Seamless Authentication with Better Auth & D1

Configure your project authentication ->

Seamless Authentication with Better Auth & D1

Authentication is notoriously difficult to get right, especially when deploying to edge runtimes. In BYOB, we've standardized on Better Auth, pairing it natively with Cloudflare D1 to deliver a secure, frictionless authentication experience out of the box.

TLDR

• Native integration between Better Auth and Cloudflare D1 using drizzle-orm/sqlite-proxy.
• 1-Click Google Sign-In using the BYOB-managed broker.
• Dynamic baseURL handling to support multi-domain preview URLs without OAuth mismatch errors.

The D1 Database Adapter

Better Auth is highly extensible, but connecting it to Cloudflare D1 requires specific patterns. Standard Drizzle ORM setups often struggle with edge compatibility.

BYOB solves this by implementing the sqlite-proxy adapter for Drizzle. This allows the Better Auth schema (users, sessions, accounts) to map flawlessly to D1's unique row object structure. When you initialize auth in a BYOB project, the necessary D1 migrations are run automatically.

1-Click Google Sign-In

We offer two modes for Google OAuth:

1. BYOB Managed Broker (byob_managed): For immediate onboarding, you can enable Google Sign-In with zero configuration. We handle the OAuth credentials via our centralized broker using Better Auth's genericOAuth provider, getting your users into your app instantly.
2. Project Owned (project_owned): For production, you can plug in your own GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET to fully white-label the consent screen, using Better Auth's direct Google social provider.

Magic Links via BYOB Email Broker

Alongside social login, passwordless magic links are a staple of modern apps. BYOB provides a native Email Broker integration. You don't need to sign up for Resend or SendGrid immediately; BYOB handles the SMTP delivery of secure, time-boxed magic links so you can focus on building features.

Beating the Multi-Domain OAuth Trap

One of the hardest parts of preview deployments is OAuth redirect URIs. If your app expects app.com but runs on preview-123.byob.app, OAuth providers will throw mismatch errors.

BYOB's generated SvelteKit code intelligently parses x-forwarded-host headers in the auth API route (src/routes/api/auth/[...all]/+server.ts). The route rewrites the incoming request URL using the forwarded host and protocol before passing it to the Better Auth handler. This ensures that whether you are testing locally, on a preview branch, or in production, OAuth redirect URIs and magic link verify URLs always resolve to the correct environment.

Summary

By marrying Better Auth with Cloudflare D1, BYOB removes the boilerplate and edge-cases from modern authentication, letting you securely onboard users from day one.