylar13 pointed out, the CLI won’t work in this case because it relies on the auth singleton. If the maintainers are open to it, I’d be happy to submit a PR to make functions compatible with the CLI! :)

That said, not using the CLI isn’t a huge issue—you can simply check the documentation for the plugin you need and manually create or update the schema. If you’re renaming columns, just be sure to map the correct fields in the betterAuth config.

I’m still running into some issues with React Native, but they don’t seem related to this. I’ll need to do some more testing to confirm if there’s actually a problem.

@enqqi commented on GitHub (Feb 4, 2025): I managed to get to make it work! Here is how i did it: This is a hono auth server deployed to cloudflare workers auth.ts ```typescript import type { AppEnv } from "@/types/Env"; import { betterAuth } from "better-auth"; import { drizzleAdapter } from "better-auth/adapters/drizzle"; import { createAuthMiddleware, emailOTP, jwt, openAPI, } from "better-auth/plugins"; import type { Context } from "hono"; // notice how this is a function that recieves the context export const getAuth = (c: Context<AppEnv>) => betterAuth({ database: drizzleAdapter(c.get("db"), { provider: "pg", }), baseURL: c.env.AUTH_BASE_URL, secret: c.env.AUTH_SK, plugins: [ openAPI(), jwt(), emailOTP({ sendVerificationOTP: async (d, request) => { console.log(JSON.stringify(d, null, 2)); }, }), ], hooks: { after: createAuthMiddleware(async (ctx) => { console.log(ctx) }), }, emailAndPassword: { enabled: true, }, secondaryStorage: { get: c.env.AuthKV.get, set: (k, v) => c.env.AuthKV.put(k, v), delete: c.env.AuthKV.delete, }, rateLimit: { window: 30, // time window in seconds max: 40, // max requests in the window }, advanced: { cookiePrefix: "yummy", // https://www.better-auth.com/docs/integrations/hono#cross-domain-cookies crossSubDomainCookies: { enabled: true, }, // https://www.better-auth.com/docs/concepts/database#id-generation // generateId: o => o.model }, user: { modelName: "users", fields: { name: "full_name", emailVerified: "email_verified", createdAt: "created_at", image: "pfp_url", updatedAt: "updated_at", }, }, jwks: { modelName: "jwks", fields: { privateKey: "private_key", publicKey: "public_key", createdAt: "created_at", }, }, session: { modelName: "auth_sessions", fields: { userId: "user_id", ipAddress: "ip", userAgent: "user_agent", expiresAt: "expires_at", createdAt: "created_at", updatedAt: "updated_at", }, }, account: { modelName: "auth_providers", fields: { userId: "user_id", createdAt: "created_at", updatedAt: "updated_at", accessTokenExpiresAt: "access_token_exp_at", refreshTokenExpiresAt: "refresh_token_exp_at", accessToken: "access_token", refreshToken: "refresh_token", providerId: "sso_provider_id", accountId: "sso_account_id", }, }, verification: { modelName: "auth_verifications", fields: { expiresAt: "expires_at", createdAt: "created_at", updatedAt: "updated_at", }, }, }); ``` Then in the routes: ```typescript import { Hono } from "hono"; import { cors } from "hono/cors"; import { contextMiddleware } from "./mw/ctx"; import type { AppEnv } from "./types/Env"; import { contextStorage } from "hono/context-storage"; import { getAuth } from "./auth"; const app = new Hono<AppEnv>(); app.use("*", contextMiddleware); app.use( "/api/auth/**", cors({ origin: "http://localhost:8787", // replace with your origin allowHeaders: ["Content-Type", "Authorization"], allowMethods: ["POST", "GET", "OPTIONS"], exposeHeaders: ["Content-Length"], maxAge: 600, credentials: true, }), ); app.on(["POST", "GET"], "/api/auth/**", (c) => getAuth(c).handler(c.req.raw)); // this is optional since you can get the session from better-auth endpoint app.get("/session", async (c) => { const session = c.get("session"); // ctx.ts to see how this is set const user = c.get("user"); if (!user) return c.body(null, 401); return c.json({ session, user, }); }); export default app; ``` ctx.ts ```typescript import { getAuth } from "@/auth"; import type { AppEnv } from "@/types/Env"; import { getConnection } from "@cpr/utils"; import { createMiddleware } from "hono/factory"; export const contextMiddleware = createMiddleware<AppEnv>(async (c, next) => { // `getConnection` is an internal pkg from my monorepo // returns a postgres-js drizzle instance const db = getConnection(c.env.DB_URL); c.set("db", db); // set db to access it in `getAuth` // you don't really need any of this last part const session = await getAuth(c).api.getSession({ headers: c.req.raw.headers, }); if (!session) { c.set("user", null); c.set("session", null); return next(); } c.set("user", session.user); c.set("session", session.session); await next() }); ``` Caveats: As @Kylar13 pointed out, the CLI won’t work in this case because it relies on the auth singleton. If the maintainers are open to it, I’d be happy to submit a PR to make functions compatible with the CLI! :) That said, not using the CLI isn’t a huge issue—you can simply check the documentation for the plugin you need and manually create or update the schema. If you’re renaming columns, just be sure to map the correct fields in the `betterAuth` config. I’m still running into some issues with React Native, but they don’t seem related to this. I’ll need to do some more testing to confirm if there’s actually a problem.

GiteaMirror commented

2026-04-13 03:44:43 -05:00

@abegehr commented on GitHub (Feb 10, 2025):

@enzojs, thank you for sharing your solution! I have a similar function-setup of better-auth on Hono. However, I'm using the bearer plugin for Bearer token authentication. With the bearer token plugin enabled my request fail with TypeError: Can't modify immutable headers. - did you find a fix for that part of the issue?

