@better-auth/i18n

[!IMPORTANT]
Action required

• If you use ID token sign-in with a provider that has no clientId, set clientId to every client ID your apps sign in with.

better-auth

Bug Fixes

• Fixed the JWT plugin to verify JWTs and session cookie-cache JWTs with the stored key's algorithm instead of the token header's, and to warn when signing or verifying a JWT without an issuer or audience

• Fixed OAuth callbacks completed through the OAuth proxy to run the same checks as the standard OAuth callback, including issuer and ID token nonce validation

• Fixed auth.api.getSession() to keep the original database error as error.cause when the session lookup fails

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed mapProfileToUser failing to typecheck under exactOptionalPropertyTypes when it returns undefined for name, email, or image

• Fixed ID token sign-in to reject tokens when the provider has no client ID, since their audience cannot be checked

• Fixed a custom Facebook getUserInfo to no longer receive client-submitted access tokens issued to another Facebook app, and ID tokens missing exp or iat are now rejected

• Restored the Twitch and Paybin ID token handling from before 1.7.11, which made account info fail once the ID token stored at sign-in expired

• Added a cause option as a third argument to APIError.from() to keep the underlying error for server-side callers without exposing it in the response

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

• Fixed requireMcpAuth to accept only OAuth access tokens and reject session JWTs from the JWT plugin, even when they share the issuer and audience

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed OIDC SSO sign-in to reject ID tokens missing exp or iat and providers with an empty client ID, matching social sign-in

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Fixed repeated PostgreSQL migration diffs for int8 columns.

• Fixed database-backed rate limiting returning an excessively large X-Retry-After value.

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed plugin init returns with options: undefined failing type checks under exactOptionalPropertyTypes.

• Fixed ID token signature and claim validation for Twitch and Paybin sign-in. Custom Paybin issuers must publish RS256 signing keys at <issuer>/.well-known/jwks.json.

• Reduced installation size while preserving OpenTelemetry instrumentation attributes.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed OpenAPI schemas for /oauth2/consent and /oauth2/continue to match their redirect responses.

• Fixed CIMD metadata refreshes overwriting concurrent administrator changes to discovered clients.

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed Expo social account linking with ID tokens when a session cookie is present.

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Fixed Captcha and OpenAPI plugin subpath imports and type resolution for better-auth/plugins/multi-session and better-auth/test.

• Fixed Google One Tap sign-ins not recording google as the last login method.

• Fixed imports from better-auth/plugins/one-tap failing with a not-exported error.

• Fixed Google One Tap ignoring plugin-level autoSelect and cancelOnTapOutside settings.

• Fixed Google One Tap sign-ins ignoring configured Google profile mapping and user info updates.

• Fixed Google One Tap calling a prompt method unsupported by FedCM and retrying skipped prompts.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

• Added optional self-service signing key rotation for private_key_jwt clients.

Bug Fixes

• Fixed valid DPoP proofs being rejected for parameterized routes and URLs with trailing slashes.

• Fixed native clients with HTTP loopback callbacks being rejected when application type inference is enabled.

• Fixed device-code clients being unable to refresh access for approved resources omitted from a token poll.

• Fixed OAuth consent without a reference overwriting or reusing consent for a different reference.

• Fixed dynamic client registration rejecting requests that include both supported and unsupported grants.

• Fixed attempts to change cached trusted clients returning HTTP 500 instead of HTTP 400.

• Improved errors for unknown OAuth client_id values to say client not found.

• Fixed PKCE verifier errors to return the specified HTTP 400 response and error code.

• Fixed unknown OAuth clients receiving invalid_grant instead of invalid_client at the token endpoint.

• Fixed unverifiable JWT access tokens causing server errors at /oauth2/userinfo, /oauth2/introspect, and /oauth2/revoke.

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Limited JWKS refetches for unknown key IDs to protect servers from repeated requests.

• Fixed unreachable JWKS endpoints being reported as invalid tokens instead of server errors.

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

• Fixed MongoDB findMany ignoring ID sorting and potentially repeating or skipping paginated results.

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Fixed onAPIError.onError handlers to finish before responses are sent and log failures without interrupting requests

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Added isContinuation to postLogin.shouldRedirect so users can complete authorization after selecting an organization

• Fixed DPoP validation for token and UserInfo requests behind proxies that rewrite request URLs

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Aligned cookie security attributes with RFC 6265bis

• Added SvelteKit 3 to the supported peer dependency range

• Fixed stale cookies persisting after customSession sessions expire or are revoked

• Fixed customSession treating session lookup errors as signed-out users

• Fixed sign-in failures, replay checks, and SIWE email handling with generateId: "uuid"

• Removed non-returned custom fields from inferred output schema types

• Fixed Kysely migration foreign keys when custom table names match another model key

• Reduced organization plugin server bundles by excluding unused Zod locales

• Aligned @better-auth/utils and better-call dependency versions across official packages

