Better Auth Starter

\n Magic-link auth on Val Town, powered by{\" \"}\n \n Better Auth\n .\n

\n\n {isPending\n ?

Loading…

\n : session?.user\n ? \n : }\n\n

\n View source\n

\n );\n}\n","label",[171,172,67],"frontend","components","pulls","branches","forks","envVars",{"_180":26,"_182":26},"connections",{"_180":26,"_181":26},"count","unfilledCount","emptyCount",{"_32":290,"_13":282,"_65":277,"_42":-5,"_34":35,"_164":39,"_165":88,"_36":291,"_38":26,"_68":246,"_167":-5,"_70":24,"_169":-5,"_203":292,"_17":293},{"_32":283,"_13":284,"_65":285,"_42":277,"_34":35,"_164":39,"_165":88,"_36":286,"_38":26,"_68":69,"_167":287,"_70":24,"_169":-5,"_203":288,"_17":289},{"_32":274,"_13":275,"_65":276,"_42":277,"_34":35,"_164":39,"_165":88,"_36":278,"_38":26,"_68":69,"_167":279,"_70":24,"_169":-5,"_203":280,"_17":281},{"_32":270,"_13":171,"_65":216,"_42":-5,"_34":35,"_164":39,"_165":88,"_36":271,"_38":26,"_68":246,"_167":-5,"_70":24,"_169":-5,"_203":272,"_17":273},{"_32":266,"_13":172,"_65":163,"_42":216,"_34":35,"_164":39,"_165":88,"_36":267,"_38":26,"_68":246,"_167":-5,"_70":24,"_169":-5,"_203":268,"_17":269},{"_32":162,"_13":67,"_65":66,"_42":163,"_34":35,"_164":39,"_165":88,"_36":263,"_38":26,"_68":69,"_167":168,"_70":24,"_169":-5,"_203":264,"_17":265},{"_32":256,"_13":257,"_65":258,"_42":163,"_34":35,"_164":39,"_165":88,"_36":259,"_38":26,"_68":69,"_167":260,"_70":24,"_169":-5,"_203":261,"_17":262},{"_32":249,"_13":250,"_65":251,"_42":163,"_34":35,"_164":39,"_165":88,"_36":252,"_38":26,"_68":69,"_167":253,"_70":24,"_169":-5,"_203":254,"_17":255},{"_32":244,"_13":243,"_65":238,"_42":216,"_34":35,"_164":39,"_165":88,"_36":245,"_38":26,"_68":246,"_167":-5,"_70":24,"_169":-5,"_203":247,"_17":248},{"_32":235,"_13":236,"_65":237,"_42":238,"_34":35,"_164":39,"_165":88,"_36":239,"_38":26,"_68":69,"_167":240,"_70":24,"_169":-5,"_203":241,"_17":242},{"_32":228,"_13":229,"_65":230,"_42":216,"_34":35,"_164":39,"_165":88,"_36":231,"_38":26,"_68":21,"_167":232,"_70":24,"_169":-5,"_203":233,"_17":234},{"_32":221,"_13":222,"_65":223,"_42":216,"_34":35,"_164":39,"_165":88,"_36":224,"_38":26,"_68":21,"_167":225,"_70":24,"_169":-5,"_203":226,"_17":227},{"_32":213,"_13":214,"_65":215,"_42":216,"_34":35,"_164":39,"_165":88,"_36":217,"_38":26,"_68":69,"_167":218,"_70":24,"_169":-5,"_203":219,"_17":220},{"_32":206,"_13":207,"_65":208,"_42":-5,"_34":35,"_164":39,"_165":88,"_36":209,"_38":26,"_68":21,"_167":210,"_70":24,"_169":-5,"_203":211,"_17":212},{"_32":198,"_13":199,"_65":86,"_42":-5,"_34":35,"_164":39,"_165":88,"_36":200,"_38":26,"_68":201,"_167":202,"_70":24,"_169":-5,"_203":204,"_17":205},"65ee86ec-9340-4085-aedc-82e3473f090f","index.ts",["D",1787173974898],"http","import { parseVal, serveFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { Hono } from \"npm:hono\";\nimport { auth } from \"./backend/auth.ts\";\nimport { ensureSchema } from \"./backend/schema.ts\";\n\n// Create Better Auth's tables on first run. Idempotent (CREATE TABLE IF NOT EXISTS).\nawait ensureSchema();\n\nconst app = new Hono<{\n Variables: {\n user: typeof auth.$Infer.Session.user | null;\n session: typeof auth.$Infer.Session.session | null;\n };\n}>();\n\n// Mount Better Auth — handles /api/auth/sign-in/magic-link, /api/auth/get-session, etc.\napp.on([\"GET\", \"POST\"], \"/api/auth/*\", (c) => auth.handler(c.req.raw));\n\n// Make the session available to downstream routes via c.get(\"user\") / c.get(\"session\").\napp.use(\"*\", async (c, next) => {\n const session = await auth.api.getSession({ headers: c.req.raw.headers });\n c.set(\"user\", session?.user ?? null);\n c.set(\"session\", session?.session ?? null);\n await next();\n});\n\n// Example protected route — fetch from the frontend to get the current user.\napp.get(\"/api/me\", (c) => {\n const user = c.get(\"user\");\n if (!user) return c.json({ error: \"Not authenticated\" }, 401);\n return c.json({ user });\n});\n\n// Serve the frontend\napp.get(\"/\", () => serveFile(\"/frontend/index.html\"));\napp.get(\"/frontend/**/*\", (c) => serveFile(c.req.path));\n\n// View source redirect\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n// Unwrap and rethrow Hono errors as the original error so we get real stack traces.\napp.onError((err) => Promise.reject(err));\n\nexport default app.fetch;\n","children",[],[199],"8ce26010-72ff-4f12-9cbb-41356a5da823","README.md","01a01bde-b3e7-75ae-84e1-fae9ba7caa3c",["D",1787173974898],"# Better Auth Starter\n\nMagic-link authentication for Val Town, powered by\n[Better Auth](https://better-auth.com). Click **Remix** and you have a working\nauth-protected app — no setup required.\n\nIt uses [Val Town SQLite](https://docs.val.town/std/sqlite/) for the\nuser/session database and [Val Town Email](https://docs.val.town/std/email/) to\nsend the magic links. **Sending magic links to anyone other than yourself\nrequires [Val Town Pro](https://www.val.town/pricing).**\n\n## Architecture\n\n```mermaid\ngraph LR\n Browser -->|\"GET /\"| Hono[\"index.ts
