Email/password accounts
Applications needing conventional account registration and login without a social provider.
Better Auth · Pipe
emailAndPassword
Better Auth’s built-in email/password authenticator supports registration, login, email verification, and password recovery. Enable it in the server configuration and provide email callbacks for verification or reset flows.
How it works
The emailAndPassword configuration controls Better Auth’s built-in email/password authenticator. Enable it on the server, then use the client’s email sign-up and sign-in methods; verification and password-reset flows require corresponding email-sending callbacks.
Syntax
emailAndPassword: { enabled: true }Key points
- The package includes email/password authentication as a built-in authenticator.
- Turn the feature on with
emailAndPassword.enabled: truein the server configuration. - Registration is initiated through the client’s
signUp.emailmethod. - Existing users authenticate through the client’s
signIn.emailmethod. - Successful registration creates an authenticated state automatically unless configured otherwise.
- Verification is enabled by supplying a callback that delivers a link by email.
Common mistakes
- The authenticator must be enabled before email/password sign-up or sign-in will work.
- Server-side authentication methods depend on the session cookies being returned to the client.
Example: Enable email and password authentication
import { betterAuth } from "better-auth";
export const auth = betterAuth({
emailAndPassword: {
enabled: true,
},
});Enable the email-and-password authenticator in the Better Auth server configuration.
When to use it
Verified accounts
Systems that must confirm ownership of an email address before allowing authenticated access.
Password recovery
Applications that need an account-recovery path for forgotten credentials.
Interview questions
QHow do you enable email/password authentication?
Set emailAndPassword.enabled to true in the object passed to betterAuth. Without that setting, Better Auth will not permit email/password registration or login.
Follow-up: How would you prevent registration while retaining login? Set disableSignUp to true in the email-and-password configuration.
QWhich client methods handle registration and login?
Call the client method signUp.email with the user’s information to register, and use signIn.email to authenticate. The server can also expose authentication through auth.api methods.
Follow-up: What happens after successful registration by default? The user is automatically signed in unless autoSignIn is set to false.
QWhat callbacks are needed for verification and password recovery?
Email verification requires a sendVerificationEmail function that sends a verification link. Password-reset support similarly requires a sendResetPassword function in the email/password authenticator.
Follow-up: What configuration can enforce verification before a session is created? Set requireEmailVerification to true.
Related
signUp.emailsignIn.emailsendVerificationEmailsendResetPasswordemailVerificationauth.api