@better-auth/core

@better-auth/core

Bug Fixes

• Fixed mapProfileToUser failing to typecheck under exactOptionalPropertyTypes when it returns undefined for name, email, or image

• Fixed ID token sign-in to reject tokens when the provider has no client ID, since their audience cannot be checked

• Fixed a custom Facebook getUserInfo to no longer receive client-submitted access tokens issued to another Facebook app, and ID tokens missing exp or iat are now rejected

• Restored the Twitch and Paybin ID token handling from before 1.7.11, which made account info fail once the ID token stored at sign-in expired

• Added a cause option as a third argument to APIError.from() to keep the underlying error for server-side callers without exposing it in the response

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed plugin init returns with options: undefined failing type checks under exactOptionalPropertyTypes.

• Fixed ID token signature and claim validation for Twitch and Paybin sign-in. Custom Paybin issuers must publish RS256 signing keys at <issuer>/.well-known/jwks.json.

• Reduced installation size while preserving OpenTelemetry instrumentation attributes.

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Limited JWKS refetches for unknown key IDs to protect servers from repeated requests.

• Fixed unreachable JWKS endpoints being reported as invalid tokens instead of server errors.

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Fixed onAPIError.onError handlers to finish before responses are sent and log failures without interrupting requests

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Added isContinuation to postLogin.shouldRedirect so users can complete authorization after selecting an organization

• Fixed DPoP validation for token and UserInfo requests behind proxies that rewrite request URLs

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed ID token sign-in failures caused by up to 30 seconds of clock difference with identity providers

• Fixed Atlassian user info errors being mislabeled as Figma errors in logs

• Fixed authentication requests hanging after interrupted async context initialization

• Fixed recognition of valid AsyncLocalStorage initialized after importing Better Auth but before first use, and corrected misleading errors for invalid runtime-provided values in edge and browser fallbacks.

• Fixed after hooks being skipped for writes retained after a failed request on adapters without transactions

• Fixed Microsoft Entra ID sign-in and account linking with ID tokens when signing keys omit alg

• Fixed sign-in failures, replay checks, and SIWE email handling with generateId: "uuid"

• Aligned @better-auth/utils and better-call dependency versions across official packages

• Fixed concurrent MongoDB writes failing with transaction conflicts by retrying transient errors

• Added support for host-bearing custom-scheme redirect URIs for native OAuth clients

• Fixed password resets and changes retaining the new password when database session revocation fails

• Fixed secondary-storage session failures leaving sign-ups, passkey registrations, or SSO sign-ins in an inconsistent state

• Fixed missing device sessions and failed automatic session switching after cache eviction

For detailed changes, see CHANGELOG

better-auth

Magic Link upgrade: Upgrade servers sharing verification storage together, request new Magic Links, and restart pending OAuth/SAML sign-ins. No database migration is required. See the critical advisory for affected configurations and custom storage changes.

Bug Fixes

• security

  Fixed a critical Magic Link account-takeover vulnerability.

• Fixed ID-token sign-in ignoring the social provider’s disableSignUp setting.

• Fixed OAuth Proxy accepting sign-in state as a provider profile.
  Upgrade all OAuth Proxy participants together; see the OAuth Proxy upgrade guidance.

• Fixed CAPTCHA errors missing the JSON Content-Type header.

• Fixed the active organization failing to refresh after sign-in when a session hook selects the initial organization.

• Fixed rate-limit errors missing the JSON Content-Type header.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

• Added optional validateRedirectUri validation for trusted deployments with dynamic OAuth redirect URIs.

• Added verifyOAuthQueryParams to verify signed authorization queries before rendering a custom consent page.

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed concurrent PostgreSQL requests exceeding database-backed rate limits.

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed consumeOne deleting a record after a concurrent write invalidates its original condition.

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed model identity when a custom model name matches another schema key.

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added database.schemaName support for direct PostgreSQL connections.

Bug Fixes

• Fixed database option type inference outside Cloudflare Workers.

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance.

Bug Fixes

• Fixed Metro bundling when the optional OpenTelemetry API is not installed.

