email-and-password-best-practices
Installation
Summary
Email verification, password reset flows, and customizable password policies for Better Auth.
- Supports email verification with optional enforcement to block sign-in until verified, plus configurable token expiration and single-use reset tokens
- Password reset flows with built-in security: background email sending, timing attack prevention, dummy operations on invalid requests, and optional session revocation on reset
- Configurable password length limits (default 8–256 characters) and custom hashing algorithms via pluggable
hashandverifyfunctions - Requires absolute callback URLs and
sendVerificationEmail/sendResetPasswordfunctions to integrate with your email provider
SKILL.md
Quick Start
- Enable email/password:
emailAndPassword: { enabled: true } - Configure
emailVerification.sendVerificationEmail - Add
sendResetPasswordfor password reset flows - Run
npx @better-auth/cli@latest migrate - Verify: attempt sign-up and confirm verification email triggers
Email Verification Setup
Configure emailVerification.sendVerificationEmail to verify user email addresses.
import { betterAuth } from "better-auth";
import { sendEmail } from "./email"; // your email sending function