Better Auth Setup

Configure Better Auth in Convex and connect it to Nuxt through the same-origin auth proxy.

The maintained topology is:

Browser or Nuxt SSR
  → same-origin /api/auth/*
  → Better Convex Nuxt Nitro proxy
  → Convex HTTP Actions site
  → Better Auth Convex component

This keeps the session cookie on the Nuxt application origin while Better Auth data remains in Convex.

Required files

File	Responsibility
`convex/convex.config.ts`	Register the Better Auth component
`convex/auth.config.ts`	Configure Convex JWT verification
`convex/auth.ts`	Create the component client and Better Auth factory
`convex/http.ts`	Register Better Auth HTTP routes lazily
`nuxt.config.ts`	Register the Nuxt module and public Convex URLs

The complete minimal versions are in Add authentication. Keep them as the baseline and add product-specific Better Auth options in createAuth.

Environment ownership

Set these in the Convex environment:

Variable	Purpose
`SITE_URL`	Exact Nuxt origin used by Better Auth and trusted origins
`BETTER_AUTH_SECRET`	Random Better Auth signing secret, at least 32 characters

Set these for the Nuxt build/runtime:

Variable	Purpose
`NUXT_PUBLIC_CONVEX_URL`	Convex deployment URL ending in `.convex.cloud`
`NUXT_PUBLIC_CONVEX_SITE_URL`	Convex HTTP Actions URL; required for local/custom domains

SITE_URL must be an exact origin. Use HTTPS outside loopback development. Do not include a path, query, or fragment.

Proxy behavior

The module owns the fixed /api/auth/* path and same-origin credentials behavior. It sends one request to the configured Convex site origin and does not follow server-side redirects.

OAuth and login redirects are returned to the browser. Auth-enabled applications require a Nitro-capable deployment; a purely static host cannot provide the proxy.

The default request and upstream response body limit is 1 MiB. Change limits only for a measured need:

convex: {
  auth: {
    proxy: {
      maxRequestBodyBytes: 1_048_576,
      maxResponseBodyBytes: 1_048_576,
    }
  }
}

Production checklist

Use an exact HTTPS SITE_URL.
Generate a unique production secret.
Configure OAuth callback and trusted origins for the public application origin.
Set the correct Convex HTTP Actions URL.
Keep Nuxt auth routes uncached.
Test sign-up, sign-in, reload, refresh, and sign-out in the deployed topology.
Verify protected Convex functions reject anonymous calls directly.

Report an issue