Better Auth · Pipe

baseURL

baseURL sets Better Auth’s server origin. Configure it as a URL string for one domain or as an object for validated, per-request resolution across multiple hosts.

How it works

Set baseURL to the canonical root URL where the Better Auth server is hosted. It accepts a static URL for one domain or an object for request-specific resolution across approved hosts; an embedded path overrides the default authentication route path.

Syntax

betterAuth({ baseURL: string | { allowedHosts: string[]; protocol?: string; fallback?: string } })

Parameters

Name	Type	Description
`baseURL`	`string \| object`	Canonical server URL, or dynamic configuration containing allowed hosts and optional protocol/fallback settings.

Returns

A Better Auth configuration option used to determine the server base URL; it does not return a standalone value.

Key points

baseURL identifies the root URL where the Better Auth server is hosted.
Use a URL string when the application has one canonical host.
Use object configuration when several approved domains or preview environments serve the application.
The BETTER_AUTH_URL environment variable is the fallback before request-based inference.
With neither configuration source set, the URL can be derived from the request.
Including a route prefix in the URL overrides the default Better Auth path.

Common mistakes

Do not depend on the incoming request to infer the URL; configure baseURL explicitly or provide BETTER_AUTH_URL.
A path embedded in the URL overrides the configured/default base path, so include it deliberately.
Behind a proxy, forwarded host and protocol headers do not affect resolution unless trusted proxy headers are enabled.

Example: Configure a static base URL

import { betterAuth } from "better-auth";

export const auth = betterAuth({
  baseURL: "https://example.com",
});

Sets the server’s canonical origin for Better Auth URL construction.

When to use it

Static single-domain configuration

One production hostname

Validated dynamic host resolution

Preview or branch deployments

Multiple production hosts

Applications served through custom domains

Canonical callback URL construction

OAuth integrations requiring a stable callback origin

Interview questions

QWhat is the purpose of baseURL?

baseURL is the root URL used by Better Auth to construct its URLs. Use a string for a single-domain deployment, or an object with allowedHosts when requests can arrive through multiple domains.

Follow-up: How should a deployment avoid unsafe host-derived URLs? Configure an allowlist with allowedHosts; unknown hosts are rejected unless a fallback is supplied.

QWhat is the resolution order when baseURL is not configured?

If baseURL is absent, Better Auth checks BETTER_AUTH_URL and then may infer the value from the request. Explicit configuration is preferred because request inference is not recommended.

Follow-up: What happens when neither an explicit option nor the environment variable is present? Better Auth falls back to incoming-request inference.

QWhen should the object form be used?

The object form supports per-request resolution. Better Auth validates the request host against allowedHosts, then builds the request-specific base URL; protocol can force the scheme and fallback supplies a URL for unmatched hosts.

Follow-up: Which proxy headers participate by default? Forwarded host and protocol headers are ignored unless advanced.trustedProxyHeaders is enabled.

BETTER_AUTH_URL
basePath
allowedHosts
protocol
fallback
advanced.trustedProxyHeaders

Source: Options | Better Auth. Checked 2026-10-15.