(Hono server)\"]\n Browser -->|\"/api/auth/*\"| BA[\"Better Auth
handler\"]\n Hono -->|serves| HTML[\"index.html\"]\n HTML -->|loads| Entry[\"index.tsx\"]\n Entry -->|renders| App[\"App.tsx\"]\n App -->|useSession| Client[\"auth-client.ts\"]\n Client -->|fetch| BA\n BA -->|reads/writes| SQLite[(\"std/sqlite\")]\n BA -->|sends magic link| Email[\"std/email\"]\n```\n\n## File structure\n\n```\nindex.ts ← Hono entrypoint; mounts Better Auth at /api/auth/*\nbackend/\n auth.ts ← Better Auth instance (server)\n schema.ts ← Creates the user/session/account/verification tables\nfrontend/\n index.html ← HTML shell (loads Twind + React)\n index.tsx ← React entrypoint (mounts )\n lib/\n auth-client.ts ← Better Auth React client (useSession, signIn, signOut)\n components/\n App.tsx ← Root: shows or based on session\n SignIn.tsx ← Email form that calls signIn.magicLink\n Dashboard.tsx ← Signed-in view with sign-out button\n```\n\n## How auth works\n\n1. User enters their email and submits the form. The client calls\n `authClient.signIn.magicLink({ email })`, which `POST`s to\n `/api/auth/sign-in/magic-link`.\n2. Better Auth generates a token, stores it in the `verification` table, and\n calls our `sendMagicLink` callback in `backend/auth.ts`. The callback uses\n `std/email` to send the link.\n3. User clicks the link, which opens `/api/auth/magic-link/verify?token=…`.\n Better Auth validates the token, creates a row in `session`, sets a secure\n cookie, and redirects to `/`.\n4. Back in React, `useSession()` re-fetches `/api/auth/get-session`, the user\n object becomes available, and `` renders ``.\n\n## Adding more auth methods\n\nBetter Auth has a rich [plugin ecosystem](https://better-auth.com/docs/plugins).\nCommon next steps:\n\n- **Email + password** — flip `emailAndPassword.enabled` to `true` in\n `backend/auth.ts`. No plugin needed.\n- **Social login (Google, GitHub, …)** — add `socialProviders` to your auth\n config and store the client IDs/secrets as env vars. See the\n [social providers docs](https://better-auth.com/docs/concepts/social-providers).\n- **Passkeys, 2FA, organizations** — add the relevant plugin on the server and\n the matching client plugin in `frontend/lib/auth-client.ts`.\n\nAfter enabling new methods, you may need new database columns. See the\n[database concepts](https://better-auth.com/docs/concepts/database) page — for\nSQLite you'll add the columns directly to `backend/schema.ts`.\n\n## Production checklist\n\n- [ ] Set the **`BETTER_AUTH_SECRET`** env var to a random string from\n [`generate-random-signing-key.val.run`](https://generate-random-signing-key.val.run/).\n- [ ] Narrow `baseURL.allowedHosts` in `backend/auth.ts` to the exact hosts you\n serve from (e.g. `[\"myapp.com\", \"*.web.val.run\"]`).\n- [ ] Make sure your Val Town account is on [Pro](https://www.val.town/pricing)\n so emails can be sent to addresses other than your own.\n\n## Notes\n\n- The session cookie defaults to 7 days and refreshes itself.\n- Magic-link tokens expire after 5 minutes and are single-use by default.\n- Better Auth uses Kysely under the hood — Val Town's `std/sqlite` is already an\n `@libsql/client` Client, so we hand it straight to `LibsqlDialect`. Zero\n database setup.",[],[207],"783aff7b-3ec7-4fe5-ac03-30c2102cca80","index.tsx","01a01bde-b3e7-75ae-84e1-f1fa459c8fdb","01a01bde-b3e7-75ae-84e1-f7069749d4be",["D",1787173974898],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { createRoot } from \"https://esm.sh/react-dom@18.2.0/client\";\nimport { App } from \"./components/App.tsx\";\n\nconst root = document.getElementById(\"root\");\nif (!root) {\n throw new Error(\"No root element found\");\n}\n\ncreateRoot(root).render();",[],[171,214],"ce2369c5-26c6-4942-8bba-b914e04b9d22","index.html","01a01bde-b3e7-75ae-84e1-ec78266bff27",["D",1787173974898],"\n\n \n \n \n Better Auth Starter\n \n \n \n \n

