Authentication

Sign up with email and password

POST/api/auth/sign-up/email

Register a new user with email and password. With the username plugin enabled, an optional username field is accepted (max 30 characters, admin is blocked).

Request Body

application/json

emailRequired

string <email>·max 254

Email address. The 254-character bound is the RFC 5321 maximum.

Example[email protected]

passwordRequired

string <password>·min 1·max 256

Account password. The bound below is a documented request bound rather than a server-enforced limit.

Examples3cur3P@ss

nameRequired

string·min 1·max 256

Human-readable account name. Documented request bound, not enforced by server-side validation.

ExampleJane Doe

username

string·min 1·max 30

Username. The 30-character maximum is enforced by the username plugin (maxUsernameLength: 30). The value admin is rejected.

Examplejanedoe

Responses

Sign in with email and password

POST/api/auth/sign-in/email

Request Body

application/json

emailRequired

string <email>·max 254

Email address. The 254-character bound is the RFC 5321 maximum.

Example[email protected]

passwordRequired

string <password>·min 1·max 256

Account password. The bound below is a documented request bound rather than a server-enforced limit.

Examples3cur3P@ss

Responses

Sign in with username and password

POST/api/auth/sign-in/username

Provided by the username plugin. Behaves like sign-in with email, but identifies the user by username.

Request Body

application/json

usernameRequired

string·min 1·max 30

Username. The 30-character maximum is enforced by the username plugin (maxUsernameLength: 30). The value admin is rejected.

Examplejanedoe

passwordRequired

string <password>·min 1·max 256

Account password. The bound below is a documented request bound rather than a server-enforced limit.

Examples3cur3P@ss

Responses

Sign out and invalidate session

POST/api/auth/sign-out

Invalidate the current session. Requires a session cookie or Bearer token.

This operation takes no request body.

Sign up with email and password

Request Body

Responses

200User created successfully

Show Child AttributesHide Child Attributes

Show Child AttributesHide Child Attributes

400The request was malformed or failed validation.

401Authentication is missing or invalid.

403The caller is authenticated but not permitted to perform this action.

404No resource exists at this path.

429Too many requests. Sign-up is limited to 30 requests per hour per client address.

500The service failed to process the request.

defaultUnexpected error.

Sign in with email and password

Request Body

Responses

200Sign-in successful

Show Child AttributesHide Child Attributes

Show Child AttributesHide Child Attributes

400The request was malformed or failed validation.

401Authentication is missing or invalid.

403The caller is authenticated but not permitted to perform this action.

404No resource exists at this path.

429Too many requests. Sign-in is limited to 5 requests per 60 seconds per client address.

500The service failed to process the request.

defaultUnexpected error.

Sign in with username and password

Request Body

Responses

200Sign-in successful

Show Child AttributesHide Child Attributes

Show Child AttributesHide Child Attributes

400The request was malformed or failed validation.

401Authentication is missing or invalid.

403The caller is authenticated but not permitted to perform this action.

404No resource exists at this path.

429Too many requests. Sign-in is limited to 5 requests per 60 seconds per client address.

500The service failed to process the request.

defaultUnexpected error.

Sign out and invalidate session

Responses

200Signed out successfully

401Authentication is missing or invalid.

403The caller is authenticated but not permitted to perform this action.

404No resource exists at this path.

429Too many requests. Better Auth applies a default budget of 100 requests per 60 seconds per client address across `/api/auth/*`.

500The service failed to process the request.

defaultUnexpected error.