@abegehr commented on GitHub (Feb 10, 2025): @enzojs, thank you for sharing your solution! I have a similar function-setup of better-auth on Hono. However, I'm using the bearer plugin for Bearer token authentication. With the bearer token plugin enabled my request fail with `TypeError: Can't modify immutable headers.` - did you find a fix for that part of the issue?

GiteaMirror commented

2026-04-13 03:44:44 -05:00

@samducker commented on GitHub (Feb 23, 2025):

I am doing a similar approach to you @enzojs however I'm struggling to get the type inference doing it this way. Did you have any advice on getting these inferred types out so you can share them with your client.

Even better if you know how to get the better auth routes into the hono RPC?

I get this error without a manual type assertion

The inferred type of 'createAuth' cannot be named without a reference to '../../../../../node_modules/better-auth/dist/index-Y--3ocl8'. This is likely not portable. A type annotation is necessary.ts(2742)

If I do : ReturnType then my openapi plugin and inferred types don't work correctly.

Probably this issue https://github.com/better-auth/better-auth/issues/1391

@samducker commented on GitHub (Feb 23, 2025): I am doing a similar approach to you @enzojs however I'm struggling to get the type inference doing it this way. Did you have any advice on getting these inferred types out so you can share them with your client. Even better if you know how to get the better auth routes into the hono RPC? I get this error without a manual type assertion ``` The inferred type of 'createAuth' cannot be named without a reference to '../../../../../node_modules/better-auth/dist/index-Y--3ocl8'. This is likely not portable. A type annotation is necessary.ts(2742) ``` If I do : ReturnType<typeof betterAuth> then my openapi plugin and inferred types don't work correctly. Probably this issue https://github.com/better-auth/better-auth/issues/1391

GiteaMirror commented

2026-04-13 03:44:45 -05:00

@enqqi commented on GitHub (Feb 25, 2025):

I'm actually running a monorepo with an Expo app, SvelteKit, Hono, and using Bun as the package manager. The monorepo is set up with npm (Bun) workspaces, just a basic setup.

I think your issue might be related to how your project is structured. You may need to set up a monorepo where both your Better Auth server and clients share a common package for the types. @samducker

@enqqi commented on GitHub (Feb 25, 2025): I'm actually running a monorepo with an Expo app, SvelteKit, Hono, and using Bun as the package manager. The monorepo is set up with npm (Bun) workspaces, just a basic setup. I think your issue might be related to how your project is structured. You may need to set up a monorepo where both your Better Auth server and clients share a common package for the types. @samducker

GiteaMirror commented

2026-04-13 03:44:46 -05:00

@Fawwaz-2009 commented on GitHub (Mar 10, 2025):

hey @enzojs thanks for sharing your solution. I tried something similar to your solution but keep getting BASE_URL is needed error , any idea what maybe causing this?

export const getAuth = ({ BETTER_AUTH_SECRET, drizzleDB }: { BETTER_AUTH_SECRET: string; drizzleDB: DrizzleDB }) =>
  betterAuth({
    secret: BETTER_AUTH_SECRET,
    baseUrl: "http://localhost:8787",
    trustedOrigins: ["http://localhost:3000", "http://localhost:8787"],
    advanced: {
      crossSubDomainCookies: {
        enabled: true,
      },
    },
    database: drizzleAdapter(drizzleDB, {
      provider: "sqlite",
      schema,
    }),
    emailAndPassword: {
      enabled: true,
    },
  });

@Fawwaz-2009 commented on GitHub (Mar 10, 2025): hey @enzojs thanks for sharing your solution. I tried something similar to your solution but keep getting BASE_URL is needed error , any idea what maybe causing this? ```ts export const getAuth = ({ BETTER_AUTH_SECRET, drizzleDB }: { BETTER_AUTH_SECRET: string; drizzleDB: DrizzleDB }) => betterAuth({ secret: BETTER_AUTH_SECRET, baseUrl: "http://localhost:8787", trustedOrigins: ["http://localhost:3000", "http://localhost:8787"], advanced: { crossSubDomainCookies: { enabled: true, }, }, database: drizzleAdapter(drizzleDB, { provider: "sqlite", schema, }), emailAndPassword: { enabled: true, }, }); ``` ![Image](https://github.com/user-attachments/assets/206816fa-6032-46f1-bc38-ae11f39aa1c9)

GiteaMirror commented

2026-04-13 03:44:47 -05:00

@Fawwaz-2009 commented on GitHub (Mar 10, 2025):

nvm actually it turns out that needed to change baseUrl to baseURL :)

@Fawwaz-2009 commented on GitHub (Mar 10, 2025): nvm actually it turns out that needed to change `baseUrl` to `baseURL` :)

GiteaMirror commented

2026-04-13 03:44:47 -05:00

@cihadaydemir commented on GitHub (Mar 13, 2025):

I managed to get to make it work! Here is how i did it:

This is a hono auth server deployed to cloudflare workers

auth.ts

import type { AppEnv } from "@/types/Env";
import { betterAuth } from "better-auth";
import { drizzleAdapter } from "better-auth/adapters/drizzle";
import {
createAuthMiddleware,
emailOTP,
jwt,
openAPI,
} from "better-auth/plugins";
import type { Context } from "hono";

