# Logins and accounts

> Accounts and logins let your app recognize returning visitors and protect their private data, using Better Auth, a database, and an unseen secret key—and you only add them when your app genuinely needs to remember who someone is between visits.

## Analogy

A public park doesn't ask for ID at the gate, because anyone can walk in. A gym does, because it keeps your locker and membership tied to you—and instead of you building the turnstile from scratch, you install a tested lock system.

## How it works

Each app gets only what it needs: if your app is a calculator, a directory or a personal site where nothing belongs to a specific person, skip accounts altogether. Once your spec calls for personal data that must stay private across visits, you need both a database (Neon) and an authentication library (**Better Auth**).

When someone signs in, Better Auth creates a **session**—a signed pass stored in an HTTP-only browser cookie that says “this browser is signed in as user X” until it expires or they sign out. To sign those passes safely, your app uses two env-var settings: `BETTER_AUTH_URL` (your site's address, or `http://localhost:3000` on your computer) and `BETTER_AUTH_SECRET` (a random secret your agent generates and sends straight to `.env.local` and vercel without ever printing it in the chat).

Never let an agent invent its own password handling. Using Better Auth with its security skill gives you salted password hashing, protection against forged requests (**CSRF**), trusted origins for preview links, and database-stored rate-limit rules so an attacker cannot guess thousands of passwords per minute.

Signing in on the frontend is only half the job. Every backend action that reads or changes private data must check the session on the server first, and verify that the signed-in person is allowed to touch that record.

## In your project

When your plan reaches logins, your agent loads the `better-auth-best-practices` and `better-auth-security-best-practices` skills, generates a fresh unseen `BETTER_AUTH_SECRET` for `.env.local` and another for Vercel, creates the auth tables in your Neon development branch, and builds the sign-up, sign-in and sign-out screens.

## Copy for your agent

```text
Check whether my app's SPEC.md actually needs user accounts. If it does, explain how we'll set up Better Auth with database-stored rate limits and unseen secrets before writing any code.
```

---
Source: [Agentic Makers](https://agenticmakers.app/en/learn/logins-and-accounts) · License: CC BY 4.0