github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #6306] Ability to add a password #27801

New Issue
Closed
opened 2026-04-17 19:01:18 -05:00 by GiteaMirror · 3 comments
GiteaMirror commented 2026-04-17 19:01:18 -05:00
Owner
Copy Link

Originally created by @adueck on GitHub (Nov 25, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/6306

Is this suited for github?

  • Yes, this is suited for github

Is your feature request related to a problem? Please describe.

If a user creates an account with a social signin, it would be great to be able to add a password. Just like we are able to link social accounts to a previously created account, we should be able to add an email/password login to an existing account. Currently it looks like to do this we have to go in and do things manually in the DB.

Describe the solution you'd like

It would be great to have an addPassword method on the auth client, like so.

authClient.addPassword({ password });

Describe alternatives you've considered

I have tried using authCilent.changePassword() but that yields the error CREDENTIAL_ACCOUNT_NOT_FOUND.

I have considered doing things manually, something like this... But I would really rather not mess around with the DB myself, both for convenience but more so for stability/DB integrity.

export async function setUserPasswordBackend(userId: string, newPassword: string) {
  // get internal context (for hashing, adapter internals)
  const ctx = await auth.$context;

  // hash the password using Better Auth's configured hash
  const hashed = await ctx.password.hash(newPassword);

  // Upsert the credential account row for this user
  // The exact table/column names depend on your adapter schema; below is conceptual:
  await db.account.upsert({
    where: { userId_providerId: { userId, providerId: "credential" } },
    create: {
      userId,
      providerId: "credential",
      providerAccountId: ctx.utils.generateId?.() ?? /* or email */ userId,
      // the credential record stores the hashed password in 'password' or 'secret' field
      // check your adapter schema; adjust field names accordingly
      // (some adapters store the hash in 'secret' or in the account.value)
      // Example:
      password: hashed,
      // also set identifier (email) if required by your adapter:
      identifier: /* user's email */,
    },
    update: {
      password: hashed,
      // update other fields if needed
    },
  });

  // Optionally revoke other sessions for the user
  await auth.api.revokeSessions({ body: { userId } }); // or use revokeOtherSessions per session
}

Additional context

No response

Originally created by @adueck on GitHub (Nov 25, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/6306 ### Is this suited for github? - [x] Yes, this is suited for github ### Is your feature request related to a problem? Please describe. If a user creates an account with a social signin, it would be great to be able to **add a password**. Just like we are able to link social accounts to a previously created account, we should be able to add an email/password login to an existing account. Currently it looks like to do this we have to go in and do things manually in the DB. ### Describe the solution you'd like It would be great to have an `addPassword` method on the auth client, like so. ``` authClient.addPassword({ password }); ``` ### Describe alternatives you've considered I have tried using `authCilent.changePassword()` but that yields the error `CREDENTIAL_ACCOUNT_NOT_FOUND`. I have considered doing things manually, something like this... But I would really rather not mess around with the DB myself, both for convenience but more so for stability/DB integrity. ``` export async function setUserPasswordBackend(userId: string, newPassword: string) { // get internal context (for hashing, adapter internals) const ctx = await auth.$context; // hash the password using Better Auth's configured hash const hashed = await ctx.password.hash(newPassword); // Upsert the credential account row for this user // The exact table/column names depend on your adapter schema; below is conceptual: await db.account.upsert({ where: { userId_providerId: { userId, providerId: "credential" } }, create: { userId, providerId: "credential", providerAccountId: ctx.utils.generateId?.() ?? /* or email */ userId, // the credential record stores the hashed password in 'password' or 'secret' field // check your adapter schema; adjust field names accordingly // (some adapters store the hash in 'secret' or in the account.value) // Example: password: hashed, // also set identifier (email) if required by your adapter: identifier: /* user's email */, }, update: { password: hashed, // update other fields if needed }, }); // Optionally revoke other sessions for the user await auth.api.revokeSessions({ body: { userId } }); // or use revokeOtherSessions per session } ``` ### Additional context _No response_
GiteaMirror added the lockedenhancement labels 2026-04-17 19:01:18 -05:00
GiteaMirror commented 2026-04-17 19:01:19 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Nov 25, 2025):

Thanks for submitting your feature request! We understand that being able to add an email/password login to an account created via a social sign-in would be very beneficial, and it's something that the community has brought up before. In a previous request, we discussed allowing an admin to set a user’s password by providing a userId rather than requiring a logged‐in session, which is a very similar use case. Although that request was closed, our team is aware of the demand for an API method like addPassword to simplify this process and ensure database integrity without manual intervention [1].

Right now, the recommended workaround is to use the internal context available in Better Auth to hash a new password and update the corresponding account entry using your configured adapter. We know that working directly with the DB isn’t ideal, so we’re actively exploring how to expose a dedicated method (such as authClient.addPassword) to cover this scenario in a more user-friendly way.

Could you share additional details about how you envision this working in your flow, or any extra requirements you might have? Tag @better-auth-agent if you would like an answer from the Agent.

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3576263164 --> @better-auth-agent[bot] commented on GitHub (Nov 25, 2025): Thanks for submitting your feature request! We understand that being able to add an email/password login to an account created via a social sign-in would be very beneficial, and it's something that the community has brought up before. In a previous request, we discussed allowing an admin to set a user’s password by providing a userId rather than requiring a logged‐in session, which is a very similar use case. Although that request was closed, our team is aware of the demand for an API method like addPassword to simplify this process and ensure database integrity without manual intervention [[1]](https://www.better-auth.com/docs/reference/contributing). Right now, the recommended workaround is to use the internal context available in Better Auth to hash a new password and update the corresponding account entry using your configured adapter. We know that working directly with the DB isn’t ideal, so we’re actively exploring how to expose a dedicated method (such as authClient.addPassword) to cover this scenario in a more user-friendly way. Could you share additional details about how you envision this working in your flow, or any extra requirements you might have? Tag @better-auth-agent if you would like an answer from the Agent. <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)
GiteaMirror commented 2026-04-17 19:01:19 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Nov 25, 2025):

Hi @adueck! I'm Dosu and I’m helping the better-auth team.

