Auth

Quickback Stack uses Better Auth for authentication, running on Cloudflare Workers with D1 as the session store.

Overview

Better Auth provides:

• Email/password authentication
• Session management with cookies
• Multi-tenant organizations with roles
• Plugin ecosystem for passwordless auth, passkeys, and more

Configuration

Auth is configured in your quickback.config.ts:

import { defineAuth, defineConfig, defineRuntime, defineDatabase } from "@quickback/compiler";

export default defineConfig({
  name: "my-app",
  providers: {
    runtime: defineRuntime("cloudflare"),
    database: defineDatabase("cloudflare-d1"),
    auth: defineAuth("better-auth", {
      emailAndPassword: { enabled: true },
      plugins: ["emailOtp", "passkey", "magicLink"],
    }),
  },
});

Auth Base Path

All Better Auth routes are served under:

/auth/v1/*

Common endpoints:

• POST /auth/v1/sign-in/email — Email/password sign in
• POST /auth/v1/sign-up/email — Create account
• GET /auth/v1/get-session — Get current session
• POST /auth/v1/sign-out — Sign out

Organization Roles

These are Better Auth's built-in organization roles — no configuration needed. The creatorRole defaults to owner.

Tip: Account UI's role picker uses these exact three roles. Use ["owner", "admin", "member"] in your Access rules so generated projects plug into Better Auth and Account UI seamlessly.

Roles are used throughout the security layers — in Access rules, Firewall owner checks, and RLS policies.

Next Steps

• Plugins — Email OTP, passkeys, magic links, and more
• Security — Cookies, rate limiting, cross-domain auth