github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-10-20 20:26:55 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

Without email verification, how can we restrict him from registering an account #2853

New Issue
Open
opened 2026-03-13 10:23:36 -05:00 by GiteaMirror · 8 comments
GiteaMirror commented 2026-03-13 10:23:36 -05:00
Owner
Copy Link
Copy Source

Originally created by @Rvvvv1 on GitHub (Feb 10, 2026).

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

How to create a user in the database only after user authentication when registering with an email? If we don't do this, there is a problem that if the user hasn't been verified, they will still be created in my database. If they register again, it will show that the account already exists

Current vs. Expected behavior

Image import { betterAuth } from "better-auth";
import { drizzleAdapter } from "better-auth/adapters/drizzle";
import db from "../../server/db";
import { admin, openAPI, username } from "better-auth/plugins";
import { nextCookies } from "better-auth/next-js";
import * as schema from "../../server/db/schema";
import { sendEmail } from "../emails/send-email";

export const auth = betterAuth({
database: drizzleAdapter(db, {
provider: "pg",
schema,
}),
emailAndPassword: {
enabled: true,
autoSignIn: false,
requireEmailVerification: true,
},
emailVerification: {
sendVerificationEmail: async ({ url, user }) => {
await sendEmail(url, user);
},
},
socialProviders: {
// github: {
// clientId: process.env.GITHUB_CLIENT_ID as string,
// clientSecret: process.env.GITHUB_CLIENT_SECRET as string,
// },
},
trustedOrigins: [process.env.BETTER_AUTH_URL!],
plugins: [admin(), username(), nextCookies(), openAPI()],
});

What version of Better Auth are you using?

1

System info

1

Which area(s) are affected? (Select all that apply)

Client

Auth config (if applicable)

import { betterAuth } from "better-auth"
export const auth = betterAuth({
  emailAndPassword: {  
    enabled: true
  },
});

Additional context

No response

Originally created by @Rvvvv1 on GitHub (Feb 10, 2026). ### Is this suited for github? - [ ] Yes, this is suited for github ### To Reproduce How to create a user in the database only after user authentication when registering with an email? If we don't do this, there is a problem that if the user hasn't been verified, they will still be created in my database. If they register again, it will show that the account already exists ### Current vs. Expected behavior <img width="1332" height="820" alt="Image" src="https://github.com/user-attachments/assets/730ef48b-a8dd-4fac-be72-ebb51efce7c1" /> import { betterAuth } from "better-auth"; import { drizzleAdapter } from "better-auth/adapters/drizzle"; import db from "../../server/db"; import { admin, openAPI, username } from "better-auth/plugins"; import { nextCookies } from "better-auth/next-js"; import * as schema from "../../server/db/schema"; import { sendEmail } from "../emails/send-email"; export const auth = betterAuth({ database: drizzleAdapter(db, { provider: "pg", schema, }), emailAndPassword: { enabled: true, autoSignIn: false, requireEmailVerification: true, }, emailVerification: { sendVerificationEmail: async ({ url, user }) => { await sendEmail(url, user); }, }, socialProviders: { // github: { // clientId: process.env.GITHUB_CLIENT_ID as string, // clientSecret: process.env.GITHUB_CLIENT_SECRET as string, // }, }, trustedOrigins: [process.env.BETTER_AUTH_URL!], plugins: [admin(), username(), nextCookies(), openAPI()], }); ### What version of Better Auth are you using? 1 ### System info ```bash 1 ``` ### Which area(s) are affected? (Select all that apply) Client ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth" export const auth = betterAuth({ emailAndPassword: { enabled: true }, }); ``` ### Additional context _No response_
GiteaMirror added the question label 2026-03-13 10:23:36 -05:00
GiteaMirror commented 2026-03-13 10:23:37 -05:00
Author
Owner
Copy Link
Copy Source

@better-auth-agent[bot] commented on GitHub (Feb 10, 2026):

To restrict account creation without email verification in Better Auth, it's important to set up your configuration correctly. You can make use of the requireEmailVerification feature. This will ensure that users are only able to log in after they have verified their email address.