Better Auth doesn't have a public addPassword method on the client, but you can add a password to an existing social signin account using the server-side setPassword method. This is the recommended and supported approach—it's designed to securely link a credential-based login (email/password) to a user who originally signed up with a social provider, without manual DB manipulation. The setPassword method must be called from the server (not the client) for security reasons and requires the user's session token in the headers. If the user already has a password, it will return an error. Example usage:

await auth.api.setPassword({
  body: { newPassword: "your-new-password" },
  headers: { /* session token headers */ }
});

Alternatively, if you need to set a password for a user by userId (for example, as an admin), the admin plugin provides setUserPassword for backend use cases. Direct DB updates are discouraged—using these API methods ensures integrity and security. For more details, see the official docs and related code.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

<!-- gh-comment-id:3576280041 --> @dosubot[bot] commented on GitHub (Nov 25, 2025): <!-- Greeting --> Hi @adueck! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the better-auth team. <!-- Answer --> Better Auth doesn't have a public addPassword method on the client, but you can add a password to an existing social signin account using the server-side setPassword method. This is the recommended and supported approach—it's designed to securely link a credential-based login (email/password) to a user who originally signed up with a social provider, without manual DB manipulation. The setPassword method must be called from the server (not the client) for security reasons and requires the user's session token in the headers. If the user already has a password, it will return an error. Example usage: ```ts await auth.api.setPassword({ body: { newPassword: "your-new-password" }, headers: { /* session token headers */ } }); ``` Alternatively, if you need to set a password for a user by userId (for example, as an admin), the admin plugin provides setUserPassword for backend use cases. Direct DB updates are discouraged—using these API methods ensures integrity and security. For more details, see the [official docs](https://github.com/better-auth/better-auth/blob/cb5c2fc2604090247f8bb9a33eae03a5fdc1ab14/docs/content/docs/concepts/users-accounts.mdx#L103-L456) and [related code](https://github.com/better-auth/better-auth/blob/cb5c2fc2604090247f8bb9a33eae03a5fdc1ab14/packages/better-auth/src/api/routes/update-user.ts#L130-L371). <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/44d21ed4-3e40-423b-a9d6-0d8f685ac7b3?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/44d21ed4-3e40-423b-a9d6-0d8f685ac7b3?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/44d21ed4-3e40-423b-a9d6-0d8f685ac7b3?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/44d21ed4-3e40-423b-a9d6-0d8f685ac7b3?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/44d21ed4-3e40-423b-a9d6-0d8f685ac7b3?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/44d21ed4-3e40-423b-a9d6-0d8f685ac7b3?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/44d21ed4-3e40-423b-a9d6-0d8f685ac7b3?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=Better%20Auth%20doesn%27t%20have%20a%20public%20addPassword%20method%20on%20the%20client%2C%20but%20you%20can%20add%20a%20password%20to%20an%20existing%20social%20signin%20account%20using%20the%20server-side%20setPassword%20method.%20This%20is%20the%20recommended%20and%20supported%20approach%E2%80%94it%27s%20designed%20to%20securely%20link%20a%20credential-based%20login%20%28email/password%29%20to%20a%20user%20who%20originally%20signed%20up%20with%20a%20social%20provider%2C%20without%20manual%20DB%20manipulation.%20The%20setPassword%20method%20must%20be%20called%20from%20the%20server%20%28not%20the%20client%29%20for%20security%20reasons%20and%20requires%20the%20user%27s%20session%20token%20in%20the%20headers.%20If%20the%20user%20already%20has%20a%20password%2C%20it%20will%20return%20an%20error.%20Example%20usage%3A%0A%0A%60%60%60ts%0Aawait%20auth.api.setPassword%28%7B%0A%20%20body%3A%20%7B%20newPassword%3A%20%22your-new-password%22%20%7D%2C%0A%20%20headers%3A%20%7B%20/%2A%20session%20token%20headers%20%2A/%20%7D%0A%7D%29%3B%0A%60%60%60%0A%0AAlternatively%2C%20if%20you%20need%20to%20set%20a%20password%20for%20a%20user%20by%20userId%20%28for%20example%2C%20as%20an%20admin%29%2C%20the%20admin%20plugin%20provides%20setUserPassword%20for%20backend%20use%20cases.%20Direct%20DB%20updates%20are%20discouraged%E2%80%94using%20these%20API%20methods%20ensures%20integrity%20and%20security.%20For%20more%20details%2C%20see%20the%20%5Bofficial%20docs%5D%28https%3A//github.com/better-auth/better-auth/blob/cb5c2fc2604090247f8bb9a33eae03a5fdc1ab14/docs/content/docs/concepts/users-accounts.mdx%23L103-L456%29%20and%20%5Brelated%20code%5D%28https%3A//github.com/better-auth/better-auth/blob/cb5c2fc2604090247f8bb9a33eae03a5fdc1ab14/packages/better-auth/src/api/routes/update-user.ts%23L130-L371%29.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/6306)
GiteaMirror commented 2026-04-17 19:01:20 -05:00
Author
Owner
Copy Link

@ping-maxwell commented on GitHub (Jan 8, 2026):

Hello, please use the set-password method for this.

<!-- gh-comment-id:3723995939 --> @ping-maxwell commented on GitHub (Jan 8, 2026): Hello, please use the [set-password](https://www.better-auth.com/docs/concepts/users-accounts#set-password) method for this.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label enhancement locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#27801
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?