Authentication and CORS
I cannot sign in: email not verified
Section titled “I cannot sign in: email not verified”Sign-in needs a verified address. If email is not configured, the link is logged: run wrangler tail, request a new link, and open the URL from the log.
Better Auth URL is wrong
Section titled “Better Auth URL is wrong”pnpm run update -- --authExisting sessions can depend on the current authentication origin, so change it deliberately.
Browser reports a CORS error
Section titled “Browser reports a CORS error”Add your website’s origin to CORS_ORIGINS on the API (comma-separated, exact scheme and host):
CORS_ORIGINS=https://www.example.com,http://localhost:4321The Astro installer does not edit this for you. Setup adds the Admin Worker origin automatically.
Signed in, but the session does not stick
Section titled “Signed in, but the session does not stick”On a cross-site setup the session cookie is third-party, and some browsers block those. Use the same-origin proxy.
429 on sign-in or forms
Section titled “429 on sign-in or forms”Auth routes allow 10 POSTs per 60 seconds per IP, forms 5. Behind a proxy, configure TRUSTED_PROXY_SECRET so the limit is per visitor rather than per proxy.