\n \n \n \n",[],[171,222],"7dc7b054-cdd0-4e35-83eb-897979ee2483","favicon.svg","01a01bde-b3e6-71bb-818c-f09f58c6596f",["D",1787173974898],"\n",[],[171,229],"32c5e9b1-e52a-43ff-967e-c4f3f1e1ba96","auth-client.ts","01a01bde-b3e6-71bb-818c-ea590be4a25e","01a01bde-b3e6-71bb-818c-eccb3df547f5",["D",1787173974898],"import { createAuthClient } from \"https://esm.sh/better-auth@1.6.9/react?deps=react@18.2.0,react-dom@18.2.0\";\nimport { magicLinkClient } from \"https://esm.sh/better-auth@1.6.9/client/plugins?deps=react@18.2.0,react-dom@18.2.0\";\n\n// Base URL is the same origin as the page, so we don't need to set it.\n// Plugins must mirror the server-side plugins enabled in backend/auth.ts.\nexport const authClient = createAuthClient({\n plugins: [magicLinkClient()],\n});\n\nexport const { useSession, signIn, signOut } = authClient;\n",[],[171,243,236],"lib","cf5279b5-064b-4847-9fda-cbbe8ba6c606",["D",1787173974898],"directory",[192],[171,243],"0909ad61-4b8f-4df2-b1b3-bb73ea325f25","SignIn.tsx","01a01bde-b3e6-71bb-818c-e39c028724b7",["D",1787173974898],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { useState } from \"https://esm.sh/react@18.2.0\";\nimport { signIn } from \"../lib/auth-client.ts\";\n\nexport function SignIn() {\n const [email, setEmail] = useState(\"\");\n const [status, setStatus] = useState<\"idle\" | \"sending\" | \"sent\" | \"error\">(\n \"idle\",\n );\n const [errorMsg, setErrorMsg] = useState(\"\");\n\n async function handleSubmit(e: React.FormEvent) {\n e.preventDefault();\n setStatus(\"sending\");\n setErrorMsg(\"\");\n const { error } = await signIn.magicLink({\n email,\n callbackURL: \"/\",\n });\n if (error) {\n setStatus(\"error\");\n setErrorMsg(error.message ?? \"Failed to send magic link\");\n } else {\n setStatus(\"sent\");\n }\n }\n\n if (status === \"sent\") {\n return (\n