• Fixed generic OAuth providers remaining unavailable after discovery fails at startup by retrying on subsequent requests

• Fixed lastLoginMethod sign-in failures when cookieName or maxAge is explicitly undefined

• Fixed magic link verification changing percent-encoded characters in callback URLs

• Fixed type errors when using oauthProvider() or mcp() with exactOptionalPropertyTypes

• Fixed organization plugin type errors in projects with skipLibCheck: false

• Fixed failed password resets consuming reset links or OTPs before the new password is saved

• Fixed password resets and changes retaining the new password when database session revocation fails

• Fixed phone number password resets to use a configured verifyOTP callback

• Fixed secondary-storage session failures leaving sign-ups, passkey registrations, or SSO sign-ins in an inconsistent state

• Fixed missing device sessions and failed automatic session switching after cache eviction

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed ID token sign-in failures caused by up to 30 seconds of clock difference with identity providers

• Fixed Atlassian user info errors being mislabeled as Figma errors in logs

• Fixed authentication requests hanging after interrupted async context initialization

• Fixed recognition of valid AsyncLocalStorage initialized after importing Better Auth but before first use, and corrected misleading errors for invalid runtime-provided values in edge and browser fallbacks.

• Fixed after hooks being skipped for writes retained after a failed request on adapters without transactions

• Fixed Microsoft Entra ID sign-in and account linking with ID tokens when signing keys omit alg

• Fixed sign-in failures, replay checks, and SIWE email handling with generateId: "uuid"

• Aligned @better-auth/utils and better-call dependency versions across official packages

• Fixed concurrent MongoDB writes failing with transaction conflicts by retrying transient errors

• Added support for host-bearing custom-scheme redirect URIs for native OAuth clients

• Fixed password resets and changes retaining the new password when database session revocation fails

• Fixed secondary-storage session failures leaving sign-ups, passkey registrations, or SSO sign-ins in an inconsistent state

• Fixed missing device sessions and failed automatic session switching after cache eviction

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

• Added support for pausing and resuming OAuth clients through adminUpdateOAuthClient

• Added support for linking protected resources when registering a client with adminCreateOAuthClient

• Added resource identifier validation for adminCreateOAuthResource and configured resources

• Added clientId to clientPrivileges checks for actions on existing OAuth clients

Bug Fixes

• Fixed sign-in failures, replay checks, and SIWE email handling with generateId: "uuid"

• Aligned @better-auth/utils and better-call dependency versions across official packages

• Added support for host-bearing custom-scheme redirect URIs for native OAuth clients

• Fixed startup resource-seeding failures from blocking authentication routes until restart

• Fixed type errors when using oauthProvider() or mcp() with exactOptionalPropertyTypes

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages

• Fixed SSO provider registration and updates rejecting partial mapping values that omit defaulted fields

• Fixed SAML providers with linked accounts rejecting IdP signing certificate rotation

• Rejected OIDC SSO providers whose configured issuer does not match discovery, preventing later sign-in failures

• Fixed SAML providers with linked accounts rejecting changes to their post-login callbackUrl

• Fixed OIDC sign-in when the mapped email claim contains a list of addresses

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Fixed SCIM reprovisioning of inactive users with an existing externalId

• Aligned @better-auth/utils and better-call dependency versions across official packages

• Fixed SCIM requests silently ignoring attribute names with different letter case

• Fixed concurrent SCIM updates to return 409 instead of 500 when a unique value is already claimed

• Fixed SCIM User and Group requests rejecting nullable attributes sent as JSON null

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages

• Fixed failed MongoDB transaction commits leaving transactions open and blocking other writes

• Fixed concurrent MongoDB writes failing with transaction conflicts by retrying transient errors

• Fixed MongoDB authentication errors masking the original transaction commit failure

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages

• Fixed Drizzle sign-in, session refresh, and date filtering with string-based date columns

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages

• Fixed cross-request I/O errors from concurrent D1 queries on a shared auth instance with Kysely 0.29

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

• Fixed @better-auth/mcp type errors with exactOptionalPropertyTypes and skipLibCheck: false

• Fixed type errors when using oauthProvider() or mcp() with exactOptionalPropertyTypes

For detailed changes, see CHANGELOG

@better-auth/api-key

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

• Added support for host-bearing custom-scheme redirect URIs for native OAuth clients

For detailed changes, see CHANGELOG

@better-auth/electron

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages

For detailed changes, see CHANGELOG

@better-auth/memory-adapter

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages

For detailed changes, see CHANGELOG

@better-auth/passkey

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages

For detailed changes, see CHANGELOG

@better-auth/prisma-adapter

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

• Stopped reporting completed one-time Stripe checkouts as webhook failures

For detailed changes, see CHANGELOG

@better-auth/telemetry

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages

For detailed changes, see CHANGELOG