skills.rest
shirogin
shiroginCOMMUNITY
Explore all skills by this author →
GitHub

email-and-password-best-practices

Configures Better Auth email verification, password reset, and security enforcement rules.

1|Updated Mar 31, 2026
Search Tags:#authentication#token-management#security-best-practices#password-security#email-verification
One-click install
npx skills add https://github.com/shirogin/jesuph-skills --skill email-and-password-best-practices-shirogin
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: email-and-password-best-practices
Source: https://github.com/shirogin/jesuph-skills/tree/main/.agents/skills/email-and-password-best-practices
Command: npx skills add https://github.com/shirogin/jesuph-skills --skill email-and-password-best-practices-shirogin

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill provides guidance and enforcement rules for implementing secure email and password authentication using Better Auth.

Core Features & Use Cases

  • Email verification setup: configure emailVerification.sendVerificationEmail to verify user emails during sign-up.
  • Requiring email verification: enable emailAndPassword.requireEmailVerification to block sign-in until email is verified.
  • Client-side validation: while server-side validation is essential, client-side checks improve UX and reduce server load.
  • Callback URLs: use absolute URLs for sign-up/sign-in callbacks to avoid origin inference issues.
  • Password reset flows: provide sendResetPassword function to send reset emails; optional onPasswordReset hook.
  • Security considerations: token expiration, single-use tokens, and session revocation on password reset; redirectTo validation; password length requirements.

Quick Start

Configure Better Auth with email/password enabled and implement sendVerificationEmail to verify user emails during signup.

Frequently Asked Questions about email-and-password-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up email verification for user sign-up in Better Auth?▼

Email verification in Better Auth is set up by configuring the emailVerification.sendVerificationEmail function to send verification emails during the user sign-up process. This ensures reliable verification of user email addresses before account activation.

Can I block user sign-in until their email is verified?▼

Yes, you can block sign-in until email verification is complete by enabling the emailAndPassword.requireEmailVerification setting. This enforces the verification flow by restricting access for users with unverified email addresses.

What is the best way to handle password reset flows securely?▼

Secure password reset flows require providing a sendResetPassword function to send reset emails, using single-use tokens with strict expiration, and implementing session revocation upon password reset. An optional onPasswordReset hook can also be configured.

How should callback URLs be configured for authentication redirects?▼

Callback URLs for sign-up and sign-in redirects should always be absolute URLs. Using absolute paths avoids origin inference issues and ensures the authentication flow reliably redirects users to the correct destination.

Do I need client-side validation for password security if I have server-side checks?▼

Client-side validation for password security is recommended alongside essential server-side checks. Implementing client-side password length and policy checks improves user experience and reduces server load by catching invalid inputs early.

What security considerations are important for token management in password resets?▼

Token management for password resets requires enforcing token expiration, using single-use tokens, validating redirectTo URLs, and executing session revocation on password reset. These controls prevent token reuse and unauthorized access.

Related Skills

Explore More Software Engineering Skills→
panaversitypanaversity
16

email-and-password-best-practices

Implement email verification and password reset flows with Better Auth.

Official
Intermediate
nashirabbashnashirabbash

email-and-password-best-practices

Configure email verification and password authentication with Better Auth.

Community
Advanced
PhantomKnight287PhantomKnight287
9

email-and-password-best-practices

Configure Better Auth email and password authentication with secure defaults and migration guidance.

Community
Advanced
spike-land-aispike-land-ai
1

email-and-password-best-practices

Configure secure email and password authentication with Better Auth.

Official
Intermediate