new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

Better Auth · Authentication · all subjects

email and password/password reset

5 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Password reset configuration

To enable password reset, provide a `sendResetPassword` function in the `emailAndPassword` configuration. This function takes a data object with properties: user (user object), url (URL containing reset token), token (reset token), and a request object as second parameter. Avoid awaiting email sending to prevent timing attacks; use `waitUntil` on serverless platforms. Optionally provide an `onPasswordReset` callback to execute logic after successful password reset.

Request password reset endpoint

The POST /request-password-reset endpoint accepts: email (string, required, default 'john.doe@example.com'), redirectTo (string, optional, default 'https://example.com/reset-password'). If the user exists, it triggers the sendResetPassword function. Invalid or expired tokens redirect with query parameter ?error=INVALID_TOKEN; valid tokens redirect with ?token=VALID_TOKEN.

Reset password endpoint and usage

The POST /reset-password endpoint accepts: newPassword (string, required, default 'password1234') and token (string, required). Call it as: const { data, error } = await authClient.resetPassword({ newPassword: 'password1234', token }). Extract the token from URL search parameters: const token = new URLSearchParams(window.location.search).get('token').

Revoke sessions on password reset

By default, other active sessions are not revoked when a user resets their password. To revoke all user sessions on password reset, set `emailAndPassword.revokeSessionsOnPasswordReset` to `true`.

Change password endpoint

The POST /change-password endpoint requires a session. It accepts: newPassword (string, required, default 'newpassword1234'), currentPassword (string, required, default 'oldpassword1234'), revokeOtherSessions (boolean, optional, default true - when true, all other active sessions for the user are invalidated).

Give your agent this brain