@openpolicy/better-auth

A Better Auth plugin that automatically registers user consent with OpenPolicy Plus on sign-up.

Install

npm install @openpolicy/better-auth @openpolicy/plus better-auth

Usage

import { betterAuth } from "better-auth";
import { openpolicy } from "@openpolicy/better-auth";
import { config } from "./openpolicy.config";

export const auth = betterAuth({
  emailAndPassword: { enabled: true },
  plugins: [
    openpolicy({
      apiKey: process.env.OPENPOLICY_API_KEY!,
      config,
    }),
  ],
});

After a successful sign-up, the plugin posts a consent record to OpenPolicy containing the user's id, email, name, and the client IP.

Options

| Option | Type | Description | | --------- | ------------------------- | --------------------------------------------------------------------- | | apiKey | string | OpenPolicy Plus API key. | | config | Record<string, unknown> | Your OpenPolicy config. Hashed server-side to version consent. | | baseUrl | string | Override the API base URL (defaults to https://plus.openpolicy.sh). |

IP forwarding

The plugin runs on your server, so if it called OpenPolicy directly without any extra work the consent row would be stamped with your server's IP rather than the end user's. To avoid that, the plugin reads x-forwarded-for (first entry) and falls back to x-real-ip from the incoming request headers, then forwards that to the consent API. Make sure your reverse proxy is setting these headers.