From fc00ad5b32b0ab9e5a0f73570d6b95b379a0dfe3 Mon Sep 17 00:00:00 2001 From: Leon Serfaty <80597822+silkoserfo@users.noreply.github.com> Date: Mon, 7 Sep 2026 12:04:19 -0400 Subject: [PATCH] fix(auth): don't require email verification to sign in MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Transactional email only sends when RESEND_API_KEY is set; without it sendEmail() silently no-ops. Combined with requireEmailVerification: true, that meant every newly registered account was permanently locked out — the verification link was never delivered and unverified users could not log in. Verification mail is still sent on signup when email is configured; it is no longer a barrier to signing in. Re-enable once transactional email is live. Note: password reset still depends on email delivery, so users who forget a password remain stuck until RESEND_API_KEY is configured. Co-Authored-By: Claude Opus 5 (1M context) --- lib/auth/auth.ts | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/lib/auth/auth.ts b/lib/auth/auth.ts index e496d59..d18a7cc 100644 --- a/lib/auth/auth.ts +++ b/lib/auth/auth.ts @@ -131,10 +131,13 @@ export const auth = betterAuth({ emailAndPassword: { enabled: true, - // SECURITY GATE: unverified emails CANNOT sign in. Verification emails are sent - // on signup (see emailVerification.sendOnSignUp below), so users can verify before - // their first login. - requireEmailVerification: true, + // Sign-in does NOT require a verified email. This is deliberate: verification + // mail only sends when RESEND_API_KEY is configured, and without it sendEmail() + // silently no-ops — gating sign-in on verification would lock out every new + // account. Verification mail is still sent when email is configured (see + // emailVerification.sendOnSignUp below); it just isn't a barrier to logging in. + // Turn this back on once transactional email is live and proven. + requireEmailVerification: false, minPasswordLength: 8, async sendResetPassword({ user, url }) { await sendEmail({