Washlook

Problem

Shop owners needed to add staff on the spot without requiring each one to have an email address — the standard signup flow assumes an email-verified account, but waiting on an invite round-trip breaks onboarding at a busy counter.

Solution

Built a second onboarding path alongside the standard email-invite flow, via a custom Better Auth plugin (pin-auth.ts):

• •createUserDirectly calls Better Auth's internal adapter directly to create a user row without a password or verification email — bypassing the public sign-up API entirely. Since Better Auth's user.email is a required unique column, it fabricates a synthetic per-org email (name@{org-slug}.local) just to satisfy the constraint, with a numeric suffix on collision.
• •A 4-digit pin field was added to the org plugin's member schema (a supported extension point), unique per organization.
• •signInWithPin is a separate authentication mechanism entirely — org slug + PIN, resolved against member.pin, minting a session directly through the internal adapter instead of Better Auth's credential verification.
• •Staff access this via a shareable slug URL / QR code pointing at a PIN-entry page, so an admin can add someone on the spot and hand them a PIN instead of waiting on an email round-trip.