Skip to main content
Revcenter uses better-auth for authentication — email and password only today (no social sign-in yet), running inside the same Next.js app rather than a separate service.

​
Sign-up and verification

  1. /signup collects name, email, and password and calls signUp.email.
  2. A verification email is sent immediately (Resend in production, or a local Mailpit inbox at http://127.0.0.1:54324 in development — see Quickstart).
  3. You’re redirected to /verify?email=..., which shows a “check your email” message and a resend button.
  4. Clicking the link in the email verifies your address and signs you in automatically.
Accounts cannot sign in until verified — requireEmailVerification is on.

​
Sign-in and sign-out

/login accepts email and password. On success you’re redirected to whatever page you were trying to reach (?redirect=), or /intake by default. Sign out from the dropdown under your name at the bottom of the sidebar. This clears the session cookie and middleware redirects any further attempt to reach a protected page back to /login.

​
Password reset

/reset-password with no token shows a “send me a reset link” form. The emailed link carries a token back to the same page, which then shows a “choose a new password” form. Reset tokens expire after a short window set by better-auth.

​
Organizations

Every user belongs to at least one organization — the workspace that scans, candidates, and API keys are scoped to. On first login without one, you’re sent to /onboarding to name your organization.
  • One active organization per session. Multi-organization membership is supported by better-auth’s data model, but there’s no organization switcher in the UI yet — the session tracks activeOrganizationId, defaulting to your first membership.
  • Roles. The person who creates an organization is its owner. Additional roles (admin, member) exist in better-auth’s organization plugin.

​
Invitations

Inviting a teammate sends them a link to /accept-invitation/{id}. That page:
  1. Loads the invitation (organization name, invited email) — this works even if you’re signed out.
  2. If you’re signed out, it offers sign-in or sign-up links that carry you back to the same invitation afterward.
  3. If you’re signed in as a different email than the invitation, it tells you so rather than silently failing.
  4. If the emails match, Accept invitation joins you to that organization.

​
How this is enforced

Every protected page and API route checks the session server-side before doing anything — there is no client-side-only gate. Data access happens through a service-role database connection that the browser never touches directly; the session check is what stands between a request and that connection. See API Reference → Authentication for the underlying endpoints.