SSO

The SSO plugin replaces the standard sign-in form with an email-first flow. The user types an email, BAUI asks Better Auth whether an organization claims that domain, and redirects to the identity provider when one does. When none does, the same view reveals password, magic link, email OTP, and every other registered sign-in method.

Setup

import { betterAuth } from "better-auth"
import { sso } from "@better-auth/sso"

export const auth = betterAuth({
  // ...
  plugins: [sso()] 
})

import { ssoClient } from "@better-auth/sso/client"
import { createAuthClient } from "better-auth/solid"

export const authClient = createAuthClient({
  plugins: [ssoClient()] 
})

npx shadcn@latest add https://better-auth-ui.com/r/solid/sso.json

import { AuthProvider } from "@/components/auth/auth-provider"
import { ssoPlugin } from "@/lib/auth/sso-plugin"
import { authClient } from "@/lib/auth-client"

export function Providers(props: { children?: JSX.Element }) {
  return (
    <AuthProvider
      authClient={authClient}
      navigate={navigate}
      plugins={[ssoPlugin()]} 
    >
      {props.children}
    </AuthProvider>
  )
}

How discovery resolves

• A provider match redirects the browser straight to the identity provider.
• A 404 means no organization claims the domain. The email is remembered, the view moves to the fallback step, and the user continues with whatever methods you registered.
• Any other failure shows an error and leaves the user on the email step so they can retry.

Runtime prerequisites

• Server: sso() from @better-auth/sso, with at least one registered provider.
• Client: ssoClient() from @better-auth/sso/client.
• Runtime API: signInSsoOptions from Solid runtime APIs.

Copied files

• src/lib/auth/sso-plugin.ts
• src/lib/auth/use-sign-in-continuation.ts
• src/lib/auth/two-factor-methods.ts
• src/components/auth/sso/email-first-sign-in.tsx
• src/components/auth/provider-button.tsx
• src/components/auth/provider-buttons.tsx

After install the flow is yours. Reorder the fallback methods, change the copy on the discovery step, or skip the fallback entirely for a tenant that must use SSO.

Options

Localization