Get a signed-in user.

1. Install the stock client: bun add better-auth (or npm i better-auth). No Signet package.
2. Point baseURL at your instance’s /api/auth. The requests are identical, hosted or on-prem.
3. Call the methods you already know: signUp.email, signIn.email, useSession, getSession, signOut.

Install the stock client: bun add better-auth. Nothing Signet-specific to add; the client package is the integration path.

Pinned client: better-auth 1.6.23. The certification receipt covers this version exactly; newer clients are not known to break and are not covered.

import { createAuthClient } from "better-auth/react";

// One client for the whole app: the stock better-auth
// React client, pointed at your Signet instance.
export const authClient = createAuthClient({
  baseURL: "https://auth.example.com/api/auth",
});

// In a "use client" component: sign in, then read the
// session with the hook. Same calls you already write.
await authClient.signIn.email({ email, password });
const { data, isPending } = authClient.useSession();

Browser clients should call /api/auth on their own origin, as the Next.js starter demonstrates with a same-origin gateway; when the app and Signet use different origins, add the app's origin to the instance's [server].trusted_origins.

To read the session in a Server Component or Route Handler, forward the request cookies with the vanilla better-auth/client, as shown in the React Router v7 card.

Install the stock client: bun add better-auth. Nothing Signet-specific to add; the client package is the integration path.

Pinned client: better-auth 1.6.23. The certification receipt covers this version exactly; newer clients are not known to break and are not covered.

// app/lib/auth-client.ts: the React client for components.
import { createAuthClient as createReactAuthClient } from "better-auth/react";
export const authClient = createReactAuthClient({ baseURL: "https://auth.example.com/api/auth" });
await authClient.signIn.email({ email, password });

// app/routes/dashboard.tsx: read the session in a loader by
// forwarding the request cookies to your Signet instance.
import { createAuthClient as createServerAuthClient } from "better-auth/client";
const serverAuth = createServerAuthClient({ baseURL: "https://auth.example.com/api/auth" });
export async function loader({ request }) {
  const session = await serverAuth.getSession({
    fetchOptions: { headers: request.headers },
  });
  if (!session.data) throw redirect("/login");
  return { user: session.data.user };
}

Gate any route by redirecting when session.data is null; the loader runs on the server, so the check never reaches the browser.

Install the stock client: npm i better-auth. Nothing Signet-specific to add; the client package is the integration path.

Pinned client: better-auth 1.6.23. The certification receipt covers this version exactly; newer clients are not known to break and are not covered.

import express from "express";
import { createAuthClient } from "better-auth/client";

const authClient = createAuthClient({
  baseURL: "https://auth.example.com/api/auth",
});

// Verify the caller's session against Signet on each request.
async function requireUser(req, res, next) {
  const session = await authClient.getSession({
    fetchOptions: { headers: { cookie: req.headers.cookie ?? "" } },
  });
  if (!session.data) return res.status(401).json({ error: "not signed in" });
  req.user = session.data.user;
  next();
}

Attach requireUser to any route that needs a signed-in caller; a missing or expired session returns 401 without your backend ever storing a password.

Install the stock client: bun add better-auth. Nothing Signet-specific to add; the client package is the integration path.

Pinned client: better-auth 1.6.23. The certification receipt covers this version exactly; newer clients are not known to break and are not covered.

import { createAuthClient } from "better-auth/vue";

export const authClient = createAuthClient({
  baseURL: "https://auth.example.com/api/auth",
});

// In a Vue setup block: useSession() returns a Vue ref.
const session = authClient.useSession();
await authClient.signIn.email({ email, password });
// In the template: session.data?.user

Use session.value in script and Vue’s automatic ref unwrapping in templates. The HTTP calls remain the same certified wire.

Install the stock client: bun add better-auth. Nothing Signet-specific to add; the client package is the integration path.

Pinned client: better-auth 1.6.23. The certification receipt covers this version exactly; newer clients are not known to break and are not covered.

import { createAuthClient } from "better-auth/svelte";

export const authClient = createAuthClient({
  baseURL: "https://auth.example.com/api/auth",
});

// In a component module: Svelte auto-subscribes with $session.
const session = authClient.useSession();
await authClient.signIn.email({ email, password });
// In markup: {$session.data?.user.email}

For SvelteKit, keep the browser client shown here and put the same-origin /api/auth gateway at the framework boundary; Signet remains the auth server.

Install the stock client: bun add better-auth. Nothing Signet-specific to add; the client package is the integration path.

Pinned client: better-auth 1.6.23. The certification receipt covers this version exactly; newer clients are not known to break and are not covered.

import { createAuthClient } from "better-auth/react";

export const authClient = createAuthClient({
  baseURL: "https://auth.example.com/api/auth",
});

// Create an account (swap for signIn.email to log in).
await authClient.signUp.email({ email, password, name });

// Read the session with the hook; sign out when done.
const { data, isPending } = authClient.useSession();
await authClient.signOut();

Browser clients should call /api/auth on their own origin, as the Next.js starter demonstrates with a same-origin gateway; when the app and Signet use different origins, add the app's origin to the instance's [server].trusted_origins.

The Express starter demonstrates session verification on the server with the incoming request cookies.

Install the stock client: bun add better-auth. Nothing Signet-specific to add; the client package is the integration path.

Pinned client: better-auth 1.6.23. The certification receipt covers this version exactly; newer clients are not known to break and are not covered.

import { createAuthClient } from "better-auth/client";

const authClient = createAuthClient({
  baseURL: "https://auth.example.com/api/auth",
});

// Every call returns { data, error }. It does not throw.
const { data, error } = await authClient.signIn.email({ email, password });

// Read the current session; sign out to end it.
const session = await authClient.getSession();
await authClient.signOut();

This is the whole integration surface. Any framework is this client plus that framework’s own way of holding state. There is nothing Signet-specific to learn.

• The Next.js starter ships with your Signet delivery at examples/starters/next-app (hosted onboarding or the enterprise source delivery); there is no public download. It includes an App Router sign-up/sign-in page plus a same-origin /api/auth/* gateway that preserves each Set-Cookie header.
• The Express starter ships in the same delivery at examples/starters/express-api. Its /api/me guard forwards the caller’s cookie through the stock better-auth/client.

Run npm ci && npm test in either directory. Set only the public SIGNET_URL; neither starter contains a server secret, database credential, or Signet-specific SDK.