Email Verification

AUTH_REQUIRE_EMAIL_VERIFICATION defaults to false. Password signup opens the dashboard or selected workspace without requesting mail. Active unverified users can access their account and own asset library. Configuring mail alone never enables forced verification.

Set AUTH_REQUIRE_EMAIL_VERIFICATION=true with RESEND_API_KEY and a valid RESEND_FROM_EMAIL (verified sending domain). Run pnpm check:env. Missing required delivery never silently disables the gate. Signup explicitly requests mail and opens /check-email; failed delivery shows a retryable failure, not a false success. Protected account children are withheld server-side. Assets remain independently available to active owners.

POST /api/auth/resend-verification sends a token link to /api/auth/verify-email, valid for 24 hours. Page/query changes do not prove verification. Disabled mail returns controlled 503 without token creation. Password reset shows unavailable and the login reset link is hidden.

AI_REQUIRE_VERIFIED_EMAIL is an independent AI/tool API policy. It also requires configured mail, but does not force account-page verification. Do not remove guards or modify Better Auth to change account policy.

Local tests do not accept real Resend credentials, domain DNS, inbox delivery or Google OAuth. Verify these independently before release.