@better-auth/drizzle-adapter

[!IMPORTANT]
Action required

• If you use ID token sign-in with a provider that has no clientId, set clientId to every client ID your apps sign in with.

better-auth

Bug Fixes

• Fixed the JWT plugin to verify JWTs and session cookie-cache JWTs with the stored key's algorithm instead of the token header's, and to warn when signing or verifying a JWT without an issuer or audience

• Fixed OAuth callbacks completed through the OAuth proxy to run the same checks as the standard OAuth callback, including issuer and ID token nonce validation

• Fixed auth.api.getSession() to keep the original database error as error.cause when the session lookup fails

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed mapProfileToUser failing to typecheck under exactOptionalPropertyTypes when it returns undefined for name, email, or image

• Fixed ID token sign-in to reject tokens when the provider has no client ID, since their audience cannot be checked

• Fixed a custom Facebook getUserInfo to no longer receive client-submitted access tokens issued to another Facebook app, and ID tokens missing exp or iat are now rejected

• Restored the Twitch and Paybin ID token handling from before 1.7.11, which made account info fail once the ID token stored at sign-in expired

• Added a cause option as a third argument to APIError.from() to keep the underlying error for server-side callers without exposing it in the response

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

• Fixed requireMcpAuth to accept only OAuth access tokens and reject session JWTs from the JWT plugin, even when they share the issuer and audience

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed OIDC SSO sign-in to reject ID tokens missing exp or iat and providers with an empty client ID, matching social sign-in

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Fixed repeated PostgreSQL migration diffs for int8 columns.

• Fixed database-backed rate limiting returning an excessively large X-Retry-After value.

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed plugin init returns with options: undefined failing type checks under exactOptionalPropertyTypes.

• Fixed ID token signature and claim validation for Twitch and Paybin sign-in. Custom Paybin issuers must publish RS256 signing keys at <issuer>/.well-known/jwks.json.

• Reduced installation size while preserving OpenTelemetry instrumentation attributes.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed OpenAPI schemas for /oauth2/consent and /oauth2/continue to match their redirect responses.

• Fixed CIMD metadata refreshes overwriting concurrent administrator changes to discovered clients.

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed Expo social account linking with ID tokens when a session cookie is present.

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Fixed Captcha and OpenAPI plugin subpath imports and type resolution for better-auth/plugins/multi-session and better-auth/test.

• Fixed Google One Tap sign-ins not recording google as the last login method.

• Fixed imports from better-auth/plugins/one-tap failing with a not-exported error.

• Fixed Google One Tap ignoring plugin-level autoSelect and cancelOnTapOutside settings.

• Fixed Google One Tap sign-ins ignoring configured Google profile mapping and user info updates.

• Fixed Google One Tap calling a prompt method unsupported by FedCM and retrying skipped prompts.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

• Added optional self-service signing key rotation for private_key_jwt clients.

Bug Fixes

• Fixed valid DPoP proofs being rejected for parameterized routes and URLs with trailing slashes.

• Fixed native clients with HTTP loopback callbacks being rejected when application type inference is enabled.

• Fixed device-code clients being unable to refresh access for approved resources omitted from a token poll.

• Fixed OAuth consent without a reference overwriting or reusing consent for a different reference.

• Fixed dynamic client registration rejecting requests that include both supported and unsupported grants.

• Fixed attempts to change cached trusted clients returning HTTP 500 instead of HTTP 400.

• Improved errors for unknown OAuth client_id values to say client not found.

• Fixed PKCE verifier errors to return the specified HTTP 400 response and error code.

• Fixed unknown OAuth clients receiving invalid_grant instead of invalid_client at the token endpoint.

• Fixed unverifiable JWT access tokens causing server errors at /oauth2/userinfo, /oauth2/introspect, and /oauth2/revoke.

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Limited JWKS refetches for unknown key IDs to protect servers from repeated requests.

• Fixed unreachable JWKS endpoints being reported as invalid tokens instead of server errors.

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

• Fixed MongoDB findMany ignoring ID sorting and potentially repeating or skipping paginated results.

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Fixed onAPIError.onError handlers to finish before responses are sent and log failures without interrupting requests

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Added isContinuation to postLogin.shouldRedirect so users can complete authorization after selecting an organization

• Fixed DPoP validation for token and UserInfo requests behind proxies that rewrite request URLs

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages

• Fixed Drizzle sign-in, session refresh, and date filtering with string-based date columns

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed concurrent PostgreSQL requests exceeding database-backed rate limits.

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed model identity when a custom model name matches another schema key.

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed lazy database initialization when using Drizzle relations.

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Improved schema validation for the Drizzle Relations v2 adapter.

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Features

• Added initialization-time schema validation and actionable mismatch guidance for Drizzle and Prisma adapters.

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed one-to-one Drizzle relations when usePlural is enabled.

• Added validation for missing Drizzle schema fields in compound where clauses.

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Added native database transaction support to test instances for PostgreSQL and MySQL.

• Updated bundled dependencies (jose, nanostores, noble crypto packages, SimpleWebAuthn) to their latest compatible releases, with no changes required to existing projects.

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Fixed case-insensitive parsing of string Boolean values for SCIM User active and the primary sub-attribute of emails, phoneNumbers, addresses, roles, and entitlements at the HTTP ingress, improving Microsoft Entra interoperability.

• Added an optional SCIM-owned connection and credential catalog: configure managedConnections to allow trusted server code to create runtime tenant connections and issue, rotate, and revoke bearer credentials through server-only auth.api methods, without a code-defined connection or an application-owned verifier.

