Security features
Passwords, two-factor authentication, passkeys, rate limits and what users see.
Passwords
- 12 to 128 characters. Passwords found in known breaches (haveibeenpwned) are rejected at sign-up and on change.
- Hashing is scrypt with Better Auth's parameters, so hashes are portable between Better Auth instances.
- A password reset revokes every session. Users are emailed a link valid for one hour.
Two-factor authentication
Users enable it from Account → Security. Two methods are available and can be combined:
| Method | Notes |
|---|---|
| Authenticator | TOTP, issuer "Dylog"; QR code shown once during setup |
| Email code | Six-digit one-time code sent to the account email |
Ten backup codes are generated at enrolment and can be regenerated. Sign-in with two-factor enabled asks
for the second step before returning to next.
Passkeys
Users can register platform or roaming passkeys and sign in without a password ("Continue with Passkey").
Passkeys are bound to the accounts hostname, so they will need re-registering when production moves from
workers.dev to accounts.dylog.ai.
Rate limits
Enforced per client IP at the edge:
| Endpoint | Limit |
|---|---|
/api/auth/sign-in/email | 10 per minute |
/api/auth/sign-up/email | 5 per minute |
/api/auth/request-password-reset | 5 per minute |
/api/auth/two-factor/* | 10 per minute |
everything else under /api/auth | 100 per minute |
/api/auth/get-session | unlimited |
Exceeding a limit returns 429 with Retry-After.
Sessions
Seven-day sessions extended daily while active, revocable per device from Account → Security. See Sessions.
Accounts sends verification, password reset, email-change confirmation, invitation, one-time code and
"password changed" emails from accounts@dylog.ai. In environments without an email provider key the
messages are logged instead of sent.