Forgotten password recovery
A user cannot remember an email-password account password and needs a secure recovery link.
Better Auth · Module
forgetPassword
Better Auth password recovery sends a token-bearing reset link through a configured email callback. The user follows the link and submits a new password on the reset page.
How it works
Enable email-and-password authentication and provide a callback that sends each user a reset link. The linked reset page then uses the token to invoke the password-reset operation with the user's new password.
Syntax
sendResetPassword: async ({ user, url, token }, request) => { /* send reset email */ }Parameters
| Name | Type | Description |
|---|---|---|
user | User | User account associated with the reset request. |
url | string | Reset URL containing the verification token. |
token | string | Verification token used to complete the reset. |
Returns
A reset-email callback; the documentation does not specify a distinct return value.
Key points
- The reset-email callback receives a structured payload rather than only a URL.
- Your application must provide the destination page that handles the clicked reset link.
- The reset page completes recovery by calling the password-reset operation.
Common mistakes
- Resetting a password does not automatically end the user's other active sessions; enable session revocation when that security behavior is required.
Example: Configure password-reset email
import { betterAuth } from "better-auth";
export const auth = betterAuth({
emailAndPassword: {
enabled: true,
sendResetPassword: async ({ user, url }) => {
await sendEmail({
to: user.email,
subject: "Reset your password",
text: `Open this link to reset your password: ${url}`,
});
},
},
});Configure an email sender that delivers the generated reset URL to the user.
When to use it
Custom reset-email delivery
An application wants password-reset messages delivered through its existing transactional email provider.
Session invalidation after reset
An organization requires credential recovery to invalidate previously issued sessions.
Interview questions
QHow do you implement a password-reset flow?
Configure emailAndPassword.sendResetPassword to deliver the generated URL to the user. The callback receives the user, reset URL, and token, and the reset page uses the token to complete the password change.
Follow-up: How can all existing sessions be invalidated after the reset? Enable revokeSessionsOnPasswordReset in the email-and-password configuration.
QWhat information is passed to the reset-email callback?
The reset-email callback receives a URL containing a verification token. After the user opens the link, the application presents a reset page and calls resetPassword with the token and replacement password.
Follow-up: What controls how long the token remains valid? resetPasswordTokenExpiresIn sets the validity period in seconds, with a documented default of 3600 seconds.
QHow does password reset work with Email OTP?
The Email OTP plugin supports password recovery by sending a forget-password OTP. The client can request it with emailOtp.requestPasswordReset(), optionally verify it, and then call emailOtp.resetPassword() with the email, OTP, and new password.
Follow-up: Which endpoint should replace the deprecated one? Use /email-otp/request-password-reset.
Related
sendResetPasswordresetPasswordresetPasswordTokenExpiresInrevokeSessionsOnPasswordResetonPasswordResetemailOtp.requestPasswordResetemailOtp.resetPassword