Plugins

26 plugins ship with the package under better_auth.plugins_ext. Each one is a class; pass instances to BetterAuth(plugins=[...]).

from better_auth import BetterAuth
from better_auth.plugins_ext import OrganizationPlugin, TwoFactorPlugin

auth = BetterAuth(
    secret="a-strong-32-character-minimum-secret",
    plugins=[TwoFactorPlugin(issuer="Example"), OrganizationPlugin()],
)

Plugins add routes under base_path, extend the database schema (their tables migrate exactly like the core ones), and hook the request pipeline. Every constructor option mirrors the TypeScript option of the same name in snake_case, with the same default. better_auth.plugins_ext.__all__ is the authoritative list. Each plugin has its own page:

Sign-in methods

• Username — sign in with a username instead of an email
• Magic Link — passwordless sign-in through a single-use link
• Email OTP — one-time codes by email
• Phone Number — SMS one-time codes
• Passkey (WebAuthn) — WebAuthn/FIDO2
• Anonymous — throwaway guest users, linked on real sign-up
• Sign-In with Ethereum — SIWE (ERC-4361) wallet authentication
• Google One Tap — sign in from Google's One Tap prompt
• Two-Factor Authentication — TOTP, OTP and backup codes as a second factor

Organizations and access control

• Admin — user administration, bans, impersonation
• Organization — organizations, members, invitations, teams

Tokens and keys

• API Key — long-lived database-backed API keys
• JWT — signed JWTs plus a published JWKS
• Bearer Token — the set-auth-token response header
• One-Time Token — single-use session handoff tokens

Being an OAuth server

• OAuth Provider — a full OAuth 2.1 / OIDC authorization server
• Device Authorization — the RFC 8628 device flow

Federating outward

• SSO (OIDC) — OIDC identity providers per domain or organization
• Generic OAuth — any OAuth2/OIDC provider, configured at runtime
• OAuth Proxy — social login from preview deployments
• OAuth Popup — social sign-in in a popup window

Session shaping

• Multi-Session — several accounts signed in at once
• Custom Session — reshape the /get-session payload
• Last Login Method — the "you last signed in with…" hint

Abuse prevention

• Captcha — CAPTCHA checks before protected endpoints
• Have I Been Pwned — reject breached passwords

Writing your own

Everything above uses the same public surface your plugin has — see Core concepts.