Better Auth security skill for Claude Code: harden your auth setup

Helps Claude harden a Better Auth setup: rate limits, secrets, CSRF, trusted origins, cookies and audit logging.

Installs: 49.5K; on skills.sh
Stars: 228; on GitHub
Updated: Oct 2026; last repo commit

This skill makes Claude configure the security side of Better Auth. Its description lists rate limiting, auth secrets, CSRF protection, trusted origins, session and cookie security, OAuth token encryption, IP tracking and audit logging.

SKILL.md ends with a ten-item production checklist, such as a 32+ character secret, HTTPS, trusted origins and keeping CSRF protection on. It is one Markdown file and bundles no scripts.

Good for

Developers preparing a Better Auth app for production
Teams that need rate limiting and brute-force protection
Anyone adding audit logs or IP tracking to auth events

Install better-auth-security-best-practices

Claude Code

Copy this prompt.

Install the better-auth-security-best-practices skill in Claude Code. Run this command:

npx skills add https://github.com/better-auth/skills --skill better-auth-security-best-practices

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

From its listing on skills.sh. Source.

What's in the skill

When it loads

Configure rate limiting, manage auth secrets, set up CSRF protection, define trusted origins, secure sessions and cookies, encrypt OAuth tokens, track IP addresses, and implement audit logging for Better Auth. Use when users need to secure their auth setup, prevent brute force attacks, or harden a Better Auth deployment.

Sections in SKILL.md

Secret Management
Configuring the Secret
Secret Requirements
Rate Limiting
Default Configuration
Storage Options
Custom Storage
Per-Endpoint Rules
CSRF Protection
Configuration
Trusted Origins
Configuring Trusted Origins
Wildcard Patterns
Dynamic Trusted Origins
Session Security
Session Expiration

Key facts

Author: Better Auth (better-auth org)
Repository: better-auth/skills
Installs on skills.sh: 49,486 (Nov 2, 2026)
GitHub stars (repo): 228 (Nov 2, 2026)
Last repo commit: Oct 19, 2026
Files: 1 file (SKILL.md only)

What it includes

How to set the secret, with a 32+ character requirement and openssl rand -base64 32.
Secret management
Default config, storage options, custom storage and per-endpoint rules.
Rate limiting
Configuration, and keeping the check on.
CSRF protection
Static, wildcard and dynamic origin lists.
Trusted origins
Expiration, caching strategies, custom and cross-subdomain cookies.
Session and cookie security
State parameter storage and encrypting stored OAuth tokens.
OAuth security
IP address headers for apps behind a proxy.
IP-based security
Database hooks for auditing, plus background task setup for serverless hosts.
Audit logging and background tasks
A short section on avoiding user enumeration.
Account enumeration prevention
Secret, HTTPS, origins, rate limits, CSRF, cookies, tokens, tasks, audit, IP.
Production checklist (10)

From the official docs

Questions

How do I install it?

Use the install box above. It installs only better-auth-security-best-practices, not the other five skills in the repo.

Which Better Auth skill should I install?

The better-auth/skills repo has six: best-practices (setup and config), create-auth (planning and scaffolding), security, emailAndPassword, organization and twoFactor. Start with create-auth for a new project and best-practices for config questions, then add the topic skill you need.

Does it make my app secure?

No. It gives Claude Better Auth's recommended settings and a checklist. You still need to review the config it writes and test your own deployment.

Does it change my code?

It makes Claude write or edit Better Auth config in your project when you ask for security changes. Review the diff, especially anything touching secrets or origins.

Is it safe to install?

The folder is one Markdown file with no scripts, so installing adds instructions only. Keep real secrets out of chat and out of committed files.

Does it work in the Claude app or Codex?

The install box lists a zip upload for the Claude app and a skills folder for Codex. The repo has no README, so the author does not say which clients it supports.

Information

updated Nov 2, 2026

Repository: better-auth/skills
Folder: security

better-auth/skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 6

better-auth-security-best-practices SKILL.md · github.com
skills.sh listing · skills.sh
Repository · github.com
Using skills in Claude · support.claude.com
Claude Code skills · code.claude.com
better-auth/skills repo tree · github.com