// notice how this is a function that recieves the context
export const getAuth = (c: Context) =>
betterAuth({
database: drizzleAdapter(c.get("db"), {
provider: "pg",
}),
baseURL: c.env.AUTH_BASE_URL,
secret: c.env.AUTH_SK,
plugins: [
openAPI(),
jwt(),
emailOTP({
sendVerificationOTP: async (d, request) => {
console.log(JSON.stringify(d, null, 2));
},
}),
],
hooks: {
after: createAuthMiddleware(async (ctx) => {
console.log(ctx)
}),
},
emailAndPassword: {
enabled: true,
},
secondaryStorage: {
get: c.env.AuthKV.get,
set: (k, v) => c.env.AuthKV.put(k, v),
delete: c.env.AuthKV.delete,
},
rateLimit: {
window: 30, // time window in seconds
max: 40, // max requests in the window
},
advanced: {
cookiePrefix: "yummy",
// https://www.better-auth.com/docs/integrations/hono#cross-domain-cookies
crossSubDomainCookies: {
enabled: true,
},
// https://www.better-auth.com/docs/concepts/database#id-generation
// generateId: o => o.model
},
user: {
modelName: "users",
fields: {
name: "full_name",
emailVerified: "email_verified",
createdAt: "created_at",
image: "pfp_url",
updatedAt: "updated_at",
},
},
jwks: {
modelName: "jwks",
fields: {
privateKey: "private_key",
publicKey: "public_key",
createdAt: "created_at",
},
},
session: {
modelName: "auth_sessions",
fields: {
userId: "user_id",
ipAddress: "ip",
userAgent: "user_agent",
expiresAt: "expires_at",
createdAt: "created_at",
updatedAt: "updated_at",
},
},
account: {
modelName: "auth_providers",
fields: {
userId: "user_id",
createdAt: "created_at",
updatedAt: "updated_at",
accessTokenExpiresAt: "access_token_exp_at",
refreshTokenExpiresAt: "refresh_token_exp_at",
accessToken: "access_token",
refreshToken: "refresh_token",
providerId: "sso_provider_id",
accountId: "sso_account_id",
},
},
verification: {
modelName: "auth_verifications",
fields: {
expiresAt: "expires_at",
createdAt: "created_at",
updatedAt: "updated_at",
},
},
});
Then in the routes:

import { Hono } from "hono";
import { cors } from "hono/cors";
import { contextMiddleware } from "./mw/ctx";
import type { AppEnv } from "./types/Env";
import { contextStorage } from "hono/context-storage";
import { getAuth } from "./auth";

const app = new Hono();

app.use("*", contextMiddleware);

app.use(
"/api/auth/**",
cors({
origin: "http://localhost:8787", // replace with your origin
allowHeaders: ["Content-Type", "Authorization"],
allowMethods: ["POST", "GET", "OPTIONS"],
exposeHeaders: ["Content-Length"],
maxAge: 600,
credentials: true,
}),
);

app.on(["POST", "GET"], "/api/auth/**", (c) => getAuth(c).handler(c.req.raw));

// this is optional since you can get the session from better-auth endpoint
app.get("/session", async (c) => {
const session = c.get("session"); // ctx.ts to see how this is set
const user = c.get("user");

if (!user) return c.body(null, 401);

return c.json({
session,
user,
});
});

export default app;
ctx.ts

import { getAuth } from "@/auth";
import type { AppEnv } from "@/types/Env";
import { getConnection } from "@cpr/utils";
import { createMiddleware } from "hono/factory";

export const contextMiddleware = createMiddleware(async (c, next) => {
// getConnection is an internal pkg from my monorepo
// returns a postgres-js drizzle instance
const db = getConnection(c.env.DB_URL);

c.set("db", db); // set db to access it in getAuth

// you don't really need any of this last part
const session = await getAuth(c).api.getSession({
headers: c.req.raw.headers,
});

if (!session) {
c.set("user", null);
c.set("session", null);
return next();
}

c.set("user", session.user);
c.set("session", session.session);
await next()
});
Caveats:

As @Kylar13 pointed out, the CLI won’t work in this case because it relies on the auth singleton. If the maintainers are open to it, I’d be happy to submit a PR to make functions compatible with the CLI! :)

That said, not using the CLI isn’t a huge issue—you can simply check the documentation for the plugin you need and manually create or update the schema. If you’re renaming columns, just be sure to map the correct fields in the betterAuth config.

I’m still running into some issues with React Native, but they don’t seem related to this. I’ll need to do some more testing to confirm if there’s actually a problem.

Hi @enzojs,
first of all big thanks for your contributions so far.
I've been struggeling with exactly the same thing for days now and also tried out different approaches to get it running.
I tried your most recent approach at my project, but keep getting a cors error, despite having set up a cors middleware.
For me it seems like better-auth is still breaking and thats causing the cors error.

When signing in via social providers I get following error:
[wrangler:inf] OPTIONS /api/auth/sign-in/social 500 Internal Server Error (6ms)

Did you maybe have experience something similar or have an idea what the issue could be?
Thanks

