Plugins

26 plugins ship with the package under better_auth.plugins_ext. Each one is a class; pass instances to BetterAuth(plugins=[...]).

from better_auth import BetterAuth
from better_auth.plugins_ext import OrganizationPlugin, TwoFactorPlugin

auth = BetterAuth(
    secret="a-strong-32-character-minimum-secret",
    plugins=[TwoFactorPlugin(issuer="Example"), OrganizationPlugin()],
)

Plugins add routes under base_path, extend the database schema (their tables migrate exactly like the core ones), and hook the request pipeline. Every constructor option mirrors the TypeScript option of the same name in snake_case, with the same default. better_auth.plugins_ext.__all__ is the authoritative list. Each plugin has its own page:

Sign-in methods

• Username: sign in with a username instead of an email
• Magic Link: passwordless sign-in through a single-use link
• Email OTP: one-time codes by email
• Phone Number: SMS one-time codes
• Passkey (WebAuthn): WebAuthn/FIDO2
• Anonymous: throwaway guest users, linked on real sign-up
• Sign-In with Ethereum: SIWE (ERC-4361) wallet authentication
• Google One Tap: sign in from Google's One Tap prompt
• Two-Factor Authentication: TOTP, OTP and backup codes as a second factor

Organizations and access control

• Admin: user administration, bans, impersonation
• Organization: organizations, members, invitations, teams

Tokens and keys

• API Key: long-lived database-backed API keys
• JWT: signed JWTs plus a published JWKS
• Bearer Token: the set-auth-token response header
• One-Time Token: single-use session handoff tokens

Being an OAuth server

• OAuth Provider: a full OAuth 2.1 / OIDC authorization server
• Device Authorization: the RFC 8628 device flow

Federating outward

• SSO (OIDC): OIDC identity providers per domain or organization
• Generic OAuth: any OAuth2/OIDC provider, configured at runtime
• OAuth Proxy: social login from preview deployments
• OAuth Popup: social sign-in in a popup window

Session shaping

• Multi-Session: several accounts signed in at once
• Custom Session: reshape the /get-session payload
• Last Login Method: the "you last signed in with…" hint

Abuse prevention

• Captcha: CAPTCHA checks before protected endpoints
• Have I Been Pwned: reject breached passwords

Writing your own

Everything above uses the same public surface your plugin has. See Core concepts.