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added Cloudflare as a built-in social provider with client-secret and PKCE support.

• Added initialization-time schema validation and actionable mismatch guidance for Drizzle and Prisma adapters.

• Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches.

• Added custom token endpoint authentication strategies for providers with non-standard request parameters.

Bug Fixes

• Restored optional consumeOne and incrementOne methods for custom database adapters.

• Fixed TikTok sign-in and token refresh with the documented clientKey and clientSecret options.

• Improved request IP validation performance.

• Improved PayPal authorization code and refresh token requests, including PKCE handling.

• Improved Reddit token requests with OAuth-compliant Basic authentication and redirect protection.

• Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer.

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions.

• Fixed auth request logs to respect the configured logger, log level, and disabled setting.

• Improved validation of relative callback and redirect URLs with paths, queries, and fragments.

• Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format.

• Added synchronous and optional access to the current auth endpoint context.

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Added native database transaction support to test instances for PostgreSQL and MySQL.

• Updated bundled dependencies (jose, nanostores, noble crypto packages, SimpleWebAuthn) to their latest compatible releases, with no changes required to existing projects.

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Fixed case-insensitive parsing of string Boolean values for SCIM User active and the primary sub-attribute of emails, phoneNumbers, addresses, roles, and entitlements at the HTTP ingress, improving Microsoft Entra interoperability.

• Added an optional SCIM-owned connection and credential catalog: configure managedConnections to allow trusted server code to create runtime tenant connections and issue, rotate, and revoke bearer credentials through server-only auth.api methods, without a code-defined connection or an application-owned verifier.

• Fixed an issue where trusted server code could not retain a terminal connection binding before a dynamic SCIM connection's first authenticated request when supplying a provisioning domain during decommissioning.

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed SSO provider registration to allow reusing a SCIM connection ID, as SCIM connections no longer participate in the authentication provider namespace.

• Fixed SAML assertion signature verification to validate signatures on the raw assertion instead of trusting an already-parsed response, and enforced signing policy and size limits on SP metadata. wantAssertionsSigned now correctly controls whether the SP requires signed assertions, matching real-world IdP signing behavior.

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

• Fixed Client ID Metadata Document caching to follow shared-cache freshness rules: the plugin now prefers s-maxage over max-age and Expires, honors s-maxage=0, conditionally revalidates with ETag or Last-Modified, and treats invalid or duplicate freshness directives as immediately stale. Concurrent refreshes now converge on a single client-resource link instead of failing on a unique constraint.

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed native adapter transactions for raw database instances (better-sqlite3, node:sqlite, bun:sqlite, mysql2, pg) passed directly as database, matching the behavior of the explicit { db }/{ dialect } config shapes. Plugins requiring native transactions (such as @better-auth/scim) now work correctly when using the quickstart database: new Database(...) form.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed scope error responses so MCP clients now receive a 403 with an RFC 6750 insufficient_scope WWW-Authenticate challenge naming every missing scope, allowing clients to request all needed scopes in a single authorization request.

For detailed changes, see CHANGELOG

auth

Bug Fixes

• Fixed the CLI to refuse adding required columns without default values to already-populated tables

For detailed changes, see CHANGELOG

@better-auth/core

Breaking Changes

• breaking

  Moved database joins out of experimental into the stable advanced.database.joins option

  Migration: Replace experimental: { joins: true } with advanced: { database: { joins: true } }. Drizzle and Prisma users should regenerate their schema (npx auth@latest generate) so it includes the required relations.

• breaking

  Scoped account identity by trusted issuer, keying accounts on (issuer, accountId)

  Migration: Accounts now require Account.issuer. Read provider identity from accountInfo.account.accountId, drop mapping.id from SSO configs, and give the microsoftEntraId helper a concrete tenant GUID. Apply the account-identity backfill in the 1.7 upgrade guide before deploying.

• breaking

  Decoupled SCIM provisioning from the organization plugin

  Migration: SCIM configuration, client APIs, database schema, and the Group model are all replaced, and provisioning state cannot migrate in place. Follow the SCIM cutover in the 1.7 upgrade guide, including a full directory reprovision, before resuming traffic.

