Agent Wranglers

Recommended Open source

Use Better Auth or django-allauth for sign-in inside the app

When one app runs its own sign-in, use Better Auth in TypeScript or django-allauth in Django, with users in your own database.

By Agent Wranglers. Updated .

Applies when

The project it has user accounts.

Cost

Open source. Both are MIT licensed and free to use in your own code.

How to do it

Better Auth reached 1.0.0 on 23 November 2024, so record it as an exception to the five-year test. Version 1.7.12 shipped on 20 October 2026, with about 7.8 million weekly npm downloads. Since 22 September 2025, the Better Auth team also maintains Auth.js, formerly NextAuth.js. They keep patching Auth.js security issues and recommend Better Auth for new projects. django-allauth first came out in February 2011, and 65.20.1 shipped on 20 October 2026, with about 1.5 million weekly downloads. Both cover passwords, social sign-in, second factors and passkeys. Weigh a library against a server as Decide whether a provider or a library runs sign-in says. Choose something else when two or more apps share sign-in, and run Keycloak instead.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

TypeScript example

import express from 'express';
import { betterAuth } from 'better-auth';
import { toNodeHandler } from 'better-auth/node';
import { Pool } from 'pg';

export const auth = betterAuth({
  database: new Pool({ connectionString: process.env.DATABASE_URL }),
  emailAndPassword: { enabled: true },
});

const app = express();
app.all('/api/auth/*splat', toNodeHandler(auth));
app.use(express.json());

Python example

# settings.py
INSTALLED_APPS += ["allauth", "allauth.account", "allauth.mfa"]
MIDDLEWARE += ["allauth.account.middleware.AccountMiddleware"]
AUTHENTICATION_BACKENDS = ["allauth.account.auth_backends.AuthenticationBackend"]
MFA_SUPPORTED_TYPES = ["totp", "webauthn", "recovery_codes"]
MFA_PASSKEY_LOGIN_ENABLED = True

How to check

Every sign-in, sign-up and sign-out route comes from the library. The app code imports no password hashing package of its own. A script exports every user, with the password hash, to JSON.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/stack/product-services/sign-in-library">Agent Wranglers software choices playbook</a>. In code you write, add a comment next to it with the same link.