AUTH STARTER · PRODUCTION CHECKLIST
Production checklist
Don't ship without ticking these. We've made every one of these mistakes — that's how we know.
Secrets & env
- BETTER_AUTH_SECRET is unique to prod (32+ chars).
- DATABASE_URL points at the prod database, not staging.
- BETTER_AUTH_URL and NEXT_PUBLIC_APP_URL both match the deployed origin exactly (no trailing slash, correct protocol).
- OAuth client IDs/secrets are prod values, not dev.
- RESEND_API_KEY is set and EMAIL_FROM uses a verified domain.
- DKIM, SPF, DMARC records are in your DNS.
- Sent a test sign-up to a real Gmail account → not in spam.
- Magic link clicks land back on prod URL, not localhost.
Database
- All migrations are committed and applied.
- Connection pooling (or HTTP driver) configured for serverless.
- DB has automated backups.
Auth & security
- emailAndPassword.requireEmailVerification is true.
- captcha.enabled is true (Turnstile site key in env).
- rateLimit.enabled is true (it is, in production).
- trustedOrigins in authServerConfig includes your prod origin.
- OpenAPI plugin is OFF in prod (it is, by default).
- First admin user has been assigned via DB or seed script.
Passkeys
- BETTER_AUTH_URL hostname is your final canonical domain (passkeys are bound to it).
- HTTPS is enabled (passkeys won't register over http).
Phone OTP (if enabled)
- Real SMS provider wired in src/lib/auth.ts (NOT the console.warn stub).
- Sender phone/sender ID approved (Twilio Toll-Free / Short Code if you need US scale).
When you check all of these
You are objectively further along than 90% of indie SaaS launches. The remaining 10% is just building product. Go ship.