@better-auth/mcp

@better-auth/mcp

Bug Fixes

• Fixed requireMcpAuth to accept only OAuth access tokens and reject session JWTs from the JWT plugin, even when they share the issuer and audience

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Fixed repeated PostgreSQL migration diffs for int8 columns.

• Fixed database-backed rate limiting returning an excessively large X-Retry-After value.

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed plugin init returns with options: undefined failing type checks under exactOptionalPropertyTypes.

• Fixed ID token signature and claim validation for Twitch and Paybin sign-in. Custom Paybin issuers must publish RS256 signing keys at <issuer>/.well-known/jwks.json.

• Reduced installation size while preserving OpenTelemetry instrumentation attributes.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed OpenAPI schemas for /oauth2/consent and /oauth2/continue to match their redirect responses.

• Fixed CIMD metadata refreshes overwriting concurrent administrator changes to discovered clients.

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed Expo social account linking with ID tokens when a session cookie is present.

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Fixed Captcha and OpenAPI plugin subpath imports and type resolution for better-auth/plugins/multi-session and better-auth/test.

• Fixed Google One Tap sign-ins not recording google as the last login method.

• Fixed imports from better-auth/plugins/one-tap failing with a not-exported error.

• Fixed Google One Tap ignoring plugin-level autoSelect and cancelOnTapOutside settings.

• Fixed Google One Tap sign-ins ignoring configured Google profile mapping and user info updates.

• Fixed Google One Tap calling a prompt method unsupported by FedCM and retrying skipped prompts.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

• Added optional self-service signing key rotation for private_key_jwt