Introduction
Auth UI is the sign-in, user profile, organization and admin UI for SvelteKit and Next.js apps that run on Convex and Better Auth. A CLI copies the components, routes and Convex functions into your repository, shadcn-style, so they’re your code from the first commit. There’s no hosted auth service: users, sessions and organizations live in your own Convex deployment.
What ships
Each feature is a flag in src/convex/auth.constants.ts. The default install turns on password sign-in only.
| Feature | What you get | Turn it on with |
|---|---|---|
| Sign-in | One email-first form for sign-in and sign-up, with password, email verification code (OTP), magic link and 27 social providers. | providers. OTP and magic link also need sendEmails: true. |
| User profile | A user button and a profile dialog: name and avatar, email change, linked accounts, set or change password, delete account. | Always on |
| Organizations | Organization switcher, create organization, organization profile with members, email invitations and the roles owner, admin and member. | organizations: true with sendEmails: true |
| API keys | Users create and delete their own API keys in the profile dialog. | apiKeys: true |
| Device authorization | Better Auth’s device flow, for signing in a CLI or another device without a browser, with a page where the user approves the code. | deviceAuthorization: true |
| Admin dashboard | /admin to search, create, ban, impersonate and delete users, set passwords and sign users out. With organizations on, it also manages every organization and its members. | admin: true and the ADMIN_USER_IDS Convex variable |
| Emails | Email verification at sign-up, “Forgot password?” reset, sign-in codes, magic links, email change confirmation and invitations, sent through Resend. | sendEmails: true |
Every route the install adds, apart from sign-in, password reset and the Better Auth API, requires a session. The getting started guides list them.
What you take on
The components are files in your repository, so you can change any of them. Updates arrive the way vendored code does: jsrepo update <item> shows the diff for each file, and you merge it with your own edits.
The runtime dependencies stay ordinary packages in your package.json: Convex, Better Auth, @convex-dev/better-auth, Skeleton and Ark UI. There’s no auth service billing you per user: what you pay for is your Convex usage and, if you send email, Resend.
Stack
Versions as of @auth/svelte 0.11 and @auth/nextjs 0.3:
| Layer | SvelteKit | Next.js |
|---|---|---|
| Framework | SvelteKit 3, Svelte 5.57 | Next.js 16.4 (App Router), React 19.3 |
| Backend | Convex 1.46, @convex-dev/better-auth 0.12.5 | same |
| Auth | Better Auth 1.6.16 | same |
| Styling | Skeleton 5, Tailwind CSS 4.3 with @tailwindcss/forms | same |
| Interactive components | Ark UI (@ark-ui/svelte 5.24) | Ark UI (@ark-ui/react 5.39) |
| Icons | @lucide/svelte 1.x | lucide-react 1.x |
Resend through @convex-dev/resend 0.2.9 | same |
Next step
Pick your framework:
Still deciding? Why Auth UI makes the case for owning your auth code, and Comparison sets Auth UI against Better Auth UI.