Security
1,307 installs
email-and-password-best-practices
by better-auth/skills
Configure email verification, implement password reset flows, set password policies, and customise hashing algorithms for Better Auth email/password…
Skill content
Email verification, password reset flows, and customizable password policies for Better Auth.
- Supports email verification with optional enforcement to block sign-in until verified, plus configurable token expiration and single-use reset tokens
- Password reset flows with built-in security: background email sending, timing attack prevention, dummy operations on invalid requests, and optional session revocation on reset
- Configurable password length limits (default 8–256 characters) and custom hashing algorithms via pluggable hash and verify functions
- Requires absolute callback URLs and sendVerificationEmail / sendResetPassword functions to integrate with your email provider
Quick Start
- Enable email/password: emailAndPassword: { enabled: true }
- Configure emailVerification.sendVerificationEmail
- Add sendResetPassword for password reset flows
- Run npx @better-auth/cli@latest migrate
- Verify: attempt sign-up and confirm verification email triggers
Email Verification Setup
Configure emailVerification.sendVerificationEmail to verify user email addresses.
import { betterAuth } from "better-auth";
import { sendEmail } from "./email"; // your email sending function