> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aveid.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Better Auth integration

> Use Better Auth's generic OAuth plugin with Ave's OIDC discovery, then validate refresh behavior in your app.

[Better Auth](https://www.better-auth.com/docs/plugins/generic-oauth) can connect to any OAuth2/OIDC provider via **`genericOAuth`** and a **`discoveryUrl`** pointed at Ave’s metadata:

`https://aveid.net/.well-known/openid-configuration`

Configure your registered Ave **`clientId`** (and **`clientSecret`** if you use a confidential client). Use the **same** scopes you would in a manual integration: at least **`openid`**, and **`offline_access`** if you need refresh tokens.

## Caveats

* Upstream behavior for **token refresh** can differ from first-class social providers. **Spike and test** long sessions, rotation, and cookie handling before committing.
* Better Auth is your app’s **OAuth client to Ave** — it does not replace Ave’s passkey UX, consent screen, or **[E2EE fragment delivery](/guides/end-to-end-encryption)**. Those remain Ave-side and browser flows.

## Primary path

For the most predictable sessions without an extra framework layer, prefer **[Ave Session](/guides/ave-session-and-tokens)** and **`verifyAveIdToken`** on your API.