better-auth-mikro-orm

MikroORM adapter for Better Auth

Installation

Using npm:

npm i better-auth-mikro-orm

Using yarn:

yarn add better-auth-mikro-orm

Using pnpm:

pnpm add better-auth-mikro-orm

Usage

1. First you'll need to set up MikroORM and define the core schema for Better Auth. If you use any plugin, don't forget to check if they have any additional database schema definitions, then define entities you'll need for each plugin.
2. When you're finished with the schema definitions, you can simply pass the result of the mikroOrmAdapter call to the database option like this:

import { mikroOrmAdapter } from "better-auth-mikro-orm";
import { betterAuth } from "better-auth";

import { orm } from "./orm.js"; // Your Mikro ORM instance

export const auth = betterAuth({
  database: mikroOrmAdapter(orm),

  // Don't forget to disable the ID generator if it is already managed by MikroORM
  advanced: {
    database: {
      generateId: false,
    },
  },
});

API

mikroOrmAdapter(orm: MikroORM): AdapterInstance

Creates the MikroORM adapter instance. Note that this adapter does not manage database schemas for you, so you can't use it with @better-auth/cli. This means you'll have to manage database schemas on your own. Please refer to the Better Auth and MikroORM documentations for details.

Returns the AdapterInstance function for the Better Auth database option.

This function expects a single argument:

• orm - An instance of MikroORM returned from either MikroORM.init or MikroORM.initSync.

Application operation context

Applications with encrypted database fields can supply operationContext to mikroOrmAdapter. It runs around every adapter operation (including output normalization) and the entire transaction, including its final flush. This also covers direct auth.api calls without an HTTP middleware wrapper.

mikroOrmAdapter(orm, {
  operationContext: operation => trustedEncryptionScope.run(appKey, operation)
})

The adapter does not choose an encryption key or tenant, import an encryption library, reinterpret existing ciphertext, or supply a fallback context. The application must choose its trusted scope. An identity shared across organizations usually needs an explicit application-owned identity policy rather than the currently selected business organization. Changing an existing policy requires a separately reviewed ciphertext migration. Omitting this option preserves existing adapter behavior. Do not use request body fields to choose an encryption scope.