---
url: /docs/en/agentbuff-stack/auth-mail.md
---
# Accounts, teams and email

The workspace uses Better Auth with TanStack Query session wrappers. Pages requiring authentication wait for a valid user and session. Do not read `auth.useSession()` directly when extending the application; use existing query wrappers so sign-in, sign-out and invalidation share one cache.

## Local workflow

1. Open `/signup` or `/zh/signup`, register with an email and password.
2. Inspect the captured verification email in the local outbox; open its signed link.
3. Sign in and use the dashboard. Password recovery opens the reset page in the chosen language.
4. Use settings to review sessions, linked providers and passkeys. Sensitive changes can require fresh sign-in.

The language header selects presentation only. It never grants permissions or changes account identity. Unknown/disabled language requests fall back to English for immediate emails. Email themes, preview text and body come from one dictionary. Signed authentication endpoints remain under root `/api/auth`; localized callbacks preserve safe return destinations.

## Teams

Create or switch a team in the workspace. Owners and authorized administrators can invite members and manage permitted roles. Invitations require the receiving email to match a verified account. Personal files, saved results, tasks and credits stay personal after switching teams.

Team ownership is separate from site administration. A team owner does not gain site-wide access. Leaving as the only owner requires an ownership transfer first. Review confirmations before removing members or transferring a team.

## Configure services

Password, email OTP and passkey switches are in product configuration. Google/GitHub require complete server credential pairs. Local email is captured by the launcher; production uses the configured Resend sender. Building templates successfully does not prove external delivery or OAuth/passkey browser acceptance.

After editing email templates, rebuild the email package and API before restarting preview. Never share outbox verification codes or include them in a source commit. See [Environment](./env), [Languages](./languages) and [Administration](./admin-audit).