Agent skill · software engineering · better-auth
email-and-password-best-practices
Configure email verification, implement password reset flows, set password policies, and customise hashing algorithms for Better Auth email/password authentication. Use when users need to set up login, sign-in, sign-up, credential authentication, or password security with Better Auth.
Why this skill is useful
Adds specific implementation patterns and configurations for Better Auth's email/password authentication that the AI wouldn't reliably generate on its own.
What it needs
Requires @better-auth/cli installed locally. About 3k tokens when loaded. Last updated 2026-07-11. 206 stars on the source repository.
What this skill does
Quick Start 1. Enable email/password: emailAndPassword: { enabled: true } 2. Configure emailVerification.sendVerificationEmail 3. Add sendResetPassword for password reset flows 4. Run npx auth@latest migrate 5. Verify: attempt sign-up and confirm verification email triggers --- Email Verification Setup Configure emailVerification.sendVerificationEmail to verify user email addresses. Note: The url parameter contains the full verification link. The token is available if you need to build a custom verification URL. Requiring Email Verification For stricter security, enable emailAndPassword.requireEmailVerification to block sign-in until the user verifies their email. When enabled, unverified users will receive a new verification email on each sign-in attempt. Note: This requires sendVerificationEmail to be configured and only applies to email/password sign-ins. Client Side Validation Implement client-side validation for immediate user feedback and reduced server load. Callback URLs Always use absolute URLs (including the origin) for callback URLs in sign-up and sign-in requests. This prevents Better Auth from needing to infer the origin, which can cause issues when your backend and frontend are on different domains. Password Reset Flows Provide sendResetPassword in the email and password config to enable password resets. Security Considerations Built-in protections: background email sending (timing attack prevention), dummy operations on invalid requests, constant response messages regardless of user existence. On serverless platforms, configure a background task handler: Token Security Tokens expire after 1 hour by default. Configure with resetPasswordTokenExpiresIn (in seconds): Tokens are single-use — deleted immediately after successful reset. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills better-auth/emailAndPassword