@cihadaydemir commented on GitHub (Mar 13, 2025): > I managed to get to make it work! Here is how i did it: > > This is a hono auth server deployed to cloudflare workers > > auth.ts > > import type { AppEnv } from "@/types/Env"; > import { betterAuth } from "better-auth"; > import { drizzleAdapter } from "better-auth/adapters/drizzle"; > import { > createAuthMiddleware, > emailOTP, > jwt, > openAPI, > } from "better-auth/plugins"; > import type { Context } from "hono"; > > // notice how this is a function that recieves the context > export const getAuth = (c: Context<AppEnv>) => > betterAuth({ > database: drizzleAdapter(c.get("db"), { > provider: "pg", > }), > baseURL: c.env.AUTH_BASE_URL, > secret: c.env.AUTH_SK, > plugins: [ > openAPI(), > jwt(), > emailOTP({ > sendVerificationOTP: async (d, request) => { > console.log(JSON.stringify(d, null, 2)); > }, > }), > ], > hooks: { > after: createAuthMiddleware(async (ctx) => { > console.log(ctx) > }), > }, > emailAndPassword: { > enabled: true, > }, > secondaryStorage: { > get: c.env.AuthKV.get, > set: (k, v) => c.env.AuthKV.put(k, v), > delete: c.env.AuthKV.delete, > }, > rateLimit: { > window: 30, // time window in seconds > max: 40, // max requests in the window > }, > advanced: { > cookiePrefix: "yummy", > // https://www.better-auth.com/docs/integrations/hono#cross-domain-cookies > crossSubDomainCookies: { > enabled: true, > }, > // https://www.better-auth.com/docs/concepts/database#id-generation > // generateId: o => o.model > }, > user: { > modelName: "users", > fields: { > name: "full_name", > emailVerified: "email_verified", > createdAt: "created_at", > image: "pfp_url", > updatedAt: "updated_at", > }, > }, > jwks: { > modelName: "jwks", > fields: { > privateKey: "private_key", > publicKey: "public_key", > createdAt: "created_at", > }, > }, > session: { > modelName: "auth_sessions", > fields: { > userId: "user_id", > ipAddress: "ip", > userAgent: "user_agent", > expiresAt: "expires_at", > createdAt: "created_at", > updatedAt: "updated_at", > }, > }, > account: { > modelName: "auth_providers", > fields: { > userId: "user_id", > createdAt: "created_at", > updatedAt: "updated_at", > accessTokenExpiresAt: "access_token_exp_at", > refreshTokenExpiresAt: "refresh_token_exp_at", > accessToken: "access_token", > refreshToken: "refresh_token", > providerId: "sso_provider_id", > accountId: "sso_account_id", > }, > }, > verification: { > modelName: "auth_verifications", > fields: { > expiresAt: "expires_at", > createdAt: "created_at", > updatedAt: "updated_at", > }, > }, > }); > Then in the routes: > > import { Hono } from "hono"; > import { cors } from "hono/cors"; > import { contextMiddleware } from "./mw/ctx"; > import type { AppEnv } from "./types/Env"; > import { contextStorage } from "hono/context-storage"; > import { getAuth } from "./auth"; > > const app = new Hono<AppEnv>(); > > app.use("*", contextMiddleware); > > app.use( > "/api/auth/**", > cors({ > origin: "http://localhost:8787", // replace with your origin > allowHeaders: ["Content-Type", "Authorization"], > allowMethods: ["POST", "GET", "OPTIONS"], > exposeHeaders: ["Content-Length"], > maxAge: 600, > credentials: true, > }), > ); > > app.on(["POST", "GET"], "/api/auth/**", (c) => getAuth(c).handler(c.req.raw)); > > // this is optional since you can get the session from better-auth endpoint > app.get("/session", async (c) => { > const session = c.get("session"); // ctx.ts to see how this is set > const user = c.get("user"); > > if (!user) return c.body(null, 401); > > return c.json({ > session, > user, > }); > }); > > export default app; > ctx.ts > > import { getAuth } from "@/auth"; > import type { AppEnv } from "@/types/Env"; > import { getConnection } from "@cpr/utils"; > import { createMiddleware } from "hono/factory"; > > export const contextMiddleware = createMiddleware<AppEnv>(async (c, next) => { > // `getConnection` is an internal pkg from my monorepo > // returns a postgres-js drizzle instance > const db = getConnection(c.env.DB_URL); > > c.set("db", db); // set db to access it in `getAuth` > > // you don't really need any of this last part > const session = await getAuth(c).api.getSession({ > headers: c.req.raw.headers, > }); > > if (!session) { > c.set("user", null); > c.set("session", null); > return next(); > } > > c.set("user", session.user); > c.set("session", session.session); > await next() > }); > Caveats: > > As [@Kylar13](https://github.com/Kylar13) pointed out, the CLI won’t work in this case because it relies on the auth singleton. If the maintainers are open to it, I’d be happy to submit a PR to make functions compatible with the CLI! :) > > That said, not using the CLI isn’t a huge issue—you can simply check the documentation for the plugin you need and manually create or update the schema. If you’re renaming columns, just be sure to map the correct fields in the `betterAuth` config. > > I’m still running into some issues with React Native, but they don’t seem related to this. I’ll need to do some more testing to confirm if there’s actually a problem. Hi @enzojs, first of all big thanks for your contributions so far. I've been struggeling with exactly the same thing for days now and also tried out different approaches to get it running. I tried your most recent approach at my project, but keep getting a cors error, despite having set up a cors middleware. For me it seems like better-auth is still breaking and thats causing the cors error. When signing in via social providers I get following error: [wrangler:inf] OPTIONS /api/auth/sign-in/social 500 Internal Server Error (6ms) Did you maybe have experience something similar or have an idea what the issue could be? Thanks

GiteaMirror commented

2026-04-13 03:44:48 -05:00

@Fawwaz-2009 commented on GitHub (Mar 15, 2025):

not sure if our problems are related but I have the two apps server(hono) and frontend(next.js). server deployed to cloudlfare and frontend on vercel, while everything works perfectly locally. the authentication fails on prod, not 100% sure if it's a cors issue (there were cors errors but they are gone now) after a lot of debugging it's seems the cookie either doesn't get set or just not being sent by the frontend. during my debugging I had to hook into the before and after in better auth config and I can see that the token is not on the cookie, it never there

