Authentication
Authentication Overview
How authentication works in Switchflag — email/password signup, sessions, roles, and team invitations.
Switchflag uses Better Auth for authentication and session management. All authentication is handled server-side with secure HTTP-only cookies.
Auth methods
Currently, Switchflag supports email and password authentication. Social login providers may be added in the future.
Security features
- Password hashing — bcrypt with automatic salting
- Secure cookies — HTTP-only, secure in production, with CSRF protection
- Email verification — required before signing in
- Session management — 7-day expiry with automatic refresh
Pages
- Email & Password — signup and signin
- Email Verification — verification link flow
- Password Reset — reset link flow
- Sessions — session expiry and refresh
- Roles — owner, admin, and member permissions
- Invitations — team invitation flow