# Better Auth for Python > `better-auth-server` is a server-side Python port of Better Auth, at wire and storage parity with the TypeScript library v1.6.25 — same routes, JSON shapes, error codes and database schema. 35 social providers, 26 plugins, FastAPI, Litestar, Flask and Django integrations, plus `better-auth-client`, a Python HTTP client for any Better Auth server. ## Guide - [Home](https://better-auth-py.oumarbarry.tech/): A server-side port of Better Auth. - [Getting started](https://better-auth-py.oumarbarry.tech/guide/getting-started): `better-auth-server` is a server-side Python port of Better Auth, at full parity with the TypeScript library v1.6.25. - [Core concepts](https://better-auth-py.oumarbarry.tech/guide/concepts): Four ideas carry the whole library: sessions live in your database, adapters are the only thing that touches storage, plugins add everything else, and parity means the wire and the storage format are not yours to change. - [Configuration](https://better-auth-py.oumarbarry.tech/guide/configuration): Every option lives on the `BetterAuth` constructor, and every one is keyword-only. - [Python client](https://better-auth-py.oumarbarry.tech/guide/client): `better-auth-client` is the Python HTTP client for Better Auth servers, on PyPI. - [AI agents](https://better-auth-py.oumarbarry.tech/guide/agents): This project ships three things for coding agents: an installable skill, plain-text mirrors of this site, and in-repo agent instructions. ## Plugins - [Plugins](https://better-auth-py.oumarbarry.tech/plugins/): 26 plugins ship with the package under `better_auth.plugins_ext`. - [Username](https://better-auth-py.oumarbarry.tech/plugins/username): Sign in with a username instead of an email, with configurable validation and normalization. - [Magic Link](https://better-auth-py.oumarbarry.tech/plugins/magic-link): Passwordless sign-in through a single-use emailed link. - [Email OTP](https://better-auth-py.oumarbarry.tech/plugins/email-otp): One-time codes by email for sign-in, email verification, email change and password reset. - [Phone Number](https://better-auth-py.oumarbarry.tech/plugins/phone-number): SMS one-time codes for sign-in, phone verification and password reset. - [Passkey (WebAuthn)](https://better-auth-py.oumarbarry.tech/plugins/passkey): WebAuthn/FIDO2 registration and authentication — Touch ID, Windows Hello, hardware keys. - [Anonymous](https://better-auth-py.oumarbarry.tech/plugins/anonymous): A throwaway user and session for visitors who have not signed up. - [Sign-In with Ethereum](https://better-auth-py.oumarbarry.tech/plugins/siwe): Sign-In with Ethereum (SIWE, ERC-4361) wallet authentication. - [Google One Tap](https://better-auth-py.oumarbarry.tech/plugins/one-tap): Google One Tap: the browser posts a Google id token to `/one-tap/callback` and gets a session back, running the same find/register/link decision tree as the redirect OAuth flow. - [Two-Factor Authentication](https://better-auth-py.oumarbarry.tech/plugins/two-factor): Second-factor authentication via TOTP, emailed/SMS OTP and backup codes, with a short-lived two-factor cookie between the password step and the code step, trusted devices, and optional account lockout. - [Admin](https://better-auth-py.oumarbarry.tech/plugins/admin): User administration: roles and permissions, ban and unban, impersonation, session management, setting a user's password, and permission checks. - [Organization](https://better-auth-py.oumarbarry.tech/plugins/organization): Organizations, members, invitations, teams, and dynamic access control — the largest plugin in the set. - [API Key](https://better-auth-py.oumarbarry.tech/plugins/api-key): Long-lived API keys backed by the database: create, list, update, delete and verify, with prefixes, expiry windows, per-key rate limits, refill quotas, metadata