> ## Documentation Index
> Fetch the complete documentation index at: https://docs.revcenter.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Sign-up, sessions, and organizations

Revcenter uses [better-auth](https://www.better-auth.com) for authentication — email and
password only today (no social sign-in yet), running inside the same Next.js app rather
than a separate service.

## Sign-up and verification

1. `/signup` collects name, email, and password and calls `signUp.email`.
2. A verification email is sent immediately (Resend in production, or a local Mailpit
   inbox at `http://127.0.0.1:54324` in development — see [Quickstart](/quickstart)).
3. You're redirected to `/verify?email=...`, which shows a "check your email" message
   and a resend button.
4. Clicking the link in the email verifies your address and signs you in automatically.

Accounts **cannot sign in until verified** — `requireEmailVerification` is on.

## Sign-in and sign-out

`/login` accepts email and password. On success you're redirected to whatever page you
were trying to reach (`?redirect=`), or `/intake` by default.

Sign out from the dropdown under your name at the bottom of the sidebar. This clears the
session cookie and middleware redirects any further attempt to reach a protected page
back to `/login`.

## Password reset

`/reset-password` with no token shows a "send me a reset link" form. The emailed link
carries a token back to the same page, which then shows a "choose a new password" form.
Reset tokens expire after a short window set by better-auth.

## Organizations

Every user belongs to at least one **organization** — the workspace that scans,
candidates, and API keys are scoped to. On first login without one, you're sent to
`/onboarding` to name your organization.

* **One active organization per session.** Multi-organization membership is supported by
  better-auth's data model, but there's no organization switcher in the UI yet — the
  session tracks `activeOrganizationId`, defaulting to your first membership.
* **Roles.** The person who creates an organization is its `owner`. Additional roles
  (`admin`, `member`) exist in better-auth's organization plugin.

## Invitations

Inviting a teammate sends them a link to `/accept-invitation/{id}`. That page:

1. Loads the invitation (organization name, invited email) — this works even if you're
   signed out.
2. If you're signed out, it offers sign-in or sign-up links that carry you back to the
   same invitation afterward.
3. If you're signed in as a **different** email than the invitation, it tells you so
   rather than silently failing.
4. If the emails match, **Accept invitation** joins you to that organization.

## How this is enforced

Every protected page and API route checks the session server-side before doing anything
— there is no client-side-only gate. Data access happens through a service-role database
connection that the browser never touches directly; the session check is what stands
between a request and that connection. See
[API Reference → Authentication](/api-reference/auth) for the underlying endpoints.