email-and-password-best-practices

Overview of email-and-password-best-practices skill

The email-and-password-best-practices skill is a focused Better Auth setup guide for teams implementing classic credential login with the security pieces people usually miss: email verification, password reset, password policy, and password hashing configuration. It is best for developers who already know they want Better Auth and need a fast, correct path to production-grade email/password flows rather than a generic auth explainer.

What this skill helps you do

Use this skill when your real job is to wire up a complete email/password flow that is safe enough to ship:

• enable Better Auth email/password login
• send verification emails
• require verification before sign-in when needed
• add reset-password delivery
• apply password rules and validation
• tune hashing behavior
• run the required migration step

Who should install it

This skill is a strong fit for:

• app teams adding username/email login to a Better Auth project
• developers replacing ad hoc auth prompts with a repeatable setup path
• AI-assisted coding workflows where you want the agent to remember the Better Auth-specific config names and sequence

It is less useful if you are still deciding between auth providers, or if your app uses only OAuth/passkeys and does not need passwords.

Why it is better than a generic auth prompt

A generic prompt might tell an agent to “add login and reset password.” This skill narrows that into the actual Better Auth knobs and expected setup order, including emailAndPassword: { enabled: true }, emailVerification.sendVerificationEmail, reset-password handling, and npx @better-auth/cli@latest migrate. That makes the email-and-password-best-practices for Access Control use case much more reliable.

What matters most before adoption

Before you install, check these decision points:

• you must have an email sending function ready or planned
• you need to decide whether sign-in should require verified email
• you should know your password policy expectations
• you need access to run Better Auth migrations
• you should be comfortable editing auth server config, not just frontend forms

How to Use email-and-password-best-practices skill

Install context for the email-and-password-best-practices skill

Install the skill from the Better Auth skills repository:

npx skills add https://github.com/better-auth/skills --skill emailAndPassword

Then invoke it in an AI coding session when you want Better Auth credential flows configured, audited, or improved.

Read this file first

Start with:

• better-auth/emailAndPassword/SKILL.md

This repository slice is lightweight, so the main value is in applying the guidance to your codebase correctly rather than exploring a large support tree.

What input the skill needs from you

Give the agent the missing context the repo cannot infer:

• your Better Auth config file path
• whether email/password is already partially enabled
• your email sending provider or helper function
• whether email verification is optional or mandatory
• the reset-password UX you want
• any password length or complexity requirements
• whether you need custom hashing settings

Without that context, the agent can still scaffold, but the output will be generic.

Turn a rough goal into a strong prompt

Weak prompt:

• “Set up auth with Better Auth.”

Better prompt:

• “Use the email-and-password-best-practices skill to configure Better Auth email/password login in src/lib/auth.ts, require email verification before sign-in, add sendVerificationEmail using our existing sendEmail() helper, implement reset-password email sending, and tell me what migration command and test steps I need.”

This works better because it supplies file location, desired enforcement, existing mail primitive, and expected deliverables.

Recommended setup workflow

A practical sequence is:

1. Enable email/password in Better Auth.
2. Add verification email sending.
3. Decide whether to require verification before sign-in.
4. Add reset-password email delivery.
5. Apply password validation rules.
6. Review hashing settings only if you have a reason to customize them.
7. Run migration.
8. Test sign-up, verification, sign-in, and reset flows end to end.

That order reduces rework and matches how teams usually debug auth rollout.

Core config the skill is built around

The skill centers on a few Better Auth features:

• emailAndPassword: { enabled: true }
• emailVerification.sendVerificationEmail
• emailAndPassword.requireEmailVerification
• sendResetPassword
• password policy configuration
• hashing algorithm customization
• npx @better-auth/cli@latest migrate

If your prompt does not mention which of these you need, the agent may choose defaults you did not intend.

Email verification is the main adoption blocker

For most teams, the hardest part is not enabling password auth but shipping verification safely. The skill is useful because it reminds the agent that sendVerificationEmail receives { user, url, token }, and that the provided url already contains the verification link. That helps avoid rebuilding links incorrectly when a full URL is already available.

When to require verified email

Use emailAndPassword.requireEmailVerification when your access control model assumes a confirmed identity before account use. The repository guidance also notes an important behavior: unverified users get a fresh verification email when they try to sign in. That is a practical detail many generic prompts miss.