• Fixed an issue where trusted server code could not retain a terminal connection binding before a dynamic SCIM connection's first authenticated request when supplying a provisioning domain during decommissioning.

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed SSO provider registration to allow reusing a SCIM connection ID, as SCIM connections no longer participate in the authentication provider namespace.

• Fixed SAML assertion signature verification to validate signatures on the raw assertion instead of trusting an already-parsed response, and enforced signing policy and size limits on SP metadata. wantAssertionsSigned now correctly controls whether the SP requires signed assertions, matching real-world IdP signing behavior.

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

• Fixed Client ID Metadata Document caching to follow shared-cache freshness rules: the plugin now prefers s-maxage over max-age and Expires, honors s-maxage=0, conditionally revalidates with ETag or Last-Modified, and treats invalid or duplicate freshness directives as immediately stale. Concurrent refreshes now converge on a single client-resource link instead of failing on a unique constraint.

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed native adapter transactions for raw database instances (better-sqlite3, node:sqlite, bun:sqlite, mysql2, pg) passed directly as database, matching the behavior of the explicit { db }/{ dialect } config shapes. Plugins requiring native transactions (such as @better-auth/scim) now work correctly when using the quickstart database: new Database(...) form.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed scope error responses so MCP clients now receive a 403 with an RFC 6750 insufficient_scope WWW-Authenticate challenge naming every missing scope, allowing clients to request all needed scopes in a single authorization request.

For detailed changes, see CHANGELOG

auth

Bug Fixes

• Fixed the CLI to refuse adding required columns without default values to already-populated tables

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Breaking Changes

• breaking

  Moved database joins out of experimental into the stable advanced.database.joins option

  Migration: Replace experimental: { joins: true } with advanced: { database: { joins: true } }, and regenerate the schema (npx auth@latest generate) so it includes the required relations.

Features

• Added compound table indexes to plugin database schemas

• Added a relations-v2 entry point for projects using Drizzle Relations v2

• Added a schemaName option that generates the Drizzle schema inside a pgSchema namespace

Bug Fixes

• Exported the generated pgSchema binding so drizzle-kit can emit CREATE SCHEMA for custom PostgreSQL namespaces

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed database option type inference for projects that do not use Cloudflare Workers.

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Improved diagnostics for Cloudflare Turnstile verification failures

For detailed changes, see CHANGELOG

better-auth

Features

• Added an option to disable OpenTelemetry span creation for individual auth instances

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added an option to disable OpenTelemetry span creation for individual auth instances

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Fixed concurrent cold-start requests from intermittently losing authentication or transaction context due to an async storage initialization race

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed automatic organization assignment via email domain to require both a verified provider domain and a verified stored user email, preventing social sign-in from joining an organization whose SSO provider merely claims that domain.

• Fixed domain verification to snapshot the provider's domains at request start, returning 409 with SSO_PROVIDER_CHANGED if the provider changes during DNS resolution so callers can reload and retry.

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Improved deleteSessions performance by running deletes in parallel instead of sequentially

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed automatic email-domain organization assignment to require both a verified provider domain and a verified user email, preventing social sign-in from granting access when an SSO provider merely claims a domain.

• Fixed domain verification to snapshot the provider's domains at request start, returning 409 with SSO_PROVIDER_CHANGED if the provider changes during DNS verification so callers can reload and retry.

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Prevented duplicate session requests during React Suspense retries while preserving revalidation for interrupted refreshes

• Restored client plugin declaration compatibility for downstream TypeScript consumers

For detailed changes, see the CHANGELOG.

@better-auth/electron

Bug Fixes

• Restored client plugin declaration compatibility for downstream TypeScript consumers

For detailed changes, see the CHANGELOG.

@better-auth/expo

Bug Fixes

• Restored client plugin declaration compatibility for downstream TypeScript consumers

For detailed changes, see the CHANGELOG.

better-auth

Bug Fixes

• Fixed duplicate session requests being made across Suspense retries

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Fixed auth endpoint types to align with better-call

For detailed changes, see CHANGELOG

auth

Bug Fixes

• Fixed the CLI to align installed packages with the running CLI version

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Fixed session cleanup on user deletion to also remove sessions from secondary storage

• Fixed findSessions to skip invalid secondary-storage session entries without discarding other valid sessions

• Fixed email OTP sign-up to pass the verification type to custom OTP generators

• Fixed email OTP password reset to allow retrying after entering an invalid password

• Fixed email OTP verification to no longer reveal whether an email is registered before the OTP is verified

• Fixed jwtClient() collapsing createAuthClient type inference when combined with other client plugins

• Fixed JWT key minting inside database transactions to use the transaction-scoped adapter, preventing deadlocks on SQLite and ensuring keys commit with their surrounding transaction on Postgres and MySQL

• Fixed oAuthProxy to preserve Apple user data from form_post callbacks

• Fixed oneTapClient() collapsing createAuthClient type inference when combined with other client plugins

• Fixed database rate-limit cleanup to complete when no background task handler is configured

• Improved nextCookies performance in instrumented Next.js applications by reusing the next/headers import promise

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added a utility for creating stable, namespaced placeholder emails on the reserved placeholder.invalid domain

For detailed changes, see CHANGELOG

@better-auth/redis-storage

Bug Fixes

• Fixed listKeys() and clear() to use SCAN instead of KEYS so large keyspaces no longer block the Redis server

For detailed changes, see CHANGELOG