• breaking

  Identified Microsoft Entra accounts by the stable oid claim

  Migration: Migrate existing Microsoft account rows created from sub before upgrading. Tokens without a valid oid are rejected.

• breaking

  Verified provider id_tokens with a single shared verifier

  Migration: Custom UpstreamProvider implementations replace the removed verifyIdToken method with an idToken config carrying a JWKS source, issuer, and audience. PayPal client id_token sign-in now returns ID_TOKEN_NOT_SUPPORTED; its redirect flow is unchanged.

Features

• Added clientAssertion support to the Microsoft Entra ID social provider

• Added per-provider requireEmailVerification for social sign-in

• Added a user.validateUserInfo gate for rejecting an identity before a user is created or linked

• Added compound table indexes to plugin database schemas

• Added allowIdpInitiated support for IdP-initiated flows through a secure server-side bounce

• Added RP-initiated logout so signOut() can also sign users out of the OpenID provider

• Added refreshTokenParams for forwarding extra parameters on generic OAuth token refresh

• Added an includeGrantedScopes option to the Google provider

• Added DPoP sender-constrained access tokens (RFC 9449)

• Added private_key_jwt client authentication for token endpoint requests (RFC 7523)

• Sent Cache-Control: no-store on every OAuth response that carries credentials

• Added per-request additionalParams and loginHint across signIn.social, linkSocial, and signIn.sso

• Added JWKS-backed asymmetric JWTs for the session cookie cache

• Added transactional OIDC user resolution for SSO sign-ins

Bug Fixes

• security

  Routed CIMD client_id SSRF checks through the shared host classifier, which now rejects IPv4-compatible IPv6, the 6to4 relay prefix, and site-local addresses

• Derived the OAuth redirect_uri from the per-request base URL in multi-host deployments

• Preserved previously granted account.scope values across re-authentication and token refresh

• Fixed client plugin composition so One Tap, Electron, and Expo type-check with createAuthClient

• Single-sourced HTTP Basic credential encoding and decoding for OAuth client authentication

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed database option type inference for projects that do not use Cloudflare Workers.

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Improved diagnostics for Cloudflare Turnstile verification failures

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added an option to disable OpenTelemetry span creation for individual auth instances

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Fixed concurrent cold-start requests from intermittently losing authentication or transaction context due to an async storage initialization race

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed automatic organization assignment via email domain to require both a verified provider domain and a verified stored user email, preventing social sign-in from joining an organization whose SSO provider merely claims that domain.

• Fixed domain verification to snapshot the provider's domains at request start, returning 409 with SSO_PROVIDER_CHANGED if the provider changes during DNS resolution so callers can reload and retry.

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Improved deleteSessions performance by running deletes in parallel instead of sequentially

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed automatic email-domain organization assignment to require both a verified provider domain and a verified user email, preventing social sign-in from granting access when an SSO provider merely claims a domain.

• Fixed domain verification to snapshot the provider's domains at request start, returning 409 with SSO_PROVIDER_CHANGED if the provider changes during DNS verification so callers can reload and retry.

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Prevented duplicate session requests during React Suspense retries while preserving revalidation for interrupted refreshes

• Restored client plugin declaration compatibility for downstream TypeScript consumers

For detailed changes, see the CHANGELOG.

@better-auth/electron

Bug Fixes

• Restored client plugin declaration compatibility for downstream TypeScript consumers

For detailed changes, see the CHANGELOG.

@better-auth/expo

Bug Fixes

• Restored client plugin declaration compatibility for downstream TypeScript consumers

For detailed changes, see the CHANGELOG.

better-auth

Bug Fixes

• Fixed duplicate session requests being made across Suspense retries

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Fixed auth endpoint types to align with better-call

For detailed changes, see CHANGELOG

auth

Bug Fixes

• Fixed the CLI to align installed packages with the running CLI version

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added a utility for creating stable, namespaced placeholder emails on the reserved placeholder.invalid domain

For detailed changes, see CHANGELOG