# Secure Better Auth Email and Password Flows

Incomplete authentication settings can expose accounts or disrupt password recovery. This skill provides Better Auth guidance for verification, resets, policies, sessions, and hashing.

## Install

```bash
npx skillstore add better-auth/email-and-password-best-practices
```

## Metadata

- Status: approved
- Slug: better-auth-email-and-password-best-practices
- Skillstore revision: r2
- Version status: missing
- Tree hash: 315879fe351bdb8be10d69728a197215b186d3d8a032e0bd060a3da1795e9449
- Author: better-auth
- GitHub username: better-auth
- License: MIT
- Repository: https://github.com/better-auth/skills/tree/main/better-auth/emailAndPassword/
- Ref: 8c3e20bba512c392d9b02ee748b18e0b09d4982c
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network
- Quality score: 74
- Public page: https://skillstore.pages.dev/skills/better-auth-email-and-password-best-practices
- Manifest: https://skillstore.pages.dev/api/skills/better-auth-email-and-password-best-practices/manifest

## Capabilities

- Guides Better Auth email verification and blocks unverified email and password sign-ins.
- Shows password reset email callbacks, token lifetimes, client requests, and session revocation.
- Configures minimum and maximum password lengths.
- Explains absolute callback and redirect URLs for separate frontend and backend domains.
- Shows default scrypt behavior and a custom Argon2id hash and verify configuration.
- Provides serverless background task handling guidance for authentication emails.

## Use Cases

- Launch Credential Authentication: Configure verified email sign-up, sign-in, password rules, and secure callback URLs for a Better Auth application.
- Review Account Recovery: Assess reset email delivery, token expiry, anti-enumeration behavior, and session revocation before production release.
- Prepare Serverless Email Tasks: Connect Better Auth background authentication emails to the deployment platform's task lifecycle.

## Prompt Templates

### Configure Basic Email Authentication

```
Configure Better Auth email and password sign-up for [application]. Require email verification, use [mail provider], and explain every required setting.
```

### Design Password Recovery

```
Design a Better Auth password reset flow for [application]. Use [expiry] minutes, absolute redirects, background email delivery, and session revocation.
```

### Audit Authentication Settings

```
Review this Better Auth configuration: [configuration]. Identify verification, enumeration, token, redirect, password policy, logging, and session risks. Recommend prioritized changes.
```

### Assess Hash Migration Risk

```
Assess migration from [current hash] to [target hash] for [user count] accounts. Explain compatibility risks, required testing, and decisions needing external migration guidance.
```

## Limitations

- It does not implement an email provider, templates, retries, queues, or delivery monitoring.
- It does not provide complete user interfaces or comprehensive server-side validation.
- It warns about hash compatibility but does not define a complete legacy password migration.
- Example domains, addresses, and hashing costs require environment-specific adaptation and testing.

## Best Practices

- Apply server-side validation even when client-side validation improves immediate feedback.
- Keep verification and reset URLs absolute, trusted, and restricted to approved application origins.
- Revoke sessions after password resets and exclude emails, passwords, and tokens from logs.

## Anti Patterns

- Running mutable latest package releases without pinning and reviewing the selected version.
- Logging account identifiers, passwords, or authentication tokens during verification and reset flows.
- Replacing password verification without a tested migration path for existing hashes.

## Security Audit

- Audited at: 2026-07-23T11:31:54.65\+00:00
- Summary: The audit confirmed one medium-risk instruction that executes the latest Better Auth CLI package without version pinning. It also found a low-severity privacy risk because a reset hook logs user email addresses. The other 46 static alerts are false positives from Markdown, TypeScript examples, placeholder URLs, and ordinary API names.

## Stats

- Views: 43
- Downloads: 5
- Favorites: 0
- Popularity score: 0