Authentication
Share users safely with Better Auth signed Bearer sessions while preserving Standalone authentication.
The product experience—registration, sign-in, verification, recovery, session revocation, and account security—stays consistent. The provider and transport depend on the deployment mode.
The client uses its Supabase Auth adapter. Session ownership and provider tokens stay inside that adapter.
The client calls Better Auth under
/api/auth/*, reads the signed token from set-auth-token, and sends it as Authorization: Bearer. Every request sends the configured trusted Origin.The browser uses the host's secure cookie flow. The host also validates native origins and configured Apple/Google audiences without treating a framework name as an identity.
Session rules
- Store the Unified Bearer only in Keychain, Keystore-backed storage, SecureStore, Electron main-process encrypted storage, or Tauri's Rust-private keyring.
- Replace a token only after secure persistence succeeds.
GET /api/auth/get-sessionreturns200withnullfor an invalid session; App API endpoints return401 UNAUTHENTICATED.- On invalidation, clear the secure token, in-memory session, user-scoped caches, subscription identity, and device binding. Never fall back to Supabase.
- Better Auth errors use
{ code, message }; App API errors use the versioned error envelope. Branch on codes, not message text.
The detailed endpoint and payload contract is summarized in API Contract.