Bearer token example: server-side session validation
Example of validating Bearer token on server: const session = await auth.api.getSession({headers: req.headers}); if (!session) return res.status(401).json({error: 'Unauthorized'});
Better Auth · Plugins · all subjects
bearer/configuration
10 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
Bearer token obtained from response headers
After successful sign-in, the session token is available in the response headers under the key 'set-auth-token'. This token should be stored securely, typically in localStorage.
Auth client Bearer token configuration
Configure the auth client to include Bearer tokens by setting fetchOptions.auth with type 'Bearer' and a token function that returns the token from storage, e.g., localStorage.getItem('bearer_token').
Bearer token in Authorization header
Bearer tokens are sent in the Authorization header with the format 'Authorization: Bearer <token>'. This works for both auth client requests and direct fetch calls to APIs.
Per-request Bearer token override
Individual requests can override the default Bearer token by passing fetchOptions with custom headers containing the Authorization header set to 'Bearer <token>'.
Server-side Bearer token validation with auth.api.getSession
On the server, validate Bearer tokens by calling auth.api.getSession with the request headers containing the Authorization Bearer token header. This returns the session if the token is valid, or null/undefined if unauthorized.
Bearer token example: storing from sign-in response
Example of capturing and storing a Bearer token from sign-in: authClient.signIn.email({email, password}, {onSuccess: (ctx) => {const authToken = ctx.response.headers.get('set-auth-token'); localStorage.setItem('bearer_token', authToken);}})
Bearer token example: global auth client configuration
Example of global auth client setup: createAuthClient({fetchOptions: {onSuccess: (ctx) => {const authToken = ctx.response.headers.get('set-auth-token'); if(authToken) localStorage.setItem('bearer_token', authToken);}, auth: {type: 'Bearer', token: () => localStorage.getItem('bearer_token') || ''}}})
Bearer token example: direct API call
Example of making an API call with Bearer token outside auth client: const token = localStorage.getItem('bearer_token'); await fetch('https://api.example.com/data', {headers: {Authorization: `Bearer ${token}`}})
Bearer plugin security warning
Bearer token authentication should be used cautiously and only for APIs that do not support cookies or require Bearer tokens. Improper implementation can easily lead to security vulnerabilities.