Password reset usage guidance

If your app supports forgotten-password recovery, explicitly ask the agent to wire sendResetPassword and to show the full user journey:

• request reset
• receive email
• follow link
• set new password
• sign in again

Do not ask only for “reset password backend,” or you may get a partial implementation with no delivery step.

Password policy and client validation

The skill covers password policy, but you will get better results if you state:

• minimum length
• whether special characters are required
• whether frontend validation should mirror backend rules
• whether to return user-friendly validation messages

This is especially important if your team wants consistent behavior across sign-up, password change, and reset flows.

Hashing customization is not always needed

The email-and-password-best-practices usage path includes hashing customization, but treat it as an advanced requirement. If you do not have a compliance, migration, or performance reason, ask the agent to keep secure defaults and explain them rather than changing the algorithm unnecessarily.

Practical test checklist after implementation

Ask the agent to validate these scenarios:

• new user sign-up succeeds
• verification email is sent
• verification link works
• unverified sign-in is blocked if required
• repeat sign-in triggers a new verification email when expected
• reset-password email sends successfully
• old password stops working after reset
• password validation fails clearly on weak input

This is where the email-and-password-best-practices guide becomes materially better than a repo skim: it helps you test behavior, not just paste config.

email-and-password-best-practices skill FAQ

Is this skill only for Better Auth?

Yes. This is a provider-specific skill for Better Auth configuration and flows. If you are not using Better Auth, the config names and migration step will not transfer directly.

Is the email-and-password-best-practices skill beginner friendly?

Mostly yes, if you already understand where your auth config lives and how your app sends email. Absolute beginners may still need separate help with SMTP, transactional email providers, route wiring, and frontend forms.

Does it install anything by itself?

No. The skill is guidance for an AI workflow. Your project still needs Better Auth set up, any email provider integration you rely on, and the migration command run in your environment.

When should I not use this skill?

Skip it if:

• you only need OAuth or passkeys
• you are comparing auth platforms, not implementing Better Auth
• your app forbids password login entirely
• you want a broad security architecture review rather than a Better Auth config task

How is this different from asking an LLM for auth help?

The email-and-password-best-practices skill is narrower and more actionable. It steers the model toward Better Auth’s real configuration surface and the operational details around verification and reset flows, which reduces hallucinated APIs and missing steps.

Is it useful for email-and-password-best-practices for Access Control?

Yes, especially when your access control depends on verified identity before granting app access. The requirement to block unverified sign-in is one of the most important policy decisions this skill helps implement correctly.

How to Improve email-and-password-best-practices skill

Give the skill your exact auth file and mail helper

The fastest way to improve output quality is to point the agent at the right file and existing email utility. For example:

• “Edit src/lib/auth.ts and use lib/email/sendEmail.ts.”

That removes guesswork and reduces fake abstractions.

State your verification policy up front

For email-and-password-best-practices work, one missing sentence causes a lot of churn:

• “Users must verify email before first sign-in.”

or

• “Users can sign in before verification, but we still send verification email.”

If you do not specify this, the implementation may be secure but wrong for your product.

Ask for end-to-end flow output, not config only

A stronger request is:

• “Configure the backend and show the frontend/user flow, email triggers, migration command, and manual test plan.”

This avoids incomplete output where the auth server is configured but no one knows how users complete the flow.

Watch for common failure modes

Common issues when using this skill include:

• forgetting to implement actual email delivery
• generating custom verification links when url is already provided
• enabling verification but not deciding whether sign-in must be blocked
• wiring reset-password transport without testing the callback path
• adding frontend password rules that do not match backend validation

Provide policy details for stronger password handling

If password strength matters in your environment, include exact requirements. “Use strong passwords” is too vague. Better prompts mention length, banned patterns, reset expectations, and whether existing users must comply immediately or only on change/reset.

Ask the agent to explain tradeoffs, not just patch code

Good prompt addition:

• “Explain why you kept defaults or changed hashing settings, and note any security/usability tradeoffs.”

That improves reviewability and helps teams avoid cargo-cult security changes.

Iterate after the first draft with failure cases

After the agent produces an initial implementation, improve it by asking:

• “Now review this for unverified-user edge cases.”
• “Add manual test cases for expired reset links.”
• “Check whether password validation is consistent between sign-up and reset.”

This second pass is often where the email-and-password-best-practices install decision pays off, because the skill keeps the iteration grounded in real Better Auth behavior rather than generic auth advice.