Skip to main content
G.T. Fahad
Back to Blog
Shared Zod Contracts and better-auth in Production APIs

Shared Zod Contracts and better-auth in Production APIs

By ·
TypeScript
Security
Zod
Backend

One of the fastest ways to ship bugs in full-stack TypeScript is letting the API schema and UI forms diverge. At ClassTablet we addressed this with shared Zod schemas and better-auth for session handling.

Shared contracts

A Zod schema defines the shape of a create-assignment payload once. The NestJS route validates incoming bodies with the same schema the React form uses client-side. When the API changes, TypeScript fails in both places until you fix them together.

Authentication

better-auth provides session management without reinventing cookie security, CSRF considerations, or password flows. Integrating it behind Fastify required careful middleware ordering but paid off in fewer auth edge cases.

Practical tips

  • Validate at the boundary; never trust client-only checks
  • Keep error messages user-safe; log details server-side
  • Version breaking API changes in shared packages explicitly

Typed boundaries aren't ceremony. They're how small teams move fast without breaking production.