VividKit Crystal clear AI coding
VI
Choose Your Setup Get Started with AgentKit Continue with ClaudeKit Migrate from ClaudeKit to AgentKit Clean cutover from ClaudeKit What Is AgentKit? How AgentKit Works AgentKit Kits, Skills, Agents & Hooks AgentKit Runtime Support AgentKit Desktop App AgentKit Configuration AgentKit CLI Quick Reference AgentKit Skills Cheatsheet AgentKit Workflows AgentKit Statusline Update AgentKit CLI & Kits AgentKit Helper Clean reinstall of AgentKit AgentKit Troubleshooting What is ClaudeKit? ClaudeKit CLI Guide Command Finder Commands Cheat Sheet Workflow Recipes CLI Quick Reference Claude Mechanics Permission Modes ClaudeKit Hooks Coexistence ClaudeKit x Codex CK → Other coding tools How ClaudeKit Works Inside ClaudeKit Finding Your Unknowns Session Recovery Fix from Logs UI/UX Guide Accounts Switcher IDE Config Remote Control Codex App System Diagramming UI Review Gate Promotions Support VividKit

Quick Ref / Command

Engineer Kit

/ak:better-auth

Better Auth integration

Adds TypeScript authentication with Better Auth: email/password, OAuth, sessions, protected routes, 2FA, passkeys, magic links, organizations, rate limiting, framework handlers, migrations, and security-sensitive plugin checks.

01

Choose auth method

02

Install and env

03

Create server auth

04

Generate schema

Rule 01

Better Auth is framework-agnostic but every framework still needs the correct server handler and client wiring.

Rule 02

Start with the simplest auth method that meets security and user-experience needs, then add plugins deliberately.

Rule 03

Schema generation follows feature selection; plugin changes often require regenerated tables or fields.

Rule 04

Security defaults matter: single-use magic links, verified invitations, confidential clients, PKCE, and bound device codes prevent real attacks.

Execution Map

Core lanes from input to output, aligned with the command's real execution path.

01

Start

Input, scope, route

  1. 1 Choose auth method Pick email/password, OAuth, passkeys, magic link, organizations, rate limiting, or a combination based on user friction, security, browser support, and enterprise needs.
  2. 2 Install and env Install better-auth, set BETTER_AUTH_SECRET and BETTER_AUTH_URL, then add provider secrets such as GitHub or Google only where needed.
02

Work

Agent / skill execution

  1. 3 Create server auth Define the betterAuth server instance with database config, email/password, social providers, and selected plugins.
  2. 4 Generate schema Run Better Auth CLI generate and migrate where supported, and regenerate schema whenever plugins add tables or fields.
03

Verify

Gate, review, validation

  1. 5 Mount handlers Wire the framework API handler, such as Next.js App Router toNextJsHandler, or the matching reference for Nuxt, SvelteKit, Remix, Astro, Hono, or Express.
  2. 6 Add client and UI Create the auth client, implement sign-up, sign-in, social login, session reads, protected routes, and middleware.
04

Close

Report, handoff, artifact

  1. 7 Harden production Configure email sending, verification/reset flows, rate limiting, error handling, safer plugin defaults, and complete end-to-end auth flow tests.

Syntax, arguments, subcommands

How to invoke the skill: syntax, positional arguments, shared options, then each subcommand with its own syntax and outcome.

Syntax

/ak:better-auth [auth-method or feature]

Arguments

[auth-method or feature] Required

Auth method or feature

Name the Better Auth method or feature to add or refine, such as email/password, OAuth, sessions, MFA, passkeys, magic links, organizations, or RBAC. Include the existing stack, security policy, allowed schema or migration changes, and required verification evidence.

/ak:better-auth "Add GitHub OAuth to the existing Next.js app, preserve email/password login, generate but do not apply migrations, and verify callback and account-linking behavior."

Sample Prompt

Concrete invocations for each flag, subcommand, mode, or route available in the live workflow.

Email/password setup Recommended 
/ak:better-auth "Add email/password auth to this TypeScript app with Better Auth, including env names, schema generation, session reads, protected routes, and focused flow tests."
Use when:
Use when a TypeScript or JavaScript app has selected Better Auth and needs traditional account sign-up, sign-in, and session handling.
Expected:
Maps the existing framework and database, installs and configures Better Auth, adds server and client wiring, generates schema artifacts, protects routes, and reports focused auth-flow evidence.
Social OAuth 
/ak:better-auth "Add GitHub and Google OAuth while preserving email/password login, using minimal scopes, safe callback handling, account-linking checks, and no production credentials."
Use when:
Use when social login is required and provider callbacks, scopes, redirects, secrets, and account linking need an explicit boundary.
Expected:
Adds provider configuration and client sign-in calls, constrains redirects and scopes, keeps secrets server-side, verifies callback/session behavior, and reports any provider-console steps left undone.
Plugin-heavy auth 
/ak:better-auth "Add organizations with passkeys and 2FA; review schema impact, regenerate artifacts, keep safer plugin defaults, and verify invitation and recovery flows."
Use when:
Use for team or enterprise auth where organizations, MFA, passkeys, schema changes, and current security notes all matter.
Expected:
Selects compatible built-in methods and plugins, reviews schema and migration impact before applying changes, preserves safer defaults, and verifies invitation, session, and recovery edge cases.

Handled Scope

  • Email/password auth
  • OAuth providers
  • Sessions and protected routes
  • 2FA and passkeys
  • Organizations and RBAC
  • Auth schema migrations

Next