@Fawwaz-2009 commented on GitHub (Mar 15, 2025): not sure if our problems are related but I have the two apps server(hono) and frontend(next.js). server deployed to cloudlfare and frontend on vercel, while everything works perfectly locally. the authentication fails on prod, not 100% sure if it's a cors issue (there were cors errors but they are gone now) after a lot of debugging it's seems the cookie either doesn't get set or just not being sent by the frontend. during my debugging I had to hook into the before and after in better auth config and I can see that the token is not on the cookie, it never there

GiteaMirror commented

2026-04-13 03:44:48 -05:00

@cihadaydemir commented on GitHub (Mar 15, 2025):

Thanks for your respond.
Sounds like a similar problem. I also debugged yesterday and saw something strange happening with getSession() function in my middleware so my guess is that something is wrong with the header that’s been sent to Hono.
Will definitely check out the before and after hooks as well.
It’s been days now I can’t get it working 🥲

@cihadaydemir commented on GitHub (Mar 15, 2025): Thanks for your respond. Sounds like a similar problem. I also debugged yesterday and saw something strange happening with getSession() function in my middleware so my guess is that something is wrong with the header that’s been sent to Hono. Will definitely check out the before and after hooks as well. It’s been days now I can’t get it working 🥲

GiteaMirror commented

2026-04-13 03:44:49 -05:00

@Fawwaz-2009 commented on GitHub (Mar 16, 2025):

So, I got better auth working with both next.js and tanstack setups. Might drop a template later if anyone's interested.

I found there is potentially unsolvable limitation when using a Next.js frontend with a Hono API deployed to Cloudflare Workers. You basically can't use server components or server actions with better auth in this setup.

The issue is that you need the auth server client (the one from the Hono app) in your server components, but that client needs the Cloudflare ENV variables to initialize and access the DB. So you end up stuck in this weird spot where things don't quite connect.

Also, I don't know why using the auth client from the client-side of BetterAuth (the one in next.js app) does not work inside the server component, even though when I pass to it the headers, I couldn't figure out why this one doesn't work.

this might related to the issue

001126ba5e/packages/better-auth/src/integrations/next-js.ts (L21-L64)

@Fawwaz-2009 commented on GitHub (Mar 16, 2025): So, I got better auth working with both [next.js](https://www.f-stack.dev/auth/login) and [tanstack](https://tanstack.f-stack.dev/auth/login) setups. Might drop a template later if anyone's interested. I found there is potentially unsolvable limitation when using a Next.js frontend with a Hono API deployed to Cloudflare Workers. You basically can't use server components or server actions with better auth in this setup. The issue is that you need the auth server client (the one from the Hono app) in your server components, but that client needs the Cloudflare ENV variables to initialize and access the DB. So you end up stuck in this weird spot where things don't quite connect. Also, I don't know why using the auth client from the client-side of BetterAuth (the one in next.js app) does not work inside the server component, even though when I pass to it the headers, I couldn't figure out why this one doesn't work. this might related to the issue https://github.com/better-auth/better-auth/blob/001126ba5ea27e94bb59c7def6d407345b623dcf/packages/better-auth/src/integrations/next-js.ts#L21-L64

GiteaMirror commented

2026-04-13 03:44:50 -05:00

@cihadaydemir commented on GitHub (Mar 16, 2025):

Okay that sounds very strange.
In my recent Next.js project I was able to get it running very smoothly but I didn’t deploy on Cloudflare and also didn’t use Hono for the api’s.
It seems like that Hono on CF Workers is the problem.

@cihadaydemir commented on GitHub (Mar 16, 2025): Okay that sounds very strange. In my recent Next.js project I was able to get it running very smoothly but I didn’t deploy on Cloudflare and also didn’t use Hono for the api’s. It seems like that Hono on CF Workers is the problem.

GiteaMirror commented

2026-04-13 03:44:50 -05:00

@Fawwaz-2009 commented on GitHub (Mar 17, 2025):

for anyone looking for example here is an example with two different frontend, next.js and tanstack, the nextjs example is not perfect as the server side not working but the tanstack one should have no issues
https://github.com/Fawwaz-2009/cloudflare-api-and-separate-frontend

@Fawwaz-2009 commented on GitHub (Mar 17, 2025): for anyone looking for example here is an example with two different frontend, [next.js](https://www.f-stack.dev) and [tanstack](https://tanstack.f-stack.dev), the nextjs example is not perfect as the server side not working but the tanstack one should have no issues https://github.com/Fawwaz-2009/cloudflare-api-and-separate-frontend

GiteaMirror commented

2026-04-13 03:44:51 -05:00

@cihadaydemir commented on GitHub (Mar 17, 2025):

for anyone looking for example here is an example with two different frontend, next.js and tanstack, the nextjs example is not perfect as the server side not working but the tanstack one should have no issues https://github.com/Fawwaz-2009/cloudflare-api-and-separate-frontend

@Fawwaz-2009 First of all, thank you very much for helping me to solve my problems.
I still have some problems: when signing in via social providers I get an error that the callback URL is wrong, even though it is correct. My FE is running on port 3001 and my callback URL on the signin function is like this
callbackURL: window.location.origin Any idea why this error might occur?

@cihadaydemir commented on GitHub (Mar 17, 2025): > for anyone looking for example here is an example with two different frontend, [next.js](https://www.f-stack.dev) and [tanstack](https://tanstack.f-stack.dev), the nextjs example is not perfect as the server side not working but the tanstack one should have no issues https://github.com/Fawwaz-2009/cloudflare-api-and-separate-frontend @Fawwaz-2009 First of all, thank you very much for helping me to solve my problems. I still have some problems: when signing in via social providers I get an error that the callback URL is wrong, even though it is correct. My FE is running on port 3001 and my callback URL on the signin function is like this `callbackURL: window.location.origin` Any idea why this error might occur?

