Agent Auth database migration required
Running npx auth migrate or npx auth generate adds the agent, host, grant, and approval tables to the database schema.
Better Auth · Concepts · all subjects
database schema
10 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
custom_session table schema
The custom_session table contains the following fields: id (uuid primary key, defaults to gen_random_uuid()), expiresAt (timestamp not null), token (text not null unique), createdAt (timestamp default now not null), updatedAt (timestamp with on update trigger not null), ipAddress (text nullable), userAgent (text nullable), userId (uuid not null foreign key references custom_user.id with onDelete cascade). An index exists on userId.
custom_account table schema
The custom_account table contains the following fields: id (uuid primary key, defaults to gen_random_uuid()), issuer (text not null), accountId (text not null), providerId (text not null), userId (uuid not null foreign key references custom_user.id with onDelete cascade), accessToken (text nullable), refreshToken (text nullable), idToken (text nullable), accessTokenExpiresAt (timestamp nullable), refreshTokenExpiresAt (timestamp nullable), scope (text nullable), password (text nullable), createdAt (timestamp default now not null), updatedAt (timestamp with on update trigger not null). A unique index exists on issuer and accountId. An index exists on userId.
custom_verification table schema
The custom_verification table contains the following fields: id (uuid primary key, defaults to gen_random_uuid()), identifier (text not null), value (text not null), expiresAt (timestamp not null), createdAt (timestamp default now not null), updatedAt (timestamp default now with on update trigger not null). An index exists on identifier.
twoFactor table schema
The twoFactor table contains the following fields: id (uuid primary key, defaults to gen_random_uuid()), secret (text not null), backupCodes (text not null), userId (uuid not null foreign key references custom_user.id with onDelete cascade), verified (boolean default true), failedVerificationCount (integer default 0), lockedUntil (timestamp nullable). Indexes exist on secret and userId.
custom_user table schema
The custom_user table contains the following fields: id (uuid primary key, defaults to gen_random_uuid()), name (text not null), email (text not null unique), emailVerified (boolean default false not null), image (text nullable), createdAt (timestamp default now not null), updatedAt (timestamp default now with on update trigger not null), twoFactorEnabled (boolean default false), username (text unique nullable), displayUsername (text nullable).
Better Auth database supports PostgreSQL
Better Auth supports PostgreSQL as evidenced by this schema using pgTable from drizzle-orm/pg-core with PostgreSQL-specific functions like pg_catalog.gen_random_uuid().
Account provider identification
The custom_account table stores OAuth provider information with issuer, accountId, and providerId fields. The combination of issuer and accountId is unique, creating a unique index on these two fields together.
Cascade delete on user removal
When a user is deleted, all related records are automatically deleted through cascade delete constraints: sessions, accounts, and two-factor records linked to that user are removed due to foreign key relationships with onDelete cascade.
Two-factor authentication fields in database
Better Auth stores two-factor authentication data with fields including: secret (the TOTP secret), backupCodes (backup codes for account recovery), verified (whether 2FA is verified), failedVerificationCount (count of failed verification attempts), and lockedUntil (timestamp indicating when the account is locked after too many failed attempts).