Skip to content
Grows Documentation

Authentication email and jobs

Better Auth owns verification tokens, password-reset tokens, organization invitations, expiration, acceptance, and membership changes. The application does not recreate those state machines.

Better Auth delivery callbacks enqueue a small email job. The Cloudflare Queue consumer calls Resend with an idempotency key and retries transient failures. RESEND_API_KEY remains a deployment secret and is never stored in product records or generated client code.

Better Auth callback → BACKGROUND_JOBS → Resend

The default messages cover:

  • email verification;
  • password recovery;
  • organization invitations.

Product and billing notifications may use the same queue, but must not mutate Better Auth verification, invitation, or subscription records themselves.