Connect your app

bao exposes a standard Better Auth HTTP API. You connect to it using the Better Auth client — the same client used with any Better Auth server.

This page covers session-based auth: the client signs in, the auth-service sets a session cookie, and your server validates the session by calling the auth-service on each request.

If you need to verify identity in a backend service without a round-trip to the auth-service, see Service-to-service auth (JWKS). If your app runs on Cloudflare Workers, see Service Binding for zero-latency server-side checks.

Install

npm install better-auth

Create the auth client

Point the client at your deployed worker URL. The base URL is the worker URL printed at the end of your first deploy — it looks like https://{appName}-{env}.{account}.workers.dev.

// lib/auth-client.ts
import { createAuthClient } from "better-auth/client";

export const authClient = createAuthClient({
  baseURL: "https://my-app-production.workers.dev",
});

If you set a custom domain for your worker, use that instead.

Sign up and sign in

These examples use the password plugin. Enable it in bao.config.json first.

// Sign up
const { data, error } = await authClient.signUp.email({
  email: "user@example.com",
  password: "supersecret",
  name: "Ada Lovelace",
});

// Sign in
const { data, error } = await authClient.signIn.email({
  email: "user@example.com",
  password: "supersecret",
});

// Sign out
await authClient.signOut();

Get the current session

const { data: session } = await authClient.getSession();

if (session) {
  console.log(session.user.email);
}

Plugin clients

If you have organization or Polar plugins enabled, import the matching client plugin for typed access:

import { createAuthClient } from "better-auth/client";
import { organizationClient } from "better-auth/client/plugins";
import { polarClient } from "@polar-sh/better-auth";

export const authClient = createAuthClient({
  baseURL: "https://my-app-production.workers.dev",
  plugins: [organizationClient(), polarClient()],
});

// Create an org
await authClient.organization.create({ name: "Acme", slug: "acme" });

// Redirect to checkout
await authClient.checkout({ slug: "pro" });

Framework guides

For framework-specific setup — environment variables, protected routes, middleware — see the guides below:

All available endpoints

The full list of endpoints depends on which plugins you have enabled. The Better Auth documentation covers every endpoint in detail — bao exposes them all at your configured basePath (default /api/auth).

Better Auth API reference →