skills.rest
NarixHine
NarixHineCOMMUNITY
Explore all skills by this author →
GitHub

email-and-password-best-practices

Configure email verification, password reset flows, and hashing policies for Better Auth credential authentication.

Updated Jul 8, 2026
Search Tags:#typescript#authentication#better-auth#argon2#password reset#password hashing#email verification
One-click install
npx skills add https://github.com/NarixHine/uni-chem --skill email-and-password-best-practices-narixhine
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: email-and-password-best-practices
Source: https://github.com/NarixHine/uni-chem/tree/main/.agents/skills/email-and-password-best-practices
Command: npx skills add https://github.com/NarixHine/uni-chem --skill email-and-password-best-practices-narixhine

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires better-auth, @node-rs/argon2.

What problem does it solve? Setting up secure email/password authentication with Better Auth involves many moving parts—verification emails, reset flows, token expiry, session revocation, and password hashing—and misconfiguring any of them creates security gaps or broken user flows. ## Core Features & Use Cases - Email Verification Setup: Configure sendVerificationEmail and optionally block sign-in until users verify their email with requireEmailVerification. - Password Reset Flows: Implement sendResetPassword, control token expiry, revoke sessions on reset, and handle background tasks on serverless platforms. - Password Policies & Hashing: Set minimum/maximum password lengths and swap the default scrypt hashing for Argon2id via custom hash and verify functions. - Use Case: You are adding credential-based sign-up and login to a Next.js app with Better Auth and need verification emails, a reset-password page, and Argon2id hashing configured correctly. ## Quick Start Ask the assistant to set up Better Auth email and password authentication with email verification and a password reset flow in your project.

Frequently Asked Questions about email-and-password-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up email verification with Better Auth?▼

Configure `emailVerification.sendVerificationEmail` in your Better Auth config with a function that sends the provided verification URL to the user's email. To block sign-in until verification, also enable `emailAndPassword.requireEmailVerification`.

How do I implement a password reset flow in Better Auth?▼

Provide a `sendResetPassword` function in the `emailAndPassword` config that emails the reset URL to the user. Trigger it by calling `requestPasswordReset` with the user's email and a `redirectTo` URL pointing to your reset page.

Can I use Argon2 instead of scrypt for password hashing in Better Auth?▼

Yes, Better Auth defaults to scrypt but accepts custom `password.hash` and `password.verify` functions, so you can plug in Argon2id via @node-rs/argon2. Note that existing users hashed with the old algorithm will not be able to sign in without a migration strategy.

How long do Better Auth password reset tokens last?▼

Reset tokens expire after 1 hour by default and are single-use, being deleted immediately after a successful reset. You can change the lifetime with the `resetPasswordTokenExpiresIn` option, specified in seconds.

Why does my Better Auth password reset email not send on serverless platforms?▼

Better Auth sends emails in the background to prevent timing attacks, and serverless functions may terminate before the task completes. Configure `advanced.backgroundTasks.handler` to wrap the promise with your platform's mechanism, such as `waitUntil`.

Related Skills

Explore More Software Engineering Skills→
Montte-erpMontte-erp
6

better-auth-best-practices

Configure Better Auth server and client for session-backed TypeScript authentication.

Official
Advanced
Pontusg45Pontusg45

better-auth-best-practices

Configure Better Auth server and client with database adapters and plugins.

Community
Advanced
SeanChenRSeanChenR

better-auth-security-best-practices

Configure rate limiting, CSRF protection, and audit logging for Better Auth.

Community
Advanced
selrai-companyselrai-company

modern-auth-2026

Implement passwordless authentication with passkeys, OAuth, and Supabase.

Official
Advanced