email-and-password-best-practices

SKILL.md

Email verification, password reset flows, and customizable password policies for Better Auth.

Supports email verification with optional enforcement to block sign-in until verified, plus configurable token expiration and single-use reset tokens

Password reset flows with built-in security: background email sending, timing attack prevention, dummy operations on invalid requests, and optional session revocation on reset

Configurable password length limits (default 8–256 characters) and custom hashing algorithms via pluggable hash and verify functions

Requires absolute callback URLs and sendVerificationEmail / sendResetPassword functions to integrate with your email provider

Quick Start

Enable email/password: emailAndPassword: { enabled: true }

Configure emailVerification.sendVerificationEmail

Add sendResetPassword for password reset flows

Run npx @better-auth/cli@latest migrate

Verify: attempt sign-up and confirm verification email triggers

Email Verification Setup

Configure emailVerification.sendVerificationEmail to verify user email addresses.

import { betterAuth } from "better-auth";
import { sendEmail } from "./email"; // your email sending function