Here's how you can configure this correctly:

  1. Enable email verification: In your Better Auth configuration, ensure you have requireEmailVerification set to true within the emailAndPassword section.

    import { betterAuth } from "better-auth";
import { drizzleAdapter } from "better-auth/adapters/drizzle";
import db from "../../server/db";
import * as schema from "../../server/db/schema";

export const auth = betterAuth({
  database: drizzleAdapter(db, {
    provider: "pg",
    schema,
  }),
  emailAndPassword: {
    enabled: true,
    requireEmailVerification: true, // Ensure this is set to true
  },
  emailVerification: {
    sendVerificationEmail: async ({ url, user }) => {
      await sendEmail(url, user);
    },
  },
});

  2. Handle user sign-up: If a user tries to register, ensure that their account is not created in your database until they have verified their email. This can be done by only creating the user after confirming their email address through a verification link.

  3. Prevent duplicate accounts: With email verification enabled, if a user attempts to register with an email that has not yet been verified, they should get an error notification about needing to verify their email address before they can log in.

You can also manually handle such errors when users attempt to sign in without verified emails by sending them messages like, "Please verify your email address" if they encounter a specific error code indicating that their email is unverified.

What specific features of Better Auth are you planning to implement in your app? If you have more questions or need further assistance, feel free to ask!

If you need more help, tag @better-auth-agent in a comment so I can respond.

Diagram • Discord • GitHub

Diagram Join Star

@better-auth-agent[bot] commented on GitHub (Feb 10, 2026): To restrict account creation without email verification in Better Auth, it's important to set up your configuration correctly. You can make use of the `requireEmailVerification` feature. This will ensure that users are only able to log in after they have verified their email address. Here's how you can configure this correctly: 1. **Enable email verification**: In your Better Auth configuration, ensure you have `requireEmailVerification` set to `true` within the `emailAndPassword` section. ```typescript import { betterAuth } from "better-auth"; import { drizzleAdapter } from "better-auth/adapters/drizzle"; import db from "../../server/db"; import * as schema from "../../server/db/schema"; export const auth = betterAuth({ database: drizzleAdapter(db, { provider: "pg", schema, }), emailAndPassword: { enabled: true, requireEmailVerification: true, // Ensure this is set to true }, emailVerification: { sendVerificationEmail: async ({ url, user }) => { await sendEmail(url, user); }, }, }); ``` 2. **Handle user sign-up**: If a user tries to register, ensure that their account is not created in your database until they have verified their email. This can be done by only creating the user after confirming their email address through a verification link. 3. **Prevent duplicate accounts**: With email verification enabled, if a user attempts to register with an email that has not yet been verified, they should get an error notification about needing to verify their email address before they can log in. You can also manually handle such errors when users attempt to sign in without verified emails by sending them messages like, "Please verify your email address" if they encounter a specific error code indicating that their email is unverified. What specific features of Better Auth are you planning to implement in your app? If you have more questions or need further assistance, feel free to ask! _If you need more help, tag @better-auth-agent in a comment so I can respond._ <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)
GiteaMirror commented 2026-03-13 10:23:37 -05:00
Author
Owner
Copy Link
Copy Source

@Rvvvv1 commented on GitHub (Feb 10, 2026):

@better-auth-agent 处理用户注册 ：如果用户尝试注册，确保在他们验证邮箱之前，不要在数据库中创建他们的账户。只需通过验证链接确认邮箱地址后，才创建用户即可。怎么实现

@Rvvvv1 commented on GitHub (Feb 10, 2026): @better-auth-agent 处理用户注册 ：如果用户尝试注册，确保在他们验证邮箱之前，不要在数据库中创建他们的账户。只需通过验证链接确认邮箱地址后，才创建用户即可。怎么实现
GiteaMirror commented 2026-03-13 10:23:38 -05:00
Author
Owner
Copy Link
Copy Source

@better-auth-agent[bot] commented on GitHub (Feb 10, 2026):

To restrict users from registering an account without verifying their email in Better Auth, you should ensure that the requireEmailVerification option is set to true in your configuration. This will prevent accounts from being created until the user's email address has been verified.

