Sign in and create a key
api=http://localhost:3001
origin=http://localhost:3000
jar=$(mktemp)
curl -sS -c "$jar" -X POST "$api/api/auth/sign-up/email" \
-H "Content-Type: application/json" \
-H "Origin: $origin" \
-d '{"name":"Local Owner","email":"owner@example.com","password":"replace-this-password"}'
curl -sS -b "$jar" -X POST "$api/api/auth/api-key/create" \
-H "Content-Type: application/json" \
-H "Origin: $origin" \
-d '{"name":"cli"}'const response = await fetch("http://localhost:3001/api/auth/api-key/create", {
method: "POST",
credentials: "include",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ name: "cli" }),
});{
"id": "key_example",
"name": "cli",
"start": "ftrv_example1",
"key": "ftrv_example_key_shown_once"
}{
"error": {
"code": "FORBIDDEN",
"message": "This request origin is not allowed."
}
}Auth
Create an API key
Requires a browser session. Do not send Authorization. A request that also sends it is 401 with message API key management requires a browser session. Cookie writes need Origin or Referer to be WEB_ORIGIN or PUBLIC_BASE_URL. A missing or different origin is 403 FORBIDDEN before Better Auth runs. The secret is returned once in key. The plugin stores only a hash. Keys use the ftrv_ prefix and do not expire. The plugin’s own per-key rate limit is off.
POST
/
api
/
auth
/
api-key
/
create
Sign in and create a key
api=http://localhost:3001
origin=http://localhost:3000
jar=$(mktemp)
curl -sS -c "$jar" -X POST "$api/api/auth/sign-up/email" \
-H "Content-Type: application/json" \
-H "Origin: $origin" \
-d '{"name":"Local Owner","email":"owner@example.com","password":"replace-this-password"}'
curl -sS -b "$jar" -X POST "$api/api/auth/api-key/create" \
-H "Content-Type: application/json" \
-H "Origin: $origin" \
-d '{"name":"cli"}'const response = await fetch("http://localhost:3001/api/auth/api-key/create", {
method: "POST",
credentials: "include",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ name: "cli" }),
});{
"id": "key_example",
"name": "cli",
"start": "ftrv_example1",
"key": "ftrv_example_key_shown_once"
}{
"error": {
"code": "FORBIDDEN",
"message": "This request origin is not allowed."
}
}Authorizations
Better Auth session cookie from email/password sign-in. On an https API origin the name is __Secure-better-auth.session_token. On http it is better-auth.session_token. Host-only unless AUTH_COOKIE_DOMAIN is set. Use a cookie jar instead of typing the name.
Body
application/json
A name is required, 1 to 32 characters.
Required string length:
1 - 32