new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

explore / Web & frontend / mozg / Better Auth

Better Auth · Authentication

Answer questions about Better Auth's authentication methods exactly as documented: email and password, social sign-on and each provider's setup, magic links, passkeys, two-factor, sessions and account linking — with each method's options.

525 notes · updated 2026-08-10 · trained 89%

use this brain
# sign in to get a token
$ claude mcp add --transport http mozg \
https://mozg.sh/mcp --header "Authorization: Bearer …"
> use mozg/better-auth-authentication — …
Sign in — get this command with your token in it

New here? Sign in and this exact command appears with your token already inside — copy, paste into your terminal, done.

Or just add it

Sign in and add it, and every agent you have connected can read it — nothing to download, and it stays current as the author updates it.

Sign in to add it

Ask it things like

answers 26/30 on its latest exam
What configuration options are available when enabling email and password authentication in Better Auth?Email & Password: Core Setup✓
What is the expected behavior when you call the sign-in endpoint with valid credentials?Account & Data✓
How does email enumeration protection work in Better Auth's email and password method?Email & Password: Core Setup✓
What is the email verification flow when a user signs up with unverified email?Email & Password: Email Verification✓
What happens to a user's sessions when they reset their password?Email & Password: Password Management✓
What scope must be included in a GitHub OAuth app to retrieve user email?Social Sign-on: GitHub✓
How do you restrict Google sign-in to only Google Workspace accounts from a specific domain?Social Sign-on: Google✓
What is required for Google OAuth configuration in Better Auth?Social Sign-on: Google✓

What it can answer

30 coverage checks
89%
Answers 26 of the exam's 30 questionsIt answers 26 questions, the same as last time.
▲Social Sign-on: Third-party Providers6 / 7
✓Social Sign-on: Google4 / 4
✓Social Sign-on: GitHub3 / 3
✓Social Sign-on: OAuth Setup Patterns3 / 3
✓Account & Data2 / 2
✓Email & Password: Core Setup2 / 2
✓Email & Password: Email Verification2 / 2
✓Social Sign-on: Microsoft & Azure2 / 2
▲Email & Password: Password Management1 / 2
▲Social Sign-on: Apple1 / 3
exam badge — share this score →

Attacks survived

re-run weekly · 2026-08-09
✓gate-battery12/12 known hostile payloads caught by the ingest gate
✓injection-corpusevery active note scanned — no steering language
✓secret-corpusevery active note scanned — no keys or credentials

heuristic scans against known attack classes — measured and dated, not a promise of unpoisonability

Inside

  • Google One Tap disabled for new users when sign-up disabled · social sign-on/google
  • Refresh token endpoint requires account cookie match · account & data
  • Email OTP verification no longer reveals email registration status · email & password: email verification
  • Session deletion removes sessions from secondary storage · account & data
  • JWKS key minting uses transaction-scoped adapter · account & data
  • Yandex provider pre-configured for generic OAuth · social sign-on/generic-oauth
  • Two-factor TOTP and backup code attempt limit per challenge · two-factor
  • Google sign-in hosted domain wildcard support · social sign-on/google
  • Apple user data preservation with oAuthProxy form_post · social sign-on/apple
  • Email OTP password reset retry support · email & password: password reset
  • Magic-link and email-OTP reset credentials on unverified accounts · email & password: password reset
  • Device authorization optional user_id pre-binding · account & data
  • Two-factor account lockout configuration · two-factor
  • Organization invitations can use database-generated IDs · account & data

Licence

CC BY-NC-SA 4.0

Use it, copy it, build on it, with credit. Selling it is not allowed.