TurboJet
Authentication

Overview

Better Auth — magic link, email OTP, Google, GitHub, and Apple.

TurboJet ships a complete authentication stack powered by Better Auth. User data lives in your PostgreSQL database via the Prisma adapter — you keep full control without Auth0 or Clerk.

Config is in packages/auth/src/index.ts:

  • Prisma adapter against PostgreSQL
  • Extra user fields: hasOnboarded, role, isBanned, mobile
  • trustedOrigins / allowedDevOrigins: SaaS + marketing (+ app) URLs, plus https://appleid.apple.com for Sign in with Apple

This host vs full kit

This checkout hosts marketing and docs only. Login/signup UI and the /api/auth mount live on the SaaS app in the full TurboJet monorepo. Point BETTER_AUTH_URL, NEXT_PUBLIC_SAAS_URL, and NEXT_PUBLIC_APP_URL at the origin that mounts Better Auth. See Environment and Deployment.

Sign-in methods

On the SaaS auth UI (full kit), the layout is:

  1. Social row: Apple / Google / GitHub (buttons appear only when that provider is configured)
  2. Tabs: Magic link | OTP

Password, passkey, and guest login are not included.

Sign-in sends a Resend email (MagicLinkSignIn — see Mail). After the user clicks the link, Better Auth redirects with a callback URL on the SaaS origin (typically /dashboard).

Rate limit for /magic-link/*: 3 requests per hour.

Email OTP

Uses the Better Auth emailOTP plugin:

  1. Send a 6-digit code (type: "sign-in")
  2. User enters the code
  3. Complete sign-in with signIn.emailOtp

OTP emails use EmailOtpSignIn (Mail). Codes expire in 5 minutes (5 attempts). Rate limit for /email-otp/*: 5 requests per hour.

Guides

User and session

getSessionFromHeaders, authClient, SafeSession.

OAuth

Google, GitHub, Apple, and adding providers.

Admin

Role.ADMIN, Prisma Studio, and admin API.

Protect API endpoints

requireAuth, requireAdmin, optional session.

Frequently asked questions

What authentication library does TurboJet use?

Better Auth. Sessions and users are stored in your database through Prisma.

Can I use Google, GitHub, or Apple?

Yes. Google is required; GitHub and Apple are optional via environment variables. See OAuth.

Yes. Magic link and email OTP are first-class. Password-based login is not included in this kit.

How do I protect API routes?

Use Hono middleware (requireAuth, requireAdmin) — see Protect API endpoints. There is no Permix layer in this kit.

Use API in frontend

Typed Hono client, handle(), TanStack Query, and storefront checkout exceptions.

User and session

Read the session on the API and with the Better Auth client.

On this page

Sign-in methodsMagic linkEmail OTPGuidesFrequently asked questionsWhat authentication library does TurboJet use?Can I use Google, GitHub, or Apple?Does TurboJet support magic link or passwordless login?How do I protect API routes?