Authentication

ScopeKite owns its auth (email + password via Better Auth, wrapped behind an internal adapter — ADR-007).

• Sign-up requires email verification (delivered via the transactional email pipeline; in local dev, Mailpit catches everything).
• Web uses an HttpOnly, SameSite=Lax first-party cookie behind a same-origin proxy; mobile uses bearer tokens. There is no third-party OAuth yet.
• Password reset and session management are self-serve: Settings → “Your sessions” lists devices and revokes one or all others immediately.
• Sign-up and sensitive endpoints are rate-limited per IP and per account.

Authorization is separate from authentication: membership and roles are enforced per-workspace on every request (Security and tenancy).