SaaS Starter (Better Auth)

Authentication, organizations, roles, and sessions powered by Better Auth. This is the starter-saas-betterauth pack. Unlike WorkOS, Better Auth is a self-hosted library, so there's no separate account to create. You bring your own Google OAuth app.

For session flow, middleware, and route guards, see Authentication and Organizations.

What you need

• A Google OAuth web app you create in Google Cloud Console. Better Auth talks to Google directly.
• Resend for transactional email (password reset, email verification). Uses the base template's RESEND_API_KEY.
• Postgres and Valkey (base services).

Register a Google OAuth app

1. Open Google Cloud Console > APIs & Services > Credentials.
2. Create an OAuth 2.0 Client ID of type Web application.
3. Under Authorized redirect URIs, add the Better Auth callback path:

http://localhost:3000/api/auth/callback/google

4. Copy the Client ID and Client secret into apps/backend/.env as GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET.

In production, add your deployed origin as well:

https://yourdomain.com/api/auth/callback/google

The path is fixed: Better Auth owns the handler at /api/auth/*, and the Google callback is always /api/auth/callback/google appended to your BETTER_AUTH_URL.

Environment variables

Google sign-in flow

The pack starts Google sign-in from GET /auth/google/:intent, which calls Better Auth's signInSocial. After Google redirects back to /api/auth/callback/google, Better Auth exchanges the code, creates the session, and sends the browser to / (or /onboarding if the user has no organization).

Admin app

This starter also ships a separate admin app for managing users and organizations. Set SUPER_ADMIN_EMAIL in apps/backend/.env to sign in the first time.