AUTH STARTER · EMAIL & PASSWORD
Email & password
The boring one. Enabled by default. Proper hashing, length rules, autoSignIn, password reset.
Email and password is on out of the box. We hash with the scrypt-based algorithm Better Auth ships — no rolling your own. Reset flow uses a time-limited token sent over email.
Configure it
// src/auth.config.ts
emailAndPassword: {
enabled: true,
requireEmailVerification: false, // flip to true in prod
minPasswordLength: 8,
maxPasswordLength: 128,
autoSignIn: true, // skip the verification step on sign-up
resetPasswordTokenExpiresIn: 60 * 60, // 1 hour
},Sign up / sign in (client)
import { authClient } from "@/lib/auth-client";
// Sign up
await authClient.signUp.email({
email,
password,
name,
});
// Sign in
await authClient.signIn.email({
email,
password,
});Password reset flow
// 1. Request the link
await authClient.forgetPassword({
email,
redirectTo: "/reset-password",
});
// 2. On the /reset-password page, with the token from the URL
await authClient.resetPassword({
newPassword,
token,
});requireEmailVerification: false in dev, true in prod
We ship with requireEmailVerification: false so you can sign up and click around without an email provider configured. Flip it to true before launch — otherwise anyone with anyone's email can sign up.
Why we don't ship strict password rules
min 8, max 128 — that's it. Forced complexity rules push users to "P@ssw0rd1!" patterns. If you want stricter, add zxcvbn or your own server-side validation. NIST agrees with us on this.
Without RESEND_API_KEY, reset emails log to console
The send function falls back to console.warn so dev doesn't crash. In production, this means "password reset is silently broken if you forget the env var". Always verify Resend is configured before launch.