API Routes Public v1 authentication routes (phases 0-12).
All routes are relative to the auth mount point. With the default base_path, POST /sign-up/email is exposed as POST /api/auth/sign-up/email.
This page is the authoritative v1 route inventory for phases 0-12. The pinned TypeScript runtime and compat harness are the source of truth when generated docs or upstream prose drift.
Method Path Description GET/okHealth check GET/errorRender the Better Auth error page POST/update-userUpdate the current user's profile POST/delete-userDelete the current user GET/delete-user/callbackComplete deletion with a verification token POST/change-emailStart or complete an email change flow
Method Path Description POST/sign-up/emailRegister with email and password POST/sign-in/emailSign in with email and password POST/sign-in/usernameSign in with username and password POST/is-username-availableCheck whether a username is available
Method Path Description GET/get-sessionReturn the current session and user POST/get-sessionSame without a refresh; requires session.defer_session_refresh POST/sign-outRevoke the current session GET/list-sessionsList active sessions for the current user POST/revoke-sessionRevoke one session by token POST/revoke-sessionsRevoke all sessions for the current user POST/revoke-other-sessionsRevoke all sessions except the current one POST/request-password-resetStart password reset GET/reset-password/{token}Validate a password reset token POST/reset-passwordComplete password reset POST/change-passwordChange password for the current user POST/verify-passwordVerify the current user's password
Method Path Description POST/send-verification-emailSend an email verification link GET/verify-emailVerify an email token
Method Path Description POST/sign-in/socialStart social sign-in GET/callback/{provider}Handle a provider callback POST/callback/{provider}Handle POST-based provider callbacks POST/link-socialLink a social account to the current user GET/list-accountsList linked accounts POST/unlink-accountUnlink one account POST/get-access-tokenReturn the stored OAuth access token POST/refresh-tokenRefresh a stored OAuth token GET/account-infoReturn provider account info
Method Path Description POST/device/codeCreate a device authorization request POST/device/tokenPoll for the device access token GET/deviceRender or validate the device verification step POST/device/approveApprove a pending device request POST/device/denyDeny a pending device request
/device/code accepts an optional user_id that binds the request to that user. Otherwise, the first authenticated /device lookup claims the request. Only the bound user receives client_id and scope during review and can approve or deny the request.
User-code lookup preserves exact custom codes. If exact lookup fails, default-alphabet codes accept lowercase letters and separators. Code generation retries uniqueness conflicts at most three times and propagates other database errors.
When rate limiting is enabled, /device permits five requests per client during the configured device expiration window. The default window is 30 minutes. An explicit endpoint rate limit overrides the plugin default.
The counter resets after one full window without an allowed request. Denied requests do not extend the window. The X-Retry-After response header reports the remaining wait in seconds, rounded up.
Method Path Description POST/api-key/createCreate an API key GET/api-key/getGet one API key GET/api-key/listList API keys for the current user or an organization, paginated POST/api-key/updateUpdate an API key POST/api-key/deleteDelete an API key
Method Path Description POST/organization/createCreate an organization POST/organization/check-slugCheck slug availability POST/organization/updateUpdate organization details POST/organization/deleteDelete an organization GET/organization/get-full-organizationReturn the active organization with related data POST/organization/set-activeSet the active organization for the session GET/organization/listList organizations for the current user GET/organization/list-membersList organization members GET/organization/get-active-memberReturn the current member record GET/organization/get-active-member-roleReturn the current member role POST/organization/update-member-roleChange a member role POST/organization/remove-memberRemove a member POST/organization/leaveLeave the active organization POST/organization/invite-memberInvite a member POST/organization/accept-invitationAccept an invitation POST/organization/reject-invitationReject an invitation POST/organization/cancel-invitationCancel an invitation GET/organization/get-invitationGet one invitation GET/organization/list-invitationsList organization invitations GET/organization/list-user-invitationsList invitations for the current user POST/organization/has-permissionCheck organization permissions
Method Path Description GET/passkey/generate-register-optionsStart passkey registration POST/passkey/verify-registrationComplete passkey registration GET/passkey/generate-authenticate-optionsStart passkey authentication POST/passkey/verify-authenticationComplete passkey authentication GET/passkey/list-user-passkeysList passkeys for the current user POST/passkey/delete-passkeyDelete a passkey POST/passkey/update-passkeyRename a passkey
Method Path Description GET/admin/list-usersList users GET/admin/get-userGet one user POST/admin/create-userCreate a user POST/admin/update-userUpdate a user POST/admin/remove-userDelete a user POST/admin/set-user-passwordSet a user's password POST/admin/set-roleSet a user's role POST/admin/has-permissionCheck admin permissions POST/admin/ban-userBan a user POST/admin/unban-userUnban a user POST/admin/impersonate-userStart impersonating a user POST/admin/stop-impersonatingStop impersonation POST/admin/list-user-sessionsList sessions for a user POST/admin/revoke-user-sessionRevoke one user session POST/admin/revoke-user-sessionsRevoke all user sessions
Method Path Description POST/two-factor/enableStart 2FA enrollment POST/two-factor/disableDisable 2FA POST/two-factor/get-totp-uriReturn the TOTP URI for the current user POST/two-factor/verify-totpVerify a TOTP code POST/two-factor/send-otpSend an OTP when an OTP sender is configured POST/two-factor/verify-otpVerify an OTP code POST/two-factor/generate-backup-codesGenerate a new backup-code set POST/two-factor/verify-backup-codeVerify and consume a backup code
view_backup_codes is intentionally server-only in the pinned v1 compat surface. Use TwoFactorPlugin::view_backup_codes(...) from trusted server code when needed; there is no public /two-factor/view-backup-codes route.