Enable email and password authentication
To enable email and password authentication, set the emailAndPassword.enabled option to true in the auth configuration.
Better Auth · Authentication · all subjects
email & password core
7 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
signIn.email endpoint parameters
The POST /sign-in/email endpoint accepts: email (string, required, default "john.doe@example.com"), password (string, required, minimum 8 characters, maximum 128 characters by default), rememberMe (boolean, optional, default true; if false, user is signed out when browser is closed), callbackURL (string, optional, default "https://example.com/callback").
signOut endpoint
The POST /sign-out endpoint requires a session and accepts no parameters. It can accept fetchOptions to redirect onSuccess.
emailAndPassword configuration options
The emailAndPassword configuration supports: enabled (boolean, default false), disableSignUp (boolean, default false), minPasswordLength (number, default 8), maxPasswordLength (number, default 128), sendResetPassword (function), onPasswordReset (function), onExistingUserSignUp (function, default undefined), customSyntheticUser (function), autoSignIn (boolean, default true), requireEmailVerification (boolean, default false), revokeSessionsOnPasswordReset (boolean, default false), resetPasswordTokenExpiresIn (number, default 3600 seconds), password (object with hash and verify functions).
user.validateUserInfo provisioning gate
Better Auth 1.7.0 adds user.validateUserInfo provisioning gate that lets applications reject an identity before a user is created or a new account is linked. It runs once at the creation step for every method that provisions a user (OAuth, SSO/SAML, email/password, magic link, email OTP, anonymous, SIWE, phone number, admin-created users, and SCIM). It re-runs when an existing OAuth or SSO user signs in again where it receives fresh provider email and profile so a domain or org policy can reject users whose provider identity moved out of bounds.
Email enumeration protection with autoSignIn false
When `emailAndPassword.autoSignIn` is set to false, duplicate sign-ups return a synthetic user with `token: null` and trigger `onExistingUserSignUp` hook. New sign-ups also skip auto sign-in with `token: null`, applying email enumeration protection even without `requireEmailVerification`.
Sign-in username respects callbackURL
The `/sign-in/username` endpoint now respects the `callbackURL` body field and sets a `Location` header when provided, returning `{ redirect, url }` alongside `token`/`user`, matching the email flow behavior.