Passwordless sign-in
Users authenticate without entering a password by receiving a short-lived code by email.
Better Auth · Function
emailOTP
Better Auth’s Email OTP plugin enables email-code sign-in, email verification, and password resets. Configure a delivery callback, then use the client plugin to request and consume OTPs.
How it works
The plugin generates one-time codes and supports passwordless sign-in, email verification, and password reset. Your configuration supplies sendVerificationOTP, which receives the destination address, code, and flow type so the application can deliver the code; the client plugin exposes the corresponding OTP operations.
Syntax
emailOTP(options)Parameters
| Name | Type | Description |
|---|---|---|
options | EmailOTPOptions | Configuration object for the Email OTP plugin, including sendVerificationOTP and OTP options. |
Returns
An Email OTP plugin configured for a Better Auth instance.
Key points
- One plugin covers passwordless sign-in, email verification, and password recovery.
- Register emailOTP in the Better Auth plugins array.
- The client starts delivery by calling sendVerificationOtp with the recipient address and flow type.
- After code entry, signIn.emailOtp completes the OTP sign-in operation.
- Password recovery begins with the client's requestPasswordReset method.
Common mistakes
- The plugin does not deliver messages by itself; configure this callback to send each generated code.
- Use the override option when email verification should use an OTP rather than the default verification link.
- The expiry setting is measured in seconds, so configure it with that unit.
Example: Configure Email OTP
import { betterAuth } from "better-auth"
import { emailOTP } from "better-auth/plugins"
export const auth = betterAuth({
plugins: [
emailOTP({
async sendVerificationOTP({ email, otp, type }) {
console.log({ email, otp, type })
}
})
]
})Configure the plugin and replace the logging body with delivery through your email provider.
When to use it
Email verification
New users confirm control of their email address through a code instead of a link.
Password reset
Users recover access by receiving a code and setting a new password.
Interview questions
QWhat does the Email OTP plugin provide?
The Email OTP plugin supports three flows: sign-in, email verification, and password reset. It generates the code and invokes sendVerificationOTP with email, otp, and type so the application can deliver it.
Follow-up: How would you replace link-based verification? Set overrideDefaultEmailVerification to true in the plugin options.
QHow is passwordless sign-in performed?
The client setup uses emailOTPClient in createAuthClient. A sign-in flow first calls sendVerificationOtp, then completes authentication with signIn.emailOtp after the user supplies the code.
Follow-up: How would you initiate password recovery? Call emailOtp.requestPasswordReset to send a forget-password code.
QHow can delivery differ between authentication flows?
The server callback receives a type identifying the operation, including sign-in, email-verification, or password reset. The application can select an appropriate message or template for each type before sending the OTP.
Follow-up: What configuration controls code lifetime? Use expiresIn, whose value is specified in seconds.
Related
emailOTPClientsendVerificationOtpsignIn.emailOtpemailOtp.requestPasswordResetoverrideDefaultEmailVerificationexpiresIn