Email verification purpose
Email verification is a security feature that ensures users provide a valid email address. It helps prevent spam and abuse by confirming that the email address belongs to the user.
Better Auth · Concepts · all subjects
email & verification
14 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
sendVerificationEmail function parameters
The sendVerificationEmail function is triggered when email verification starts. It accepts a data object with properties: user (the user object containing the email address), url (the verification URL the user must click to verify their email), and token (the verification token used to complete email verification, for use with custom verification URLs). A request object is passed as the second parameter.
Email sending in verification hooks should not be awaited
Avoid awaiting the email sending in sendVerificationEmail callbacks to prevent timing attacks. On serverless platforms, use waitUntil or similar mechanisms to ensure the email is sent without blocking the response.
Enable email verification on sign-up with sendOnSignUp
To automatically send a verification email at signup, set emailVerification.sendOnSignUp to true. This sends a verification email when a user signs up. For social logins, email verification status is read from the SSO.
Behavior of sendOnSignUp with unverified SSO emails
When sendOnSignUp is enabled and the user logs in with an SSO that does not claim the email as verified, Better Auth will dispatch a verification email. However, the verification is not required to login even when requireEmailVerification is enabled.
Require email verification before login
When requireEmailVerification is enabled in emailAndPassword, users must verify their email before they can log in. Every time a user tries to sign in, sendVerificationEmail is called. This only works if sendVerificationEmail is implemented, sendOnSignIn is set to true, and the user is trying to sign in with email and password.
Email verification error response
If a user tries to sign in without verifying their email when requireEmailVerification is enabled, the signIn.email client method returns an error with status 403, which can be handled to show a message to the user.
Manually trigger email verification client method
Email verification can be manually triggered on the client by calling authClient.sendVerificationEmail with email and callbackURL parameters. The callbackURL specifies the redirect URL after verification.
Verify email with token
For manual verification, call authClient.verifyEmail with a query parameter containing the token. The token is provided by the sendVerificationEmail function.
Auto sign-in after email verification
To sign in the user automatically after they successfully verify their email, set the autoSignInAfterVerification option to true in emailVerification configuration.
Password reset email sendResetPassword function
The sendResetPassword function sends a password reset email with a link. It accepts a data object with properties: user (the user object containing the email address), url (the password reset URL), and token (the password reset token for custom verification URLs). A request object is passed as the second parameter.
Email sending in password reset hooks should not be awaited
Avoid awaiting the email sending in sendResetPassword callbacks to prevent timing attacks. On serverless platforms, use waitUntil or similar mechanisms to ensure the email is sent without blocking the response.
Better Auth works with any transactional email provider
Better Auth is provider-agnostic and works with any transactional email provider, giving full control over how authentication emails are delivered. Email providers like Resend, SuperSend TX, and Mailtrap are compatible with Better Auth.
Email is required for all Better Auth users
Email is a key part of Better Auth and is required for all users regardless of their authentication method. Better Auth provides email and password authentication out of the box with utilities to manage email verification and password reset.