BugFixes galore

lib/auth/client.ts

@@ -10,7 +10,11 @@ import type { Auth } from "./index";
  * code. Mirrors the plugins registered on the server-side `auth` instance.
  */
 export const authClient = createAuthClient({
-  baseURL: process.env.NEXT_PUBLIC_BETTER_AUTH_URL ?? "http://localhost:3000",
+  // No baseURL — uses window.location.origin automatically, which always
+  // produces same-origin requests and avoids CSP connect-src issues.
+  ...(process.env.NEXT_PUBLIC_BETTER_AUTH_URL
+    ? { baseURL: process.env.NEXT_PUBLIC_BETTER_AUTH_URL }
+    : {}),
 
   plugins: [
     // Enables organization.* methods (createOrganization, getActiveMember, etc.)