GiteaMirror commented

2026-04-13 03:44:52 -05:00

@enqqi commented on GitHub (Mar 17, 2025):

I suggest you open a thread in the discord. I'm sure you'll get a faster response there. Furthermore, I will take a deeper look to your issue once I get home. @cihadaydemir

@enqqi commented on GitHub (Mar 17, 2025): I suggest you open a thread in the discord. I'm sure you'll get a faster response there. Furthermore, I will take a deeper look to your issue once I get home. @cihadaydemir

GiteaMirror commented

2026-04-13 03:44:53 -05:00

@molvqingtai commented on GitHub (Jun 30, 2025):

I managed to get to make it work! Here is how i did it:

This is a hono auth server deployed to cloudflare workers

auth.ts

import type { AppEnv } from "@/types/Env";
import { betterAuth } from "better-auth";
import { drizzleAdapter } from "better-auth/adapters/drizzle";
import {
createAuthMiddleware,
emailOTP,
jwt,
openAPI,
} from "better-auth/plugins";
import type { Context } from "hono";

// notice how this is a function that recieves the context
export const getAuth = (c: Context) =>
betterAuth({
database: drizzleAdapter(c.get("db"), {
provider: "pg",
}),
baseURL: c.env.AUTH_BASE_URL,
secret: c.env.AUTH_SK,
plugins: [
openAPI(),
jwt(),
emailOTP({
sendVerificationOTP: async (d, request) => {
console.log(JSON.stringify(d, null, 2));
},
}),
],
hooks: {
after: createAuthMiddleware(async (ctx) => {
console.log(ctx)
}),
},
emailAndPassword: {
enabled: true,
},
secondaryStorage: {
get: c.env.AuthKV.get,
set: (k, v) => c.env.AuthKV.put(k, v),
delete: c.env.AuthKV.delete,
},
rateLimit: {
window: 30, // time window in seconds
max: 40, // max requests in the window
},
advanced: {
cookiePrefix: "yummy",
// https://www.better-auth.com/docs/integrations/hono#cross-domain-cookies
crossSubDomainCookies: {
enabled: true,
},
// https://www.better-auth.com/docs/concepts/database#id-generation
// generateId: o => o.model
},
user: {
modelName: "users",
fields: {
name: "full_name",
emailVerified: "email_verified",
createdAt: "created_at",
image: "pfp_url",
updatedAt: "updated_at",
},
},
jwks: {
modelName: "jwks",
fields: {
privateKey: "private_key",
publicKey: "public_key",
createdAt: "created_at",
},
},
session: {
modelName: "auth_sessions",
fields: {
userId: "user_id",
ipAddress: "ip",
userAgent: "user_agent",
expiresAt: "expires_at",
createdAt: "created_at",
updatedAt: "updated_at",
},
},
account: {
modelName: "auth_providers",
fields: {
userId: "user_id",
createdAt: "created_at",
updatedAt: "updated_at",
accessTokenExpiresAt: "access_token_exp_at",
refreshTokenExpiresAt: "refresh_token_exp_at",
accessToken: "access_token",
refreshToken: "refresh_token",
providerId: "sso_provider_id",
accountId: "sso_account_id",
},
},
verification: {
modelName: "auth_verifications",
fields: {
expiresAt: "expires_at",
createdAt: "created_at",
updatedAt: "updated_at",
},
},
});
Then in the routes:

import { Hono } from "hono";
import { cors } from "hono/cors";
import { contextMiddleware } from "./mw/ctx";
import type { AppEnv } from "./types/Env";
import { contextStorage } from "hono/context-storage";
import { getAuth } from "./auth";

const app = new Hono();

app.use("*", contextMiddleware);

app.use(
"/api/auth/**",
cors({
origin: "http://localhost:8787", // replace with your origin
allowHeaders: ["Content-Type", "Authorization"],
allowMethods: ["POST", "GET", "OPTIONS"],
exposeHeaders: ["Content-Length"],
maxAge: 600,
credentials: true,
}),
);

app.on(["POST", "GET"], "/api/auth/**", (c) => getAuth(c).handler(c.req.raw));

// this is optional since you can get the session from better-auth endpoint
app.get("/session", async (c) => {
const session = c.get("session"); // ctx.ts to see how this is set
const user = c.get("user");

if (!user) return c.body(null, 401);

return c.json({
session,
user,
});
});

export default app;
ctx.ts

import { getAuth } from "@/auth";
import type { AppEnv } from "@/types/Env";
import { getConnection } from "@cpr/utils";
import { createMiddleware } from "hono/factory";

export const contextMiddleware = createMiddleware(async (c, next) => {
// getConnection is an internal pkg from my monorepo
// returns a postgres-js drizzle instance
const db = getConnection(c.env.DB_URL);

c.set("db", db); // set db to access it in getAuth

// you don't really need any of this last part
const session = await getAuth(c).api.getSession({
headers: c.req.raw.headers,
});

if (!session) {
c.set("user", null);
c.set("session", null);
return next();
}

c.set("user", session.user);
c.set("session", session.session);
await next()
});
Caveats:

As @Kylar13 pointed out, the CLI won’t work in this case because it relies on the auth singleton. If the maintainers are open to it, I’d be happy to submit a PR to make functions compatible with the CLI! :)

That said, not using the CLI isn’t a huge issue—you can simply check the documentation for the plugin you need and manually create or update the schema. If you’re renaming columns, just be sure to map the correct fields in the betterAuth config.

