Better Auth · Authentication · all subjects

email and password

13 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Enable email and password authentication

To enable email and password authentication in Better Auth, set the `emailAndPassword.enabled` option to `true` in the `auth` configuration. If not enabled, users cannot sign in or sign up with email and password.

Sign in endpoint and parameters

The sign-in endpoint is POST /sign-in/email and requires a session. It accepts the following parameters: email (string, required, default 'john.doe@example.com'), password (string, required, must be at least 8 characters and max 128 by default), rememberMe (boolean, optional, default true - if false, user is signed out when browser closes), callbackURL (string, optional, default 'https://example.com/callback'). Additional fields or plugins may allow passing different properties.

Sign out endpoint

The sign-out endpoint is POST /sign-out and requires a session. It takes no parameters. To redirect after sign out, pass fetchOptions with onSuccess callback: await authClient.signOut({ fetchOptions: { onSuccess: () => { router.push('/login'); } } }).

autoSignIn option behavior

The `autoSignIn` option (default true) automatically signs in the user after sign up. When set to false, the sign-up response returns a success response and enables enumeration protection.

Cookies configuration for server methods

To use server methods like `signUpEmail`, cookies must be passed back to the client, which may require additional configuration. Plugins are provided for Next.js (see /docs/integrations/next#server-action-cookies) and SvelteKit (see /docs/integrations/svelte-kit#server-action-cookies).

Username-based authentication alternative

If username-based authentication is preferred, use the username plugin which extends the email and password authenticator with username support. See /docs/plugins/username.

Username validation for display username fallbacks

Display username fallbacks are now only stored as usernames when they pass username validation during email sign-up.

Email sign-up username display validation

Display usernames are now validated before being stored as usernames during email sign-up, so invalid fallback values are not persisted.

Email OTP sign-in no longer requires captcha by default

Email OTP sign-in no longer fails with a missing-captcha-token error under default captcha settings. To add captcha to email OTP sign-in, add `/sign-in/email-otp` to `captcha({ endpoints })`.

Expired magic-link tokens and OAuth codes consistently rejected

Expired magic-link tokens and OAuth authorization codes are now reliably rejected. Magic-link verify redirects to `?error=INVALID_TOKEN` for expired tokens (was `?error=EXPIRED_TOKEN`). The OIDC, MCP, and `@better-auth/oauth-provider` `/token` endpoints return `error_description: "invalid code"` for expired codes (was `"code expired"`). The OAuth `error` value stays `invalid_grant`.

Username validation on admin createUser endpoint

The admin `createUser` endpoint now validates username.

Magic-link verify race condition fixed with atomic consumption

A race condition in the `magic-link` plugin's verify handler that allowed two concurrent requests to mint two sessions from the same single-use token was fixed. The handler now consumes the verification row atomically via `internalAdapter.consumeVerificationValue`, so a given magic link mints at most one session regardless of concurrency. The second-redeem error code changed from `ATTEMPTS_EXCEEDED` to `INVALID_TOKEN`.

Username sign-in respects callbackURL

The `/sign-in/username` endpoint now respects `callbackURL` in the body field. The handler sets a `Location` header when `callbackURL` is provided and returns `{ redirect, url }` alongside `token`/`user`, matching the email flow.

Give your agent this brain