mirror of
https://github.com/better-auth/better-auth.git
synced 2026-07-26 02:16:23 -05:00
Layers main's #9607 clarification onto next's #9057 OTP-enablement rewrite. The "Sign In with 2FA" section now states that 2FA sign-in enforcement applies to the credential endpoints (/sign-in/email, /sign-in/username, /sign-in/phone-number) and that passwordless flows are not gated by default, with guidance to add custom hook handling to require it. The passwordless callout and the allowPasswordless option note that the flag does not change which sign-in methods are challenged. main's edit to the removed skipVerificationOnEnable bullet is dropped, since next deleted that option. (cherry picked from commit 6156cef51329e1c38544aa06eb5072d8a06ece7a)