I’m still running into some issues with React Native, but they don’t seem related to this. I’ll need to do some more testing to confirm if there’s actually a problem.

I spent a day studying this issue, I tried to modify the core of the cli to load a function, but I still got an error


ERROR: `getCloudflareContext` has been called without having called `initOpenNextCloudflareForDev` from the Next.js config file.

This has nothing to do with better-auth, although I added initOpenNextCloudflareForDev() to the top of auth.ts, it still doesn't work, it seems that initOpenNextCloudflareForDev only supports starting with next dev.

@molvqingtai commented on GitHub (Jun 30, 2025): > I managed to get to make it work! Here is how i did it: > > This is a hono auth server deployed to cloudflare workers > > auth.ts > > import type { AppEnv } from "@/types/Env"; > import { betterAuth } from "better-auth"; > import { drizzleAdapter } from "better-auth/adapters/drizzle"; > import { > createAuthMiddleware, > emailOTP, > jwt, > openAPI, > } from "better-auth/plugins"; > import type { Context } from "hono"; > > // notice how this is a function that recieves the context > export const getAuth = (c: Context<AppEnv>) => > betterAuth({ > database: drizzleAdapter(c.get("db"), { > provider: "pg", > }), > baseURL: c.env.AUTH_BASE_URL, > secret: c.env.AUTH_SK, > plugins: [ > openAPI(), > jwt(), > emailOTP({ > sendVerificationOTP: async (d, request) => { > console.log(JSON.stringify(d, null, 2)); > }, > }), > ], > hooks: { > after: createAuthMiddleware(async (ctx) => { > console.log(ctx) > }), > }, > emailAndPassword: { > enabled: true, > }, > secondaryStorage: { > get: c.env.AuthKV.get, > set: (k, v) => c.env.AuthKV.put(k, v), > delete: c.env.AuthKV.delete, > }, > rateLimit: { > window: 30, // time window in seconds > max: 40, // max requests in the window > }, > advanced: { > cookiePrefix: "yummy", > // https://www.better-auth.com/docs/integrations/hono#cross-domain-cookies > crossSubDomainCookies: { > enabled: true, > }, > // https://www.better-auth.com/docs/concepts/database#id-generation > // generateId: o => o.model > }, > user: { > modelName: "users", > fields: { > name: "full_name", > emailVerified: "email_verified", > createdAt: "created_at", > image: "pfp_url", > updatedAt: "updated_at", > }, > }, > jwks: { > modelName: "jwks", > fields: { > privateKey: "private_key", > publicKey: "public_key", > createdAt: "created_at", > }, > }, > session: { > modelName: "auth_sessions", > fields: { > userId: "user_id", > ipAddress: "ip", > userAgent: "user_agent", > expiresAt: "expires_at", > createdAt: "created_at", > updatedAt: "updated_at", > }, > }, > account: { > modelName: "auth_providers", > fields: { > userId: "user_id", > createdAt: "created_at", > updatedAt: "updated_at", > accessTokenExpiresAt: "access_token_exp_at", > refreshTokenExpiresAt: "refresh_token_exp_at", > accessToken: "access_token", > refreshToken: "refresh_token", > providerId: "sso_provider_id", > accountId: "sso_account_id", > }, > }, > verification: { > modelName: "auth_verifications", > fields: { > expiresAt: "expires_at", > createdAt: "created_at", > updatedAt: "updated_at", > }, > }, > }); > Then in the routes: > > import { Hono } from "hono"; > import { cors } from "hono/cors"; > import { contextMiddleware } from "./mw/ctx"; > import type { AppEnv } from "./types/Env"; > import { contextStorage } from "hono/context-storage"; > import { getAuth } from "./auth"; > > const app = new Hono<AppEnv>(); > > app.use("*", contextMiddleware); > > app.use( > "/api/auth/**", > cors({ > origin: "http://localhost:8787", // replace with your origin > allowHeaders: ["Content-Type", "Authorization"], > allowMethods: ["POST", "GET", "OPTIONS"], > exposeHeaders: ["Content-Length"], > maxAge: 600, > credentials: true, > }), > ); > > app.on(["POST", "GET"], "/api/auth/**", (c) => getAuth(c).handler(c.req.raw)); > > // this is optional since you can get the session from better-auth endpoint > app.get("/session", async (c) => { > const session = c.get("session"); // ctx.ts to see how this is set > const user = c.get("user"); > > if (!user) return c.body(null, 401); > > return c.json({ > session, > user, > }); > }); > > export default app; > ctx.ts > > import { getAuth } from "@/auth"; > import type { AppEnv } from "@/types/Env"; > import { getConnection } from "@cpr/utils"; > import { createMiddleware } from "hono/factory"; > > export const contextMiddleware = createMiddleware<AppEnv>(async (c, next) => { > // `getConnection` is an internal pkg from my monorepo > // returns a postgres-js drizzle instance > const db = getConnection(c.env.DB_URL); > > c.set("db", db); // set db to access it in `getAuth` > > // you don't really need any of this last part > const session = await getAuth(c).api.getSession({ > headers: c.req.raw.headers, > }); > > if (!session) { > c.set("user", null); > c.set("session", null); > return next(); > } > > c.set("user", session.user); > c.set("session", session.session); > await next() > }); > Caveats: > > As [@Kylar13](https://github.com/Kylar13) pointed out, the CLI won’t work in this case because it relies on the auth singleton. If the maintainers are open to it, I’d be happy to submit a PR to make functions compatible with the CLI! :) > > That said, not using the CLI isn’t a huge issue—you can simply check the documentation for the plugin you need and manually create or update the schema. If you’re renaming columns, just be sure to map the correct fields in the `betterAuth` config. > > I’m still running into some issues with React Native, but they don’t seem related to this. I’ll need to do some more testing to confirm if there’s actually a problem. I spent a day studying this issue, I tried to modify the core of the cli to load a function, but I still got an error ```shell ERROR: `getCloudflareContext` has been called without having called `initOpenNextCloudflareForDev` from the Next.js config file. ``` This has nothing to do with better-auth, although I added `initOpenNextCloudflareForDev()` to the top of auth.ts, it still doesn't work, it seems that `initOpenNextCloudflareForDev` only supports starting with `next dev`.

