Auth Starter (Better Auth)

The free starter. Sign in, sessions, password reset, email verification, and a profile page, powered by Better Auth on your own Postgres. This is the starter-auth-betterauth pack. No organizations to manage, no invitations, no onboarding, no admin app.

npx @hype-stack/cli compose --packs starter-auth-betterauth,layout-basic

For session flow, middleware, and route guards, see Authentication.

What you get

• Email/password and Google sign-in, with the same callback handling as the SaaS starters
• Server-side sessions in signed cookies, refresh and validation middleware
• Password reset and email verification through Resend
• A settings page with a profile tab (name, avatar), and the settings-tabs registry feature packs extend
• The same /users/me contract, CASL permission layer, and hasAccess middleware the SaaS starters ship
• Mobile and browser-extension slots with the auth screens and the profile screen

The personal workspace

Every account gets an organization named Personal workspace the moment it is created, and every session opens inside it. You never see it: there is no switcher, no members page, no invitations. It exists because every feature pack scopes its data to the active organization, and it is what makes them install on this starter exactly as they do on a SaaS one. Billing, projects, calendar, whiteboard, teams, newsletter, and cookies all work here.

Two packs need more than the free starter provides and refuse to install on it by name: pack-notifications (it ships an invitations section) and anything that needs the admin app. The install output says which capability is missing.

Growing into a SaaS starter

When you need teams, invitations, or the admin app, swap the starter:

npx @hype-stack/cli compose --packs starter-saas-betterauth

The schema is the SaaS starters' schema, so there is no migration: the personal workspace becomes the user's first team. The CLI replaces the files both starters ship, removes the ones only the free starter had, registers the apps/admin directory again, and leaves your own files alone. The WorkOS starter is the same swap with starter-saas-workos.

What you need

• A Google OAuth web app, if you want Google sign-in. Optional; without the keys the button is not offered.
• Resend for transactional email (password reset, email verification). Uses the base template's RESEND_API_KEY.
• Postgres and Valkey (base services).

Environment variables

The Google callback is /api/auth/callback/google appended to your BETTER_AUTH_URL, the same as for the SaaS starter. See SaaS Starter (Better Auth) for the Google Cloud Console steps.

The admin app

The base template ships apps/admin, and this starter ships nothing into it. The CLI leaves the directory on disk but unregisters it in stack.json, so feature packs skip their admin widgets and nothing installs into an app with no login. Upgrading to a SaaS starter registers it again.