Agent Auth

The Agent Auth plugin adds the application-owned UI that the protocol itself does not render. The approval page shows the requesting agent, its host, its mode, the capabilities it wants, and the approval strength each one needs. Users allow a subset or deny outright. A security settings card then lists agents and revokes individual active grants.

Setup

import { agentAuth } from "@better-auth/agent-auth"
import { betterAuth } from "better-auth"

export const auth = betterAuth({
  // ...
  plugins: [
    agentAuth({ 
      deviceAuthorizationPage: "/auth/agent-approval",
      capabilities: [
        {
          name: "invoices:read",
          description: "Read invoices and payment status",
          approvalStrength: "session"
        },
        {
          name: "invoices:pay",
          description: "Pay an invoice with a saved method",
          approvalStrength: "webauthn"
        }
      ]
    })
  ]
})

npx shadcn@latest add https://better-auth-ui.com/r/solid/agent-auth.json

import { AuthProvider } from "@/components/auth/auth-provider"
import { agentAuthPlugin } from "@/lib/auth/agent-auth-plugin"
import { authClient } from "@/lib/auth-client"

export function Providers(props: { children?: JSX.Element }) {
  return (
    <AuthProvider
      authClient={authClient}
      navigate={navigate}
      plugins={[agentAuthPlugin({ adapter, grants: true })]} 
    >
      {props.children}
    </AuthProvider>
  )
}

The approval page

The page reads agent_id, and optionally approval_id and code, from the query string. Without agent_id it renders an invalid-request state rather than guessing. Signed-out users are sent to sign-in with a redirectTo back to the full approval URL, so the request survives the round trip.

Capabilities start fully selected. Clearing one removes it from the approval, and clearing all of them disables the allow button.

Runtime prerequisites

• Server: agentAuth() from @better-auth/agent-auth, with deviceAuthorizationPage pointing at your route.
• App: an AgentAuthAdapter instance.
• Runtime API: agent query and mutation options from Solid runtime APIs.

Copied files

• src/lib/auth/agent-auth-plugin.ts
• src/components/auth/agent-auth/agent-approval.tsx
• src/components/auth/agent-auth/agent-authorizations.tsx

After install both views are yours. Group capabilities differently, add your own risk copy, or render the constraints payload instead of the raw JSON.

Options

Localization