GiteaMirror referenced this issue

2026-04-13 07:30:20 -05:00

[GH-ISSUE #8615] rate-limiter produces confusing warning #11136

GiteaMirror referenced this issue

2026-04-13 10:29:58 -05:00

[PR #8617] fix: misleading rate limit IP warning #16347

GiteaMirror referenced this issue

2026-04-15 19:06:25 -05:00

[GH-ISSUE #8615] rate-limiter produces confusing warning #19767

GiteaMirror referenced this issue

2026-04-15 22:41:07 -05:00

[PR #8617] [MERGED] fix: misleading rate limit IP warning #25001

GiteaMirror referenced this issue

2026-04-17 19:54:19 -05:00

[GH-ISSUE #8615] rate-limiter produces confusing warning #28459

Sign in to join this conversation.

Branches Tags

2026-05-13/ci/stabilize-docker-startup

dependabot/npm_and_yarn/samlify-2.13.0

changeset-release/main

main

2026-05-22/chore/adopt-agents-md

2026-05-22/refactor/string-case-utils

2026-05-14/fix/passkey-verify-error-and-claim

changeset-release/next

dependabot/npm_and_yarn/demo/electron/demo-minor-patch-519ef7475f

dependabot/github_actions/github-actions-98f3470200

client-assertions-main

2026-05-15/ci/fix-sqlite-abi-mismatch

2026-05-15/fix/organization-team-add-cascade

2026-05-15/fix/parse-set-cookie-value-validation

2026-05-13/feat/captcha-wildcard-endpoints

fix/i18n-before-hook-translation

fix/disable-migration-generate

2026-05-07/fix/admin-set-password-upsert

2026-05-10/fix/cookie-drain-order

2026-05-10/feat/hooks-finally

2026-05-09/fix/cookie-drain-order

2026-05-09/feat/hooks-finally

2026-05-08/feat/register-before-send

fix/stripe/subscription-data-merge

2026-05-01/chore/pnpm-v11-harden

chore/pnpm-v11

2026-04-29/feat/google-include-granted-scopes

2026-04-29/fix/oauth-account-scope-semantics

2026-04-27/fix/nextcookies-idempotent-writes

2026-04-26/fix/harden-proxy-host-validation

2026-04-26/refactor/stripe-callback-signature-cleanup

2026-04-26/fix/stripe-subscription-callback-timing

2026-04-11/fix/sveltekit-app-modules

feat/open-api-zod-contract

feat/oauth-provider-backchannel-logout-next

feat/oauth-idp-initiated-bounce

refactor/sign-in-challenges

2026-04-21/fix/oauth-rfc-input-validation

fix/release-notes-new-packages

fix/two-factor-identity-guard

fix/resource

feat/emailpassword-authorize

2026-04-12/security/dynamic-baseurl-proxy-trust-default

feat/oauth-provider-at-hash-v2

fix/release-grep-fallback

claude/address-review-comments-JhFLr

claude/slack-update-stripe-docs-consistency-8Sc0w

feat/async-auth

fix/two-factor-totp-verified-enrollment

feat/plugin-ui

codex/blog-1-6-release-post

2026-04-06/fix/type-any-guards

2026-04-05/chore/downgrade-better-call

2026-04-04/ci/skip-vercel-fork-prs

2026-03-28/ci/add-autofix-ci

chore/release-preview-script

himself65/2026/02/19/role

2026-03-24/fix/update-user-info-on-link

2026-03-20/docs/improve-website

2026-03-20/fix/anonymous-onlinkaccount-expo

2026-02-17/fix/anonymous-link-state

fix/8607-saml-inresponseto

fix/8549-scim-patch-noop

v1.4.x

refactor/migration-snapshot-tests

worktree-magic-link-additional-data

chore/migrate-build-to-rollup

worktree-fix-dynamic-baseurl-8447

2026-03-06/chore/public-api-check

fix/close-8156-regression-test

fix/secondary-storage-json-error-handling

himself65/verification-namespace

cursor/issue-8307-validation-79a3

himself65/2026/01/30/error-mdx

v1.4.x-staging

fix/email-otp-user

fix/restrict-full-organization-access-roles

himself65/2026/02/12/count

himself65/2026/02/04/define-plugin

2026-02-04/feat/add-pluralize

cursor/better-auth-js-integration-ec21

cursor/expo-state-mismatch-394c

2026-02-01/fix/org-update-role-sync-members

cursor/issue-7607-investigation-e146

cursor/email-generation-helper-0ff6

himself65/2026/01/21/avoid-spread-operator

himself65/2026/01/14/cli

claude/slack-add-docs-pr-NMvgO

claude/slack-add-advanced-useplural-WHKYL

feat/hooks-pos

feat/2fa-phone

feat/2fa

fix/rotation

fix/username-check

v1.3.x

refactor/organization

feat/multiple-client-ids-social-providers

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/better-auth#8615