better-auth-username-password-reset

A Better Auth plugin that adds an endpoint to request a password reset by username. It generates a short-lived token, stores it via Better Auth's internal adapter, and calls your sendResetPassword function with the token and a prebuilt URL.

Installation

pnpm add better-auth-username-password-reset

Peer dependency:

• better-auth ^1.3.0

Server usage

import { betterAuth } from 'better-auth';
import { usernameRequestPasswordReset } from 'better-auth-username-password-reset';

export const auth = betterAuth({
	// ...other Better Auth options
	plugins: [
		usernameRequestPasswordReset({
			// Token TTL in seconds (default 15 minutes)
			// expiresIn: 60 * 15,
			async sendResetPassword({ user, url, token }) {
				// Send the reset email/message with the provided URL or token
				// e.g. await sendEmail(user.email, { url })
				console.log('Reset URL:', url, 'Token:', token);
			},
		}),
	],
});

Server usage (Optional with Custom User Model)

import { betterAuth } from 'better-auth';
import { usernameRequestPasswordReset } from 'better-auth-username-password-reset';
import type { User } from './types';

export const auth = betterAuth({
	// ...other Better Auth options
	plugins: [
		usernameRequestPasswordReset<User>({
			// Token TTL in seconds (default 15 minutes)
			// expiresIn: 60 * 15,
			// Here type of user is User from your custom user model
			async sendResetPassword({ user, url, token }) {
				// Send the reset email/message with the provided URL or token
				// e.g. await sendEmail(user.email, { url })
				console.log('Reset URL:', url, 'Token:', token);
			},
		}),
	],
});

This registers a POST /username/request-password-reset endpoint in your Better Auth API. The endpoint accepts:

• username (string, required)
• redirectTo (string, optional)

If provided, redirectTo is appended to the reset URL as ?callbackURL=....

Request example

curl -X POST \
  -H "Content-Type: application/json" \
  -d '{
    "username": "johndoe",
    "redirectTo": "/account/password-updated"
  }' \
  http://localhost:3000/api/auth/username/request-password-reset

Response

{ "status": true }

Note: The endpoint always returns { status: true } even if the user is not found, to avoid user enumeration.

Client usage (optional)

import { createAuthClient } from 'better-auth/client';
import { usernameRequestPasswordResetClient } from 'better-auth-username-password-reset/client';

export const authClient = createAuthClient({
	baseURL: '/api/auth',
	plugins: [usernameRequestPasswordResetClient()],
});

await authClient.username.requestPasswordReset({
	body: { username: 'johndoe', redirectTo: '/account/password-updated' },
});

How it works

• Looks up the user by username using your configured adapter and user.modelName (defaults to "user").
• Generates a verification token and stores it via internalAdapter.createVerificationValue.
• Calls your sendResetPassword with { user, url, token } so you can deliver the reset link.

License

MIT