Multi-instance

Lab sketches use deploymentMode: "single-instance" with process-local stores. That is fine for a single-node demo. Do not ship it for multi-worker or multi-region Better Auth.

This page covers how to graduate any compose guide to shared infrastructure.

What changes

Pattern

export const auth = betterAuth({
  secret: process.env.BETTER_AUTH_SECRET!,
  // secondaryStorage: shared DO / Redis / KV
  session: { cookieCache: { enabled: false } },
  plugins: [
    ...passkeyStack.plugins,
    loginFactors(),
    elevate({
      deploymentMode: "multi-instance",
      passkeyCounterGuard: passkeyStack.controller,
      // Wire shared stores or BA secondaryStorage + conformance capabilities.
      passwordOnlyIfNoStronger: true,
      elevatedTtlSec: 300,
    }),
    zeroAccess({
      deploymentMode: "multi-instance",
      // securityLevel: "strict",
      // recoveryIpAddressTrust: "trusted-edge",
      requireRecoveryExportAck: true,
      assertAccess: /* createZeroAccessAssertAccess(…) */,
    }),
  ],
});

Full production-shaped sketch: Quick start. Plugin option surface: Plugin contract · API.

Conformance

Method presence on a store is not enough. Run the package conformance harnesses and pass the returned capabilities into the plugins (secondaryStorageSecurity, elevate store capabilities, and so on). Fail closed if the harness rejects the binding.

Security graduation

Passkey stack posture and zeroAccess securityLevel: "strict" are separate from deployment mode. You can be multi-instance at standard while integrating; pin strict (and trusted recovery IP) when the edge story is real.

See gradual security on Passkey login and the hard rules on Checklist.

Next

• Compose paths: Use cases
• Elevate stores / claims: Elevate / sudo · API — Elevate
• Blind store: Vault composition · API — Zero-access