and permissions. - [JWT](https://better-auth-py.oumarbarry.tech/plugins/jwt): Issues signed JWTs for the current session and publishes a JWKS so other services can verify them without calling back. - [Bearer Token](https://better-auth-py.oumarbarry.tech/plugins/bearer): Echoes the session token back on a `set-auth-token` response header so cookieless clients can store it. - [One-Time Token](https://better-auth-py.oumarbarry.tech/plugins/one-time-token): Mints a short-lived, single-use token from an existing session and exchanges it back for that session — the standard cross-domain or SSR handoff. - [OAuth Provider](https://better-auth-py.oumarbarry.tech/plugins/oauth-provider): Turns your app into an OAuth 2.1 / OIDC authorization server: client registration and management, authorize and consent, every token grant, introspection, userinfo, revocation and end-session — RFC 6749, 7009, 7636 and 7662. - [Device Authorization](https://better-auth-py.oumarbarry.tech/plugins/device-authorization): The OAuth 2.0 Device Authorization Grant (RFC 8628) — the "enter this code on another device" flow for TVs and CLIs. - [SSO (OIDC)](https://better-auth-py.oumarbarry.tech/plugins/sso): OIDC federation: register external identity providers per domain or organization and route `/sign-in/sso` to the right one, with SSRF-guarded discovery, optional DNS TXT domain verification and user/organization provisioning. - [Generic OAuth](https://better-auth-py.oumarbarry.tech/plugins/generic-oauth): Sign in with any OAuth2/OIDC provider that is not in the built-in registry, configured at runtime — point it at a discovery URL or spell out the endpoints. - [OAuth Proxy](https://better-auth-py.oumarbarry.tech/plugins/oauth-proxy): Lets preview and branch deployments finish a social login against the single redirect URI registered with the provider, by proxying the callback through the fixed production deployment. - [OAuth Popup](https://better-auth-py.oumarbarry.tech/plugins/oauth-popup): Runs social sign-in in a popup window: the client navigates the popup to `/oauth-popup/start`, and on the OAuth callback the plugin swaps the redirect for a page that posts the session token (or error) back to the opener. - [Multi-Session](https://better-auth-py.oumarbarry.tech/plugins/multi-session): Several accounts signed in at once, each with its own device-session cookie, plus endpoints to list, switch and revoke them. - [Custom Session](https://better-auth-py.oumarbarry.tech/plugins/custom-session): Wraps `GET /get-session` so you can reshape or enrich what clients receive — joining a subscription, a role, a tenant. - [Last Login Method](https://better-auth-py.oumarbarry.tech/plugins/last-login-method): Records which method was used on the most recent successful sign-in, in a cookie and optionally in the database — the "you last signed in with GitHub" hint. - [Captcha](https://better-auth-py.oumarbarry.tech/plugins/captcha): Verifies an `x-captcha-response` header against a CAPTCHA provider before the protected endpoints run. - [Have I Been Pwned](https://better-auth-py.oumarbarry.tech/plugins/have-i-been-pwned): Rejects passwords found in the Have I Been Pwned breach corpus, using a k-anonymity range query so the password never leaves your server. ## Providers - [Social providers](https://better-auth-py.oumarbarry.tech/providers/): 35 OAuth2/OIDC providers are built in. - [Apple](https://better-auth-py.oumarbarry.tech/providers/apple): Sign in with Apple. - [Atlassian](https://better-auth-py.oumarbarry.tech/providers/atlassian): Atlassian account OAuth2 with PKCE (S256). - [Amazon Cognito](https://better-auth-py.oumarbarry.tech/providers/cognito): Amazon Cognito user pools. - [Discord](https://better-auth-py.oumarbarry.tech/providers/discord): Discord OAuth2. - [Dropbox](https://better-auth-py.oumarbarry.tech/providers/dropbox): Dropbox