Configuration

All runtime configuration goes through AuthConfig.

AuthConfig

use better_auth::AuthConfig;
use chrono::Duration;

let config = AuthConfig::new("your-secret-key-at-least-32-characters-long")
    .app_name("My App")
    .base_url("https://auth.example.com")
    .base_path("/api/auth")
    .trusted_origin("https://app.example.com")
    .session_expires_in(Duration::days(7))
    .session_update_age(Duration::days(1))
    .session_fresh_age(Duration::minutes(10))
    .jwt_expires_in(Duration::hours(24))
    .password_min_length(8);

Method	Description
`new(secret)`	Create config with the signing secret (minimum 32 characters)
`app_name(name)`	Set the app name used by emails and cookie-related metadata
`base_url(url)`	Set the auth service base URL
`base_path(path)`	Set the route mount prefix (default `/api/auth`)
`trusted_origin(origin)`	Add one trusted origin
`trusted_origins(origins)`	Replace the trusted origin list
`disabled_path(path)`	Disable one route path
`disabled_paths(paths)`	Replace the disabled path list
`session_expires_in(duration)`	Set session lifetime
`session_update_age(duration)`	Refresh sessions only when older than the given age
`disable_session_refresh(flag)`	Disable automatic session refresh entirely
`session_fresh_age(duration)`	Mark recently created sessions as "fresh"
`session_cookie_cache(config)`	Enable cookie-backed session caching
`jwt_expires_in(duration)`	Set JWT lifetime for the optional JWT surface
`password_min_length(length)`	Set minimum password length
`account(account_config)`	Replace the account/OAuth configuration block

Key Behaviors

Session tokens are opaque tokens for the v1 HTTP surface. Phases 0-12 use session cookies and Bearer tokens backed by the database. JwtConfig is only relevant when you enable the JWT surface from phase 13.
base_url(...) also sets session.cookie_secure. HTTPS URLs set Secure=true; HTTP URLs set Secure=false. With the default http://localhost:3000, the default is false.
update_age and disable_session_refresh are separate controls.
- Some(duration) refreshes only when the session is older than that duration.
- None refreshes on every access.
- disable_session_refresh(true) disables refresh entirely.
fresh_age is optional. Leave it None unless you need a freshness window for sensitive actions.

SessionConfig

Controls opaque session token handling and cookie behavior.

Field	Type	Default
`expires_in`	`chrono::Duration`	`7 days`
`update_age`	`Option<chrono::Duration>`	`Some(1 day)`
`disable_session_refresh`	`bool`	`false`
`fresh_age`	`Option<chrono::Duration>`	`None`
`cookie_name`	`String`	`"better-auth.session_token"`
`cookie_secure`	`bool`	Derived from `base_url`
`cookie_http_only`	`bool`	`true`
`cookie_same_site`	`SameSite`	`Lax`
`cookie_cache`	`Option<CookieCacheConfig>`	`None`

SameSite variants: Strict, Lax, None.

JwtConfig

Controls the optional JWT surface.

Field	Type	Default
`expires_in`	`chrono::Duration`	`1 day`
`algorithm`	`String`	`"HS256"`
`issuer`	`Option<String>`	`None`
`audience`	`Option<String>`	`None`

PasswordConfig

Controls password validation and Argon2 hashing parameters.

Field	Type	Default
`min_length`	`usize`	`8`
`require_uppercase`	`bool`	`false`
`require_lowercase`	`bool`	`false`
`require_numbers`	`bool`	`false`
`require_special`	`bool`	`false`

PasswordConfig::argon2_config defaults to:

Field	Type	Default
`memory_cost`	`u32`	`4096`
`time_cost`	`u32`	`3`
`parallelism`	`u32`	`1`

Email Provider

An email provider configures the global email backend used by flows that call EmailProvider directly.

This example assumes you've already defined AppAuthSchema. If you want a complete setup from entity definitions through Axum mounting, start with the Axum integration guide.

use better_auth::BetterAuth;
use better_auth::email::ConsoleEmailProvider;

let auth = BetterAuth::<AppAuthSchema>::new(config)
    .email_provider(ConsoleEmailProvider)
    .build()
    .await?;

For password reset specifically, POST /request-password-reset is enabled by PasswordManagementPlugin::send_reset_password(...), not by EmailProvider alone.

Validation

AuthConfig::validate() checks that the secret is at least 32 characters. This is called automatically during build().