Skip to content

Authentication

# Authentication LaunchSuite uses **Better Auth** for a secure, modern, and type-safe authentication system. We support multiple authentication methods out of the box, configured to follow industry best practices. > **Security Note**: All passwords are hashed using **bcrypt** before storage. We never store plain-text passwords. ## Supported Methods ### 1. Email & Password Standard email and password authentication is enabled by default. - **Security**: Passwords are hashed using `bcrypt`. - **Verification**: Email verification is required by default. - **Recovery**: Built-in password reset flow. ### 2. Social OAuth We support major OAuth providers for one-click sign-in. To configure them, set the environment variables: | Provider | Environment Variables | | :--- | :--- | | **Google** | `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET` | | **GitHub** | `GITHUB_CLIENT_ID`, `GITHUB_CLIENT_SECRET` | ### 3. Magic Links Passwordless login via email links. - **Flow**: User enters email → System sends link → User clicks link → Logged in. - **Security**: Links are signed and valid for **15 minutes**. ## Session Management Sessions are managed using **JWT Tokens** stored in HTTP-only cookies. | Feature | details | | :--- | :--- | | **Duration** | 7 Days (default) | | **Storage** | HTTP-Only Cookie | | **Refresh** | Automatic on activity | | **Revocation** | Server-side via `sessions` table | ## Database Schema Authentication data is distributed across three main tables: ### `users` **Core user identity.** | Column | Type | Description | | :--- | :--- | :--- | | `id` | Text (UUID) | Unique user identifier | | `email` | Text | User's email address | | `emailVerified` | Boolean | Whether email is verified | | `passwordHash` | Text | Hashed password (null for OAuth) | ### `accounts` **Linked OAuth accounts.** | Column | Type | Description | | :--- | :--- | :--- | | `userId` | Text | Reference to `users.id` | | `providerId` | Text | e.g., "google", "github" | | `accountId` | Text | Provider-specific user ID | ### `sessions` **Active login sessions.** | Column | Type | Description | | :--- | :--- | :--- | | `token` | Text | The session JWT | | `userId` | Text | Reference to `users.id` | | `expiresAt` | Timestamp | When the session invalidates | | `ipAddress` | Text | Client IP for audit logs |