What is authentication-system?

Project instructions for user accounts built with Better Auth, including email-based one-time codes, password resets, email verification, and Plunk event tracking. An OTP is a short-lived code sent to confirm an email address.

Implementing or changing authentication flows, email verification, password resets, subscription integration, and related tracking.

They give developers a shared description of the sign-up, login, and password-reset behavior, including verification rules and error handling.

authentication-system — Cursor rule for Cursor by proSamik: Project instructions for user accounts built with Better Auth…

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add rules/prosamik/starterkit-nextjs-polar-betterauth-postgres/authentication-system

Clone the repo

git clone --depth 1 https://github.com/proSamik/starterkit-nextjs-polar-betterauth-postgres

Made for: Cursor.

Per session 0 Nothing until a file matches its globs; then the whole rule loads.

When invoked 1,070 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00000	$0.01070
Opus 5	$0.00000	$0.00535
Sonnet 5	$0.00000	$0.00214
Haiku 4.5	$0.00000	$0.00107

Measured 3d ago against content hash b49d86dade6e, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

authentication-system scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

Copies of this mod

1 near-identical copy found in the catalogue:

authentication-system — 100% identical, 0 lines differ

.cursor/rules/authentication-system.mdc · 137 lines

How it starts

The opening of the file, as written. The whole thing — 137 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Authentication System Guide

Overview

This project uses Better Auth with email OTP verification for secure user authentication. The system includes password reset, email verification during signup, and event tracking via Plunk.

Core Configuration

Server Configuration

The main authentication configuration is in src/lib/auth/server.ts:

Uses Better Auth with emailOTP plugin
Requires email verification before login (requireEmailVerification: true)
6-digit OTP codes with 5-minute expiration
Maximum 3 attempts per OTP
Integrated with Polar for subscription management

Client Configuration

Client-side authentication setup in src/lib/auth/client.ts:

Includes emailOTPClient plugin for OTP functionality
Error handling with toast notifications
Polar client integration

Authentication Flows

User Registration Flow

Located in src/app/(auth)/sign-up/page.tsx:

Step 1: Email validation and existence check
Step 2: Password and confirmation input
Step 3: Full name collection
Step 4: Email verification with 6-digit OTP
Account creation after successful email verification

Password Reset Flow

Located in src/app/(auth)/forgot-password/page.tsx:

Step 1: Email input for OTP request
Step 2: 6-digit OTP verification
Step 3: New password setup

Sign-In Flow

Located in src/app/(auth)/sign-in/page.tsx:

Standard email/password authentication
Redirects to email verification if account not verified
Social login options (GitHub, Google)

OTP System Features

Resend Cooldown

Custom hook src/hooks/use-resend-cooldown.ts:

2-minute (120 seconds) cooldown between resend attempts
Real-time countdown display in MM:SS format
State preserved throughout application session
Prevents spam and abuse

Read the full file on GitHub · 137 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

3d ago First seen · 137 lines · 0 tokens per session scan A b49d86dade6e

Subscribe to this mod's changes

authentication-system is a cursor rule published in the GitHub repository proSamik/starterkit-nextjs-polar-betterauth-postgres (4 stars, last pushed 1y ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,070 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Backend and APIs Security

authentication-system