Better Auth + minidauth keep your login, add keys nobody holds

What stays and what moves

Stays with Better Auth

Accounts, sessions, passwords and the sign-in screen. Nothing about how your users log in changes.

Moves to the network

The key that encrypts and signs, which exists only as shares that 14 of 20 independent nodes have to cooperate to use, and the decision about who holds a role, which takes several of your admins approving it.

Adding it to a Better Auth app

1. Store the link in tideVuid on the user table, input: false

   One extra field in auth.js, marked so the user can't set it. Everything else about authentication is untouched.

2. Add one callback route

   The user links their Tide identity in a page served by the Tide network, which neither your app nor minidauth can see into. The shared link.js drop-in adds the routes; you tell it who is signed in and where to store the vuid.

3. Read roles from minidauth, not from Better Auth

   The example's protected route reads roles from minidauth on every request, not from its own database, so editing app.db lets nobody in. Keep the Tide token in the session rather than the database.

A callback that can't be forged into a link

minidauth verifies the enclave's blind signature before it answers, so the vuid is proven rather than claimed. What the app still has to check is that a reply belongs to a sign-in it started, for the account that started it; the example does this with a short-lived map and refuses anything else.

Users without a Tide account

The Better Auth example also mounts a /tideless page. There, the signed-in Better Auth user encrypts and decrypts with no Tide account at all: their Better Auth user id is the subject, a role the quorum granted that id is the gate, and the browser never holds a credential. It needs a public, voucher-gated decrypt policy, which the setup guide covers.

Run the example

Runs locally and has been exercised against the live Tide network.

# minidauth running, with a vendor key and its policies deployed,
# this app's callback registered, and a relying-party operator in operators.json

npm install
npx @better-auth/cli migrate --yes
npm start                                   # http://localhost:3000

minidauth itself has to be running first, with a vendor key created and its policies deployed. The quick start is two Docker commands.

Stuck on the Better Auth side? Join the Discord and I'll help you get it running.

Also works with: Clerk · Auth0 · Supabase · Amazon Cognito