Coming from Better Auth

Better Auth, for PHP.

The same embed-it-in-your-app model, every feature open source, running in Laravel, Symfony, Yii or any PSR-15 host, and built for agents from the start. Every Better Auth plugin resolves to a Polaris package and a status, as of Polaris for PHP 0.11.0.

The migration map

Better Auth Polaris Status
Core (email and password, sessions, social) polaris/core, polaris/social shipped
Two-Factor polaris/core shipped
Passkey polaris/passkey shipped in 0.8.0
Magic Link, Email OTP, Phone Number, One-Time Token polaris/passwordless shipped in 0.7.0
Username polaris/username shipped in 0.7.0
Anonymous polaris/anonymous shipped in 0.7.0
Multi Session, Last Login Method polaris/multi-session shipped in 0.7.0
One Tap, Generic OAuth, OAuth Proxy polaris/social shipped in 0.8.0
Admin polaris/admin shipped in 0.2.0
Organization polaris/core shipped; teams not planned
SSO, SCIM polaris/sso, polaris/scim shipped in 0.5.0 and 0.6.0
API Key polaris/api-keys shipped in 0.9.0
JWT, Bearer polaris/core shipped
OAuth 2.1 Provider, OIDC, Device Authorization polaris/oauth-provider shipped in 0.9.0
MCP polaris/mcp shipped in 0.10.0
Agent Auth (unstable) polaris/agents shipped in 0.10.0; superset, protocol-compatible
Captcha, Have I Been Pwned polaris/sentinel shipped in 0.4.0
i18n polaris/messaging templates shipped in 0.3.0; translated problem titles planned
Open API polaris/cli shipped
Test Utils polaris/testing shipped
Sign In With Ethereum — not planned
Stripe, Polar, Autumn, Creem, Dodo, Commet — separate program
Dub — not planned
Infrastructure (paid in Better Auth): dashboard API, audit, log drains, abuse protection, email and SMS polaris/admin, polaris/audit, polaris/sentinel, polaris/messaging shipped, open source

Where Polaris goes further

  1. 01

    Every response is contract-frozen

    184 core fixtures and 55 more from the plugins, replayed through PSR-15, Laravel, Symfony and Yii in CI. Better Auth has unit tests; it has no replayed cross-host contract.

    /docs/adapters/#37-the-proof-the-functional-suite-through-the-frameworks-kernel
  2. 02

    One auth stack, four frameworks

    PSR-15, Laravel, Symfony and Yii run the same bytes. Better Auth runs on a TypeScript runtime only.

    /php
  3. 03

    The infrastructure tier is free

    Dashboard API, audit log with a hash chain, log drains, risk engine, SSO self-service, SCIM: open source and self-hosted.

    /php#plugins
  4. 04

    Agents are principals, not an afterthought

    Delegation with act claims, capability grants with budgets and constraints enforced centrally, approvals by device code, CIBA or in-app, signed receipts, a kill switch. Better Auth's Agent Auth is marked unstable, leaves rendering approvals to the app, and skips its own checks on per-capability routes.

    /docs/plugins/agents/
  5. 05

    Polaris is itself an MCP server

    Every endpoint and every read-only CLI command is a tool an agent can call under the principal's own permissions, over POST /mcp or bin/polaris mcp.

    /docs/plugins/mcp/
  6. 06

    Errors are a standard

    RFC 9457 problem details everywhere in the packages, one type URL per failure.

    /docs/php/api/
  7. 07

    No container, no magic

    Polaris::create(new Config(...)) builds the whole graph explicitly; the TypeScript client and the MCP tools are generated from the same manifest, so types never drift from the server.

    /docs/php/

From the program spec in docs/better/spec.md at v0.11.0. Billing (Better Auth's payment plugins) is a separate program.