When you set a field like role to input: false in better-auth, users can't set it directly from the client—this is for security. Here’s how you can still assign roles (or other protected fields) during signup for both email and social providers:

Email/password signup:
Let users pick their role in your signup UI. When you send the signup request, include the role in the request body. Even though input: false blocks direct assignment, you can extract the role in a user.create.before hook on the server and assign it to the user object before creation. Example:

// In your better-auth configdatabaseHooks:{user:{create:{before:async(user,ctx)=>({data:{          ...user,role:ctx.body.role||"client",// assign from request body},}),},},},

Reference

OTP/email signup:
The default OTP plugin only accepts email and otp fields. To pass a role, you need to extend or wrap the plugin to accept a role field in the POST body, then assign it in the user.create.before hook as above. This requires a small patch to the plugin or a custom endpoint.
Reference

Social/OAuth2 providers:
When starting the OAuth2 flow, include the intended role in the state parameter (e.g., state: JSON.stringify({ role: "consultant" })). On the server, extract the role from the state in your user.create.before hook and assign it to the user. This is the recommended way to securely pass contextual data through OAuth flows.

// When starting OAuth2 loginconststate=JSON.stringify({role:"consultant"});// Pass this state to the provider's authorization URL// In your user.create.before hookconst{ role}=ctx.state;// Extracted from OAuth2 state param// Assign to user as above

Reference

If you want the role to be available in the session object on the client, use the customSession plugin to merge user data into the session, since additional fields are not included by default in session responses:

customSession(async({ user, session})=>({  ...session,role:user.role,}))

Reference

Key points:

• Never trust user input for sensitive fields—always assign them server-side.
• Use the user.create.before hook to set protected fields based on context.
• For OAuth2, use the state parameter to pass contextual data.
• For OTP, you must extend the plugin to accept extra fields.
• Use customSession if you need these fields in the session on the client.

Let me know if you want a more detailed code example for your specific flow!

To reply, just mention@dosu.

^{How did I do?Good |Irrelevant |Incorrect |Verbose |Hallucination |Report 🐛 |Other}

@dosu Thats the issue how do i send the request body with input false?
"use client"
import {Button} from "@/components/ui/button";
import {authClient} from "@/utils/authClient";

export default function Home() {

async function emailSignUp(){    authClient.signUp.email({        email: "test@gmail.com",        password: "password123",        role: "client"    })}async function googleSignUp(){    console.log("Sign Up with Google clicked");}

return (

Thats what i have so far

You can include the role in your signup request body (like you're doing), but because you setinput: false for therole field, better-auth will ignore direct assignment from the client for security. Instead, you must assign the role server-side in auser.create.before hook by extracting it from the request context.

How it works:

• For email/password signup, send the role in your request body:

  authClient.signUp.email({email:"test@gmail.com",password:"password123",role:"client"// this is just context, not direct assignment})

• On the backend, use auser.create.before hook to assign the role:

  databaseHooks:{user:{create:{before:async(user,ctx)=>({data:{          ...user,role:ctx.body.role||"client",// securely assign here},}),},},},

  Reference

• For Google/social signup, pass the role using theadditionalData parameter:

  authClient.signIn.social({provider:"google",additionalData:{role:"consultant"}})

  Then, in your backend hook, extract it usinggetOAuthState:

  import{getOAuthState}from"better-auth/api";databaseHooks:{user:{create:{before:async(user,ctx)=>{conststate=awaitgetOAuthState<{role?:string}>();return{data:{            ...user,role:state?.role||"client",},};},},},},

  Reference

Key points:

• You can always send the role from the client, but it will only be used if your backend hook picks it up and assigns it.
• Never trust user input for sensitive fields—always assign them server-side.
• If you want the role to show up in the session/user object on the client, use theinferAdditionalFields plugin in yourauthClient config or thecustomSession plugin on the backend.

Let me know if you want a full working example for your stack!

To reply, just mention@dosu.

^{How did I do?Good |Irrelevant |Incorrect |Verbose |Hallucination |Report 🐛 |Other}

I tried it but i get the error saying
TS2353: Object literal may only specify known properties, and role does not exist in type
Prettify<InferSignUpEmailCtx<{
plugins: ({
id: "additional-fields-client";
$InferServerPlugin: {
id: "additional-fields";
schema: {
user: {
fields: {
role: {
type: "string";
input: false;
};
};
};
session: {
fields: {};
};
};
};
} | { ...; })[];
}, ClientFetchOption<...>>>

Finally I am going with this kind of approach

"use client"import {Button} from "@/components/ui/button";import {authClient} from "@/utils/authClient";export default function Home() {    const role = "doctor";    async function emailSignUp(){        await authClient.signUp.email({            name: "Test",            email: "test@gmail.com",            password: "password123"        },{            headers:{                "X-Role": role            }        })    }    async function googleSignUp(){        await authClient.signIn.social({            provider: "google",            additionalData:{                role: role            }        })    }  return (    <div>        <Button onClick={emailSignUp}>            Sign Up with Email        </Button>        <Button onClick={googleSignUp}>            Sign Up with Google        </Button>    </div>  );}