Better Auth · Function

jwt

Better Auth's JWT plugin issues JWTs for external services and exposes JWKS verification keys. It complements, rather than replaces, the normal Better Auth session.

How it works

The JWT plugin adds a token endpoint for obtaining a JWT and a JWKS endpoint for verifying it. It is intended for external services that need JWT authentication, while Better Auth's normal session cookie remains separate.

Syntax

jwt()

Returns

The /token endpoint returns a JWT; /jwks returns the keys needed to verify it.

Key points

The plugin supplies both token issuance and public-key discovery for external JWT consumers.
Use the /token endpoint when an application needs to obtain a JWT.
A session request can provide a service JWT through the set-auth-jwt response header.
External services can fetch verification keys from /jwks by default.
Set jwksPath when the default JWKS route does not fit the application's API layout.

Common mistakes

Use the JWT plugin for services that require JWTs, not as a substitute for Better Auth's regular session mechanism.
Do not assume the JWT returned by this plugin is the same credential as the primary session cookie.

Example: Enable the JWT plugin

import { betterAuth } from "better-auth";
import { jwt } from "better-auth/plugins";

export const auth = betterAuth({
  plugins: [jwt()],
});

const result = await auth.api.getSession({
  headers: request.headers,
});

const token = result?.headers?.get("set-auth-jwt");

The plugin adds JWT and JWKS endpoints; a session request can also return a service-usable JWT in the response header.

When to use it

Authenticate external services

An external API needs a Better Auth-issued bearer token.

Publish verification keys

A resource server must validate Better Auth JWTs without sharing the application secret.

Use the session JWT header

An application wants to forward a service token from a session response.

Interview questions

QWhat does the JWT plugin provide?

The plugin exposes a /token endpoint that returns a JWT and a /jwks endpoint that lets external services verify tokens. It is designed for systems that cannot use the Better Auth session directly.

Follow-up: How can a service obtain a token without calling the token endpoint? A getSession request returns a JWT in the set-auth-jwt response header.

QHow do you enable the plugin?

Install the plugin from better-auth/plugins and add jwt() to the Better Auth configuration. After that, the token and JWKS endpoints become available.

Follow-up: Where is the verification key set exposed by default? The JWKS endpoint is available at /jwks, unless its path is customized.

QHow does a client retrieve a JWT?

Client code can call authClient.token() to retrieve a token; the token is available in the returned data. That JWT can then be sent to an external service for authenticated requests.

Follow-up: Can the JWKS path be changed? Yes, configure the plugin's jwksPath option.

authClient.token
getSession
jwksPath
/token
/jwks
set-auth-jwt

Source: JWT. Checked 2026-10-15.

jwt