Here's the essential part of the configuration to implement:

import { betterAuth } from "better-auth";
import { drizzleAdapter } from "better-auth/adapters/drizzle";
import db from "../../server/db";

export const auth = betterAuth({
  database: drizzleAdapter(db, {
    provider: "pg",
  }),
  emailAndPassword: {
    enabled: true,
    requireEmailVerification: true, // Ensure this is set
    autoSignIn: false,
  },
  emailVerification: {
    sendVerificationEmail: async ({ url, user }) => {
      await sendEmail(url, user); // This function should handle sending the email
    },
  },
});

With the requireEmailVerification set to true, users must verify their email before their account is fully created and accessible. If they have not verified, any attempt to sign in with that email will be blocked, and you can handle the error appropriately on the client side to prompt the user to check their email for the verification link.

If you need further assistance or details on handling errors properly during sign-in, feel free to ask! How are you planning to implement the email verification flow?

Diagram • Discord • GitHub

Diagram Join Star

@better-auth-agent[bot] commented on GitHub (Feb 10, 2026): To restrict users from registering an account without verifying their email in Better Auth, you should ensure that the `requireEmailVerification` option is set to true in your configuration. This will prevent accounts from being created until the user's email address has been verified. Here's the essential part of the configuration to implement: ```typescript import { betterAuth } from "better-auth"; import { drizzleAdapter } from "better-auth/adapters/drizzle"; import db from "../../server/db"; export const auth = betterAuth({ database: drizzleAdapter(db, { provider: "pg", }), emailAndPassword: { enabled: true, requireEmailVerification: true, // Ensure this is set autoSignIn: false, }, emailVerification: { sendVerificationEmail: async ({ url, user }) => { await sendEmail(url, user); // This function should handle sending the email }, }, }); ``` With the `requireEmailVerification` set to true, users must verify their email before their account is fully created and accessible. If they have not verified, any attempt to sign in with that email will be blocked, and you can handle the error appropriately on the client side to prompt the user to check their email for the verification link. If you need further assistance or details on handling errors properly during sign-in, feel free to ask! How are you planning to implement the email verification flow? <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)
GiteaMirror commented 2026-03-13 10:23:38 -05:00
Author
Owner
Copy Link
Copy Source

@Rvvvv1 commented on GitHub (Feb 10, 2026):

@better-auth-agent 我想要所有的 auhclient 的 api 响应码 这样我才能根据不同的 code 展示对应的错误信息 如注册用户 密码长度不够 他的code 是{"code":"PASSWORD_TOO_SHORT","message":"Password too short"} 你能给我全部的 code么

@Rvvvv1 commented on GitHub (Feb 10, 2026): @better-auth-agent 我想要所有的 auhclient 的 api 响应码 这样我才能根据不同的 code 展示对应的错误信息 如注册用户 密码长度不够 他的code 是{"code":"PASSWORD_TOO_SHORT","message":"Password too short"} 你能给我全部的 code么
GiteaMirror commented 2026-03-13 10:23:39 -05:00
Author
Owner
Copy Link
Copy Source

@better-auth-agent[bot] commented on GitHub (Feb 10, 2026):

It looks like you’re asking for all the API response codes exclusively for the authClient in Better Auth, which can help in addressing different error messages, such as when a password is too short.

The current implementation includes various error codes that the client can return. These include responses for issues like invalid email or password, session errors, and more general client error codes.

However, the detailed list of error codes isn't explicitly stated in the context documents, but it does indicate that authClient has an object called $ERROR_CODES that categorizes different error messages[2]. You can look into it further in your implementation to retrieve specific codes such as PASSWORD_TOO_SHORT and others.

If you have further queries about handling specific errors or want to delve deeper into a specific topic, feel free to ask! What other aspects of Better Auth are you interested in exploring?