📬 Check your email

\n We sent a sign-in link to {email}.\n

\n );\n }\n\n return (\n

\n \n Email\n setEmail((e.target as HTMLInputElement).value)}\n placeholder=\"you@example.com\"\n class=\"mt-1 block w-full px-3 py-2 border border-gray-300 rounded-lg focus:ring-2 focus:ring-blue-500 focus:border-blue-500 outline-none\"\n disabled={status === \"sending\"}\n />\n \n \n {status === \"sending\" ? \"Sending…\" : \"Send magic link\"}\n \n {status === \"error\" && (\n

{errorMsg}

\n )}\n \n );\n}\n",[],[171,172,250],"36615a36-6cd9-434f-8c85-4b248266b178","Dashboard.tsx","01a01bde-b3e6-71bb-818c-df02fcbde22a",["D",1787173974898],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { signOut } from \"../lib/auth-client.ts\";\n\ntype User = {\n id: string;\n email: string;\n name: string;\n image?: string | null;\n};\n\nexport function Dashboard({ user }: { user: User }) {\n return (\n

Signed in as

{user.email}

\n {user.name && user.name !== user.email && (\n

Name: {user.name}

\n )}\n

id: {user.id}

\n signOut().then(() => location.reload())}\n class=\"w-full bg-gray-100 hover:bg-gray-200 text-gray-800 font-medium px-4 py-2 rounded-lg transition-colors cursor-pointer\"\n >\n Sign out\n \n

