Authentication

The frontend uses the same Better Auth system as the CMS. There is no second auth service, and a website account has no CMS access.

await cms.auth.signUp({ /* … */ });
await cms.auth.signIn({ /* … */ });
const session = await cms.auth.getSession();
await cms.auth.signOut();

Also available: verifyEmail(), resendVerificationEmail(), requestPasswordReset(), resetPassword(), changePassword() and two-factor methods.

Sessions are cookies set by the API. For them to work in browsers that block third-party cookies, and for server-side rendering, route requests through the same-origin proxy.

Endpoints

POST /api/v1/auth/sign-up/email
POST /api/v1/auth/sign-in/email
POST /api/v1/auth/sign-out
GET  /api/v1/auth/get-session
GET  /api/v1/auth/verify-email
POST /api/v1/auth/send-verification-email
POST /api/v1/auth/change-password
POST /api/v1/public/password-reset/request
POST /api/v1/public/password-reset/confirm

Auth POST routes are rate limited (10 per 60 seconds per IP). A sign-in for an unverified address fails with code EMAIL_NOT_VERIFIED.

Optional bot protection: set the TURNSTILE_SECRET_KEY Worker secret to require a Cloudflare Turnstile token on sign-up (auth.signUp({ turnstileToken })).