Diagram • Discord • GitHub

Diagram Join Star

@better-auth-agent[bot] commented on GitHub (Feb 10, 2026): It looks like you’re asking for all the API response codes exclusively for the `authClient` in Better Auth, which can help in addressing different error messages, such as when a password is too short. The current implementation includes various error codes that the client can return. These include responses for issues like invalid email or password, session errors, and more general client error codes. However, the detailed list of error codes isn't explicitly stated in the context documents, but it does indicate that `authClient` has an object called `$ERROR_CODES` that categorizes different error messages[[2]](https://www.better-auth.com/docs/concepts/client). You can look into it further in your implementation to retrieve specific codes such as `PASSWORD_TOO_SHORT` and others. If you have further queries about handling specific errors or want to delve deeper into a specific topic, feel free to ask! What other aspects of Better Auth are you interested in exploring? <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)
GiteaMirror commented 2026-03-13 10:23:40 -05:00
Author
Owner
Copy Link
Copy Source

@Rvvvv1 commented on GitHub (Feb 10, 2026):

@better-auth-agent USER_ALREADY_EXISTS: "用户已存在"
USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: "用户已存在，请使用其他邮箱" 这两个有什么区别

@Rvvvv1 commented on GitHub (Feb 10, 2026): @better-auth-agent USER_ALREADY_EXISTS: "用户已存在" USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: "用户已存在，请使用其他邮箱" 这两个有什么区别
GiteaMirror commented 2026-03-13 10:23:41 -05:00
Author
Owner
Copy Link
Copy Source

@better-auth-agent[bot] commented on GitHub (Feb 10, 2026):

The messages "USER_ALREADY_EXISTS" and "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL" refer to similar situations where a user attempts to register an account with an email that already exists in the database. However, they provide slightly different guidance:

  • "USER_ALREADY_EXISTS": This error indicates that the user is attempting to register an account but the specified email already exists.
  • "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL": This message explicitly suggests that the user needs to use another email to complete the registration since the provided one is already associated with an existing account.

This distinction helps users understand what action they need to take for successful registration.

Is there something specific you'd like to know about handling such errors or improving user experience during registration?

Diagram • Discord • GitHub

Diagram Join Star

@better-auth-agent[bot] commented on GitHub (Feb 10, 2026): The messages "USER_ALREADY_EXISTS" and "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL" refer to similar situations where a user attempts to register an account with an email that already exists in the database. However, they provide slightly different guidance: - "USER_ALREADY_EXISTS": This error indicates that the user is attempting to register an account but the specified email already exists. - "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL": This message explicitly suggests that the user needs to use another email to complete the registration since the provided one is already associated with an existing account. This distinction helps users understand what action they need to take for successful registration. Is there something specific you'd like to know about handling such errors or improving user experience during registration? <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)
GiteaMirror commented 2026-03-13 10:23:43 -05:00
Author
Owner
Copy Link
Copy Source

@bytaesu commented on GitHub (Feb 22, 2026):

Hi @Rvvvv1,

In the default email/password flow, email verification does not delay user creation. Instead, it blocks session issuance (login) for unverified users. This could allow email pre-claiming (account creation without verification), but it does not grant account access. The actual email owner can complete verification to take control of the account.

Tip

If you use the EmailOTP plugin signIn.emailOtp() flow, the account is created only after successful OTP verification.

https://www.better-auth.com/docs/plugins/email-otp#api-method-sign-in-email-otp

@bytaesu commented on GitHub (Feb 22, 2026): Hi @Rvvvv1, In the default email/password flow, email verification does not delay user creation. Instead, it blocks session issuance (login) for unverified users. This could allow email pre-claiming (account creation without verification), but it does not grant account access. The actual email owner can complete verification to take control of the account. > [!TIP] > If you use the EmailOTP plugin `signIn.emailOtp()` flow, the account is created only after successful OTP verification. > > https://www.better-auth.com/docs/plugins/email-otp#api-method-sign-in-email-otp
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No labels question
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#2853