skills.rest
TheCardGoat
TheCardGoatOFFICIAL
Explore all skills by this author →
Website𝕏@CardGoatOnlineGitHub

email-and-password-best-practices

Configure Better Auth email verification, password reset, and hashing flows.

14|5|Updated Mar 16, 2026
Search Tags:#security#authentication#better-auth#password reset#password hashing#email verification#session revocation
One-click install
npx skills add https://github.com/TheCardGoat/lorcana-simulator --skill email-and-password-best-practices-thecardgoat
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: email-and-password-best-practices
Source: https://github.com/TheCardGoat/lorcana-simulator/tree/main/.agents/skills/email-and-password-best-practices
Command: npx skills add https://github.com/TheCardGoat/lorcana-simulator --skill email-and-password-best-practices-thecardgoat

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you set up secure and correct email/password authentication by covering verification, password reset, validation, and password hashing configuration.

Core Features & Use Cases

  • Email verification configuration: Implements emailVerification.sendVerificationEmail so users can verify their addresses before relying on sign-in.
  • Password reset flows: Adds sendResetPassword and supports requestPasswordReset to deliver reset links safely.
  • Security hardening: Covers requiring email verification, token expiry, session revocation on reset, password length policies, and how to switch or customize hashing algorithms with hash and verify.
  • Use Case: You’re launching a new web app with Better Auth and need production-grade login security—verify new accounts, allow safe password recovery, and control password hashing and reset behavior.

Quick Start

Configure Better Auth with email verification and password reset by enabling emailAndPassword, implementing emailVerification.sendVerificationEmail, and adding sendResetPassword to send recovery emails.

Frequently Asked Questions about email-and-password-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure email verification in Better Auth?▼

Implement password reset flows by adding sendResetPassword and requestPasswordReset handlers to your Better Auth configuration, ensuring secure reset link delivery and token expiry validation.

Can I customize password hashing algorithms with Better Auth?▼

Yes, you can customize password hashing in Better Auth by applying custom hash and verify functions within your authentication configuration to control credential security algorithms.

How do I enforce password length limits and session revocation on reset?▼

Secure Better Auth password reset flows by setting reset token expiry limits, enforcing session revocation upon password change, and applying password length policies to harden credential validation.

Does Better Auth support gating access until email verification is complete?▼

Yes, Better Auth supports optional email verification gating, allowing you to require verified addresses before users can fully rely on sign-in functionality within your application.

What's the best way to set up secure email and password authentication flows?▼

The best way to secure email and password authentication is by configuring email verification, enforcing password reset token expiry, applying session revocation, and customizing password hashing algorithms.

Related Skills

Explore More Software Engineering Skills→
powerhouse-incpowerhouse-inc

better-auth-best-practices

Provides configuration and best-practice guidance for Better Auth TypeScript authentication integration.

Official
Intermediate
sc30gswsc30gsw

email-and-password-best-practices

Configure Better Auth email verification and password reset workflows.

Community
Advanced
peterbamuhigirepeterbamuhigire
1

email-sender

Send authenticated emails via client SMTP with SPF, DKIM, and DMARC.

Community
Advanced
atilladenizatilladeniz
2

auth-pages

Implement passwordless Magic Link authentication with server-side session checks in Next.js 16.

Community
Intermediate