AUTH STARTER · BEARER TOKENS & API
Bearer tokens & API
For mobile apps, scripts, and machine-to-machine. The bearer plugin accepts Authorization: Bearer <token>.
Cookies are great for the web — they don't work for native mobile apps or curl scripts. The bearer plugin lets the same Better Auth endpoints accept tokens via the Authorization header instead.
Turn it on
// src/auth.config.ts
plugins: {
bearer: { enabled: true },
},Authenticate a request
curl https://yourdomain.com/api/me \
-H "Authorization: Bearer <session-token>"On the server side, auth.api.getSession({ headers }) works identically — it inspects cookies AND the Authorization header. Same code, two transport mechanisms.
OpenAPI reference
openAPI plugin (enabled in dev only by default) generates a Swagger UI at /api/auth/reference. Useful for exploring the API surface while you build a mobile client.
openAPI: {
enabled: process.env.NODE_ENV === "development",
},Don't ship OpenAPI to production
It exposes the full API surface to anyone who hits the URL. We default it to dev-only on purpose. If you really want it in prod, gate it behind admin auth.
Bearer tokens are session tokens
There's no separate "API token" type yet — the token you pass as Bearer is the same session token from the cookie. Rotate it like a session, expire it like a session. Don't paste it in CI logs.