skills.rest
sethdavis512
sethdavis512COMMUNITY
Explore all skills by this author →
Website𝕏@sethdavis512GitHub

email-and-password-best-practices

Implement secure email and password authentication with Better Auth.

Updated Mar 5, 2026
Search Tags:#authentication#better-auth#password-reset#security-best-practices#password-security#email-verification#token-expiration
One-click install
npx skills add https://github.com/sethdavis512/iridium-tambo --skill email-and-password-best-practices-sethdavis512
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: email-and-password-best-practices
Source: https://github.com/sethdavis512/iridium-tambo/tree/main/.agents/skills/email-and-password-best-practices
Command: npx skills add https://github.com/sethdavis512/iridium-tambo --skill email-and-password-best-practices-sethdavis512

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill provides guidance and enforcement rules for implementing secure email and password authentication using Better Auth.

Core Features & Use Cases

  • Email verification setup: configure emailVerification.sendVerificationEmail to verify user emails and block sign-ins for unverified accounts when enabled.
  • Requiring email verification: enable requireEmailVerification to enforce verification before sign-in.
  • Client-side validation: guidance for implementing immediate UX validation.
  • Password reset flows: guidance on providing sendResetPassword function and secure reset process.
  • Security considerations: timing attack prevention, token security, single-use tokens, session revocation, redirect validation, and password requirements.
  • Hashing defaults and customization: default hashing with options to swap to alternative algorithms or custom hash/verify logic.

Quick Start

Configure Better Auth with email/password, enable verification, setup reset flows, and enforce strong password policies.

Frequently Asked Questions about email-and-password-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement secure email verification and block sign-in for unverified accounts with Better Auth?▼

Secure email verification with Better Auth uses the `emailVerification.sendVerificationEmail` configuration and enables `requireEmailVerification` to block sign-ins for unverified accounts.

What's the best way to set up a password reset flow that prevents timing attacks and uses single-use tokens?▼

A secure password reset flow requires providing a `sendResetPassword` function, enforcing single-use tokens, validating redirects, and implementing timing attack prevention during the token verification process.

How does Better Auth handle password hashing, and can I customize the default scrypt algorithm?▼

Better Auth password hashing defaults to scrypt, but supports swapping to alternative algorithms or injecting custom hash and verify logic to meet specific security requirements.

How do I enforce token expiration and session revocation during account recovery workflows?▼

Account recovery workflows enforce security by configuring token expiry times, supporting optional single-use tokens, and applying session revocation to invalidate active sessions during password resets.

Can I configure redirect validation and immediate client-side validation for Better Auth sign-up workflows?▼

Yes, Better Auth sign-up workflows support configurable redirects with validation rules and provide guidance for implementing immediate client-side UX validation for user inputs.

Related Skills

Explore More Software Engineering Skills→
sc30gswsc30gsw

better-auth-best-practices

Configure Better Auth authentication with environment variables and database adapters.

Community
Advanced
VictorSmaniottoVictorSmaniotto

auth-rbac

Implement Laravel RBAC with Guards, Policies, Gates, and Spatie permissions.

Community
Advanced
SkobynSkobyn

hunt-brute-force

Detect login brute force, OTP/2FA brute force, and credential stuffing vulnerabilities.

Community
Advanced
atilladenizatilladeniz
2

auth-pages

Implement passwordless Magic Link authentication with server-side session checks in Next.js 16.

Community
Intermediate