OAuth2 with PKCE (S256). - [Facebook](https://better-auth-py.oumarbarry.tech/providers/facebook): Facebook Login (Graph API v24.0). - [Figma](https://better-auth-py.oumarbarry.tech/providers/figma): Figma OAuth2 with PKCE (S256). - [GitHub](https://better-auth-py.oumarbarry.tech/providers/github): GitHub OAuth2. - [GitLab](https://better-auth-py.oumarbarry.tech/providers/gitlab): GitLab OAuth2 with PKCE (S256), for gitlab.com or self-hosted instances. - [Google](https://better-auth-py.oumarbarry.tech/providers/google): Google OIDC with PKCE (S256), a nonce on the authorize URL, and id-token verification against Google's JWKS. - [Hugging Face](https://better-auth-py.oumarbarry.tech/providers/huggingface): Hugging Face OAuth (OIDC-shaped) with PKCE (S256). - [Kakao](https://better-auth-py.oumarbarry.tech/providers/kakao): Kakao Login OAuth2. - [Kick](https://better-auth-py.oumarbarry.tech/providers/kick): Kick OAuth2 with PKCE (S256). - [LINE](https://better-auth-py.oumarbarry.tech/providers/line): LINE Login v2.1 with PKCE (S256). - [Linear](https://better-auth-py.oumarbarry.tech/providers/linear): Linear OAuth2. - [LinkedIn](https://better-auth-py.oumarbarry.tech/providers/linkedin): LinkedIn OIDC sign-in. - [Microsoft Entra ID](https://better-auth-py.oumarbarry.tech/providers/microsoft): Microsoft Entra ID (Azure AD), registry key `microsoft`. - [Naver](https://better-auth-py.oumarbarry.tech/providers/naver): Naver Login OAuth2. - [Notion](https://better-auth-py.oumarbarry.tech/providers/notion): Notion public-integration OAuth2. - [Paybin](https://better-auth-py.oumarbarry.tech/providers/paybin): Paybin identity provider (OIDC-shaped) with required PKCE (S256). - [PayPal](https://better-auth-py.oumarbarry.tech/providers/paypal): PayPal "Log in with PayPal". - [Polar](https://better-auth-py.oumarbarry.tech/providers/polar): Polar OAuth2 (OIDC-shaped) with PKCE (S256). - [Railway](https://better-auth-py.oumarbarry.tech/providers/railway): Railway OAuth2 (OIDC-shaped) with PKCE (S256) and basic token-endpoint auth. - [Reddit](https://better-auth-py.oumarbarry.tech/providers/reddit): Reddit OAuth2. - [Roblox](https://better-auth-py.oumarbarry.tech/providers/roblox): Roblox OAuth2 (OIDC-shaped userinfo). - [Salesforce](https://better-auth-py.oumarbarry.tech/providers/salesforce): Salesforce OAuth2 with PKCE (S256), for production, sandbox, or a My Domain host. - [Slack](https://better-auth-py.oumarbarry.tech/providers/slack): Sign in with Slack (`openid.connect` flavor). - [Spotify](https://better-auth-py.oumarbarry.tech/providers/spotify): Spotify OAuth2 with PKCE (S256). - [TikTok](https://better-auth-py.oumarbarry.tech/providers/tiktok): TikTok Login Kit. - [Twitch](https://better-auth-py.oumarbarry.tech/providers/twitch): Twitch OIDC-flavored OAuth2. - [Twitter (X)](https://better-auth-py.oumarbarry.tech/providers/twitter): X (Twitter) OAuth2 with PKCE (S256) and basic token-endpoint auth. - [Vercel](https://better-auth-py.oumarbarry.tech/providers/vercel): Sign in with Vercel. - [VK](https://better-auth-py.oumarbarry.tech/providers/vk): VK ID OAuth2 with PKCE (S256). - [WeChat](https://better-auth-py.oumarbarry.tech/providers/wechat): WeChat QR-code login (`snsapi_login`). - [Zoom](https://better-auth-py.oumarbarry.tech/providers/zoom): Zoom OAuth2. ## Migrate - [Migrating from Node](https://better-auth-py.oumarbarry.tech/migrate/from-node): The short version: point a Python service at the database your TypeScript Better Auth app already uses, and your users keep their passwords, their linked accounts, and their open sessions. ## Deploy - [Production deploy](https://better-auth-py.oumarbarry.tech/deploy/production): Everything on this page is infrastructure rather than API surface: the five things that are fine on localhost and wrong in production.