Self-service account deletion
A signed-in user requests permanent account removal after entering their password.
Better Auth · Module
deleteUser
authClient.deleteUser permanently deletes the authenticated user's data. Enable user.deleteUser first, then authorize the request with a valid password or a recently authenticated session.
How it works
Enable the user-deletion feature in the server configuration, then invoke the client method for the signed-in user. The request succeeds with either a valid password or a recently authenticated session; an optional callback URL controls the post-deletion redirect, while a verification callback can provide an email-based confirmation flow.
Syntax
await authClient.deleteUser({ password?: string, callbackURL?: string })Parameters
| Name | Type | Description |
|---|---|---|
password | string | The current user's password, when using password-based authorization. |
callbackURL | string | A URL used for redirection after the account is deleted. |
Returns
Not specified on the page.
Key points
- The feature performs a permanent database deletion rather than merely disabling the account.
- The client-facing operation is
authClient.deleteUser. - For intentionality, applications can put deletion behind an email confirmation step.
- Deletion is protected by an authentication requirement rather than being an unauthenticated action.
- Password-based accounts may authorize deletion by submitting the account password.
Common mistakes
- Account deletion does nothing until the feature is enabled in the Better Auth configuration.
- When no password is supplied, the current session must be fresh.
- Treat the verification URL as destructive: opening it performs the deletion.
Example: Delete the current user's account
import { authClient } from "@/lib/auth-client";
await authClient.deleteUser({
password: "current-password",
callbackURL: "/goodbye",
});Deletes the signed-in user's account after validating the password, then redirects to the supplied callback URL.
When to use it
Email-confirmed deletion
An application needs the user to confirm a destructive action through email.
Post-deletion redirect
A product sends the user to a farewell route after removal.
Interview questions
QHow do you enable and trigger user deletion?
Enable user.deleteUser.enabled on the server and call authClient.deleteUser for the authenticated user. The operation permanently removes that user's data from the database.
Follow-up: How can deletion require explicit confirmation? Configure sendDeleteAccountVerification and send the generated URL through an email or another confirmation channel.
QWhat authorization conditions are required?
The caller can provide a valid password when the account has one. If the password is omitted, Better Auth checks that the session token is fresh, meaning the user signed in recently.
Follow-up: What should an application do if neither condition is available? Require the user to authenticate again or obtain a valid password before retrying deletion.
QHow can the client control the result of deletion?
Pass callbackURL to authClient.deleteUser to specify where the user should be redirected after deletion. This is separate from the verification flow, which can generate a deletion link.
Follow-up: How can the application add a confirmation step? Use sendDeleteAccountVerification to deliver the generated deletion URL only after the user confirms intent.
Related
sendDeleteAccountVerificationbeforeDeleteafterDeletefresh session tokenauthClient