\n );\n}\n",[],[171,172,257],["D",1787173974898],[],[171,172,67],"c6d1af8d-b79f-47a5-a29b-8096c2b496aa",["D",1787173974898],[188,189,190],[171,172],"da07d74a-2ad3-47e8-b1d4-92ae9f09cc29",["D",1787173974898],[187,191,193,194,195],[171],"92b14450-fddf-427d-9730-c18d5f192aec","schema.ts","01a01bde-b3e6-71bb-818c-d2d74c29b72e","01a01bde-b3e6-71bb-818c-d6c7d7f16e18",["D",1787173974898],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\n// Better Auth's standard SQLite schema for core auth + magic link.\n// Magic link uses the `verification` table — no extra plugin tables needed.\n//\n// We run this on startup so the template works with zero setup.\n// Better Auth manages all reads/writes via Kysely; we just ensure the tables exist.\nexport async function ensureSchema() {\n await sqlite.batch([\n `CREATE TABLE IF NOT EXISTS user (\n id TEXT PRIMARY KEY,\n name TEXT NOT NULL,\n email TEXT NOT NULL UNIQUE,\n emailVerified INTEGER NOT NULL DEFAULT 0,\n image TEXT,\n createdAt INTEGER NOT NULL,\n updatedAt INTEGER NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS session (\n id TEXT PRIMARY KEY,\n userId TEXT NOT NULL REFERENCES user(id) ON DELETE CASCADE,\n token TEXT NOT NULL UNIQUE,\n expiresAt INTEGER NOT NULL,\n ipAddress TEXT,\n userAgent TEXT,\n createdAt INTEGER NOT NULL,\n updatedAt INTEGER NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS account (\n id TEXT PRIMARY KEY,\n userId TEXT NOT NULL REFERENCES user(id) ON DELETE CASCADE,\n accountId TEXT NOT NULL,\n providerId TEXT NOT NULL,\n accessToken TEXT,\n refreshToken TEXT,\n accessTokenExpiresAt INTEGER,\n refreshTokenExpiresAt INTEGER,\n scope TEXT,\n idToken TEXT,\n password TEXT,\n createdAt INTEGER NOT NULL,\n updatedAt INTEGER NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS verification (\n id TEXT PRIMARY KEY,\n identifier TEXT NOT NULL,\n value TEXT NOT NULL,\n expiresAt INTEGER NOT NULL,\n createdAt INTEGER NOT NULL,\n updatedAt INTEGER NOT NULL\n )`,\n ]);\n}\n",[],[282,275],"backend","0df7d8f0-571c-4951-853a-b4d7efd3aa9e","auth.ts","01a01bde-b3e6-71bb-818c-ce6760ae90d3",["D",1787173974898],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { email as sendEmail } from \"https://esm.town/v/std/email\";\nimport { httpEndpoint, parseVal } from \"https://esm.town/v/std/utils/index.ts\";\nimport { betterAuth } from \"npm:better-auth\";\nimport { magicLink } from \"npm:better-auth/plugins\";\nimport { LibsqlDialect } from \"npm:@libsql/kysely-libsql\";\n\n// Vals can be reached from multiple URLs (the *.web.val.run preview URL,\n// custom domains, branch deploys, etc). Better Auth's dynamic baseURL form\n// derives the URL from each incoming request and validates it against\n// allowedHosts. The fallback is used when running outside an HTTP context\n// (e.g. cron jobs, scripts).\nconst fallback = await httpEndpoint();\n\n// A secret is required to sign session tokens. We default to a per-val auto\n// secret so the template works with zero setup — but for production you should\n// set BETTER_AUTH_SECRET so sessions survive code edits across val versions.\nconst { username, name } = parseVal();\nconst secret =\n Deno.env.get(\"BETTER_AUTH_SECRET\") ?? `val-town-default-${username}-${name}`;\n\n// Val Town's `std/sqlite` is already an `@libsql/client` Client,\n// so we can hand it straight to Better Auth's Kysely libsql dialect.\n// Zero database setup required.\nexport const auth = betterAuth({\n baseURL: {\n // Accept any host so this works on the *.web.val.run preview URL,\n // custom domains, and any future deployment URL. For production you\n // should narrow this to the specific hosts you serve from, e.g.\n // [\"myapp.com\", \"*.web.val.run\"].\n allowedHosts: [\"*\"],\n protocol: \"auto\",\n fallback,\n },\n secret,\n database: {\n dialect: new LibsqlDialect({ client: sqlite }),\n type: \"sqlite\",\n },\n // Disable email+password — this template is magic link only.\n emailAndPassword: { enabled: false },\n plugins: [\n magicLink({\n sendMagicLink: async ({ email, url }) => {\n // Val Town's built-in email. Sending to addresses other than your own\n // requires a Pro account: https://www.val.town/pricing\n await sendEmail({\n to: email,\n subject: \"Your sign-in link\",\n text: `Click to sign in: ${url}\\n\\nThis link expires in 5 minutes.`,\n html:\n `

Click to sign in:

` +\n `

${url}

` +\n `

This link expires in 5 minutes.

`,\n });\n },\n }),\n ],\n});\n",[],[282,284],"7d6fcffa-6e42-4b17-8f26-36b1d12c3091",["D",1787173974898],[184,185],[282],["D",1787173974898],["D",1789608640792],{"_11":12,"_128":73},{"_11":12,"_124":-5,"_72":73,"_30":71,"_125":126,"_127":24},{"_38":39,"_13":16,"_32":35,"_114":75,"_115":62,"_116":63,"_117":79,"_118":119,"_120":121,"_122":14,"_123":12},"ctx",{"_51":-5,"_149":332,"_333":334,"_335":336,"_337":24,"_338":24,"_339":24,"_340":88,"_341":-5,"_342":-7,"_343":-7,"_344":26,"_345":24,"_346":24,"_347":-5,"_348":24,"_349":24,"_350":24,"_351":-5},"ENV",{"_303":304,"_305":306,"_307":16,"_308":309,"_310":311,"_312":313,"_314":315,"_316":317,"_318":319,"_320":321,"_322":323,"_324":325,"_326":327,"_328":329,"_330":331},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","c73f21da490985bff19c279eb0e09db24d688e4f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · App.tsx