Better Auth · Module

auth.api.signInEmail

Signs a user in on the server with an email and password. Optional settings control session persistence and the post-sign-in redirect.

How it works

auth.api.signInEmail authenticates a user with an email address and password. Pass the credential payload under body; optional settings control whether the session survives browser closure and where the user is redirected afterward.

Syntax

await auth.api.signInEmail({ body: { email, password, rememberMe?, callbackURL? }, asResponse?, returnHeaders? })

Parameters

Name	Type	Description
`body.email`	`string, required`	The user's email address.
`body.password`	`string, required`	The user's password; 8–128 characters by default.
`body.rememberMe`	`boolean, optional`	Whether the session should remain after the browser closes; defaults to true.
`body.callbackURL`	`string, optional`	URL to redirect to after sign-in.
`asResponse`	`boolean, optional`	Set true to receive a response object instead of data.
`returnHeaders`	`boolean, optional`	Set true to return response headers with the result.

Returns

A sign-in result containing the authenticated response data; with 2FA enabled it may include twoFactorRedirect and twoFactorMethods. asResponse: true returns a response object instead of data.

Key points

Use the server auth.api namespace for this operation.
The required email value identifies the account to authenticate.
Passwords use an 8-character minimum and 128-character maximum by default.
rememberMe defaults to keeping the session beyond browser closure; set it false for temporary persistence.
callbackURL optionally specifies the destination after successful sign-in.

Common mistakes

Setting rememberMe to false makes the session end when the browser closes.

Example: Sign in through the server API

import { auth } from "./auth";

const result = await auth.api.signInEmail({
  body: {
    email: "john.doe@example.com",
    password: "password1234",
    rememberMe: true,
    callbackURL: "https://example.com/callback",
  },
});

console.log(result);

Call the server API with credentials inside body; optional fields control session persistence and post-sign-in redirection.

When to use it

Server-side credential login

Authenticate a user from a server route or server-side action using email credentials.

Non-persistent sign-in

Keep a session only for the current browser session.

Post-login redirect

Send a successfully authenticated user to a destination URL.

2FA-aware authentication

Branch into an additional verification flow when the account has 2FA enabled.

Interview questions

QHow do you call the server-side email sign-in API?

The server method is called as auth.api.signInEmail, and its input is shaped with a body property containing the credentials. The documented body includes required email and password fields, plus optional rememberMe and callbackURL.

Follow-up: How would you preserve response headers? Pass returnHeaders: true; the API then exposes response headers alongside the response data.

QWhat are the required credentials and password constraints?

email identifies the account and password authenticates it. The documented default password limits are at least 8 characters and at most 128 characters.

Follow-up: What does rememberMe: false change? It causes the user to be signed out when the browser closes.

QHow can 2FA affect the result?

If the user has 2FA enabled, the server result can include twoFactorRedirect: true and available twoFactorMethods. Code should detect that state and continue with the appropriate verification flow.

Follow-up: What must be preserved when chaining the verification call? Forward cookies from the preceding authentication response into the next API call.

auth.api.signUpEmail
auth.api.getSession
auth.api.verifyEmail
auth.api.signInEmailOTP

Source: Email & Password | Better Auth. Checked 2026-10-15.