emdash-better-auth — email/password + social login (Better Auth) for public-facing EmDash sites

[minemeraj]

Sharing an open-source (MIT) auth plugin I built for EmDash: emdash-better-auth.

The problem it solves

EmDash's built-in auth is passkey-first and admin-oriented — perfect for logging into the CMS. But if you want to use EmDash as the backend for a public-facing app or membership site, there's no batteries-included email/password registration flow for your end users: signup page, email verification, password reset, "this person is a real user." You had to build all of that yourself.

This plugin fills that gap in one line of config.

What it does

• Email/password + social (Google, GitHub) sign-in, using Better Auth with prebuilt Better Auth UI (HeroUI) pages — sign-in, sign-up, forgot/reset password, with a dark/light/system toggle.
• Sign-ups become real EmDash users — a custom Better Auth adapter maps them onto EmDash's own users table, so accounts are first-class, RBAC-governed users. No migrations, no second user store.
• Mandatory email verification by default (blocks bot signups): unverified sign-in is rejected, the link is re-sent, and clicking it verifies + auto-signs-in. (Needs an email:deliver provider such as emdash-smtp.)
• Admin settings page to configure verification behavior, canonical URL, and per-provider OAuth credentials — without a redeploy. Admin-only (plugins:manage), with env-var fallback.
• Portable & extensible. Everything derives from a single package-name constant; adding a social provider is a two-line change.

Why Better Auth (the bigger picture)

The thing I'm most excited about isn't the feature list — it's the foundation. Because sign-ups flow through a Better Auth adapter onto EmDash's user model, this is really a bridge between EmDash and the Better Auth ecosystem. Today it ships email/password + Google/GitHub, but the same adapter opens the door to Better Auth's plugins — more social providers (Apple, Discord, Microsoft, X…), two-factor, username login, organizations/teams, even Stripe billing — as future additions rather than rewrites.

Try it

• 📦 pnpm add emdash-better-auth — npm
• 💻 Source + docs: https://github.com/theweekendprojects/emdash-better-auth
• 🔗 Live demo: https://theweekendprojects.com/auth/sign-up (real signup + email-verification flow)

Quickstart, requirements, and the security notes are in the README.

One thing building this surfaced: EmDash stores plugin secret-typed settings in the DB unencrypted (the field is only masked in the UI). I'm planning to open an Ideas discussion proposing encrypted-at-rest storage for plugin secrets — for now the plugin documents the tradeoff and lets you keep the signing key as a Worker secret.

This is my first EmDash plugin — feedback, issues, and PRs very welcome. 🙏

[minemeraj]

Some updates, we released 0.4.0 and tested live.

Now the latest version have profile info. We will add more user info.

You can update password:

List of active sessions and you can revoke all the sessions.

One can Enable 2FA

You need an AuthApp:

In login you can trust this device:

So the full 2FA can be enabled and disabled by user. But also possible to mandatory by Admin in admin settings:

[minemeraj]

Update — v0.9.3: everything I listed as "future" above now ships.

When I posted this it was email/password + Google/GitHub, and I listed 2FA, username login, organizations and Stripe billing as things the Better Auth adapter could unlock later. They're all in now:

• Passwordless / magic link, 2FA, passkeys
• Organizations / teams
• OIDC provider + more social providers (Microsoft/Entra, Apple, Discord, Facebook, X)
• Stripe billing
• Audit logging
• An admin settings page to toggle it all, no redeploy

Still one line of config (authProviders: [betterAuthProvider()]), still no migrations, and sign-ups still land as real EmDash users in the users table under EmDash RBAC — not a second user store.

Open edge I'd still like core feedback on: true content paywalling (#1467) and per-collection authZ (#824) need a read/query seam, which I proposed in #3079. Identity + billing are handled today; content gating is the part that needs core.

npm: https://www.npmjs.com/package/emdash-better-auth · repo: https://github.com/theweekendprojects/emdash-better-auth · live demo: https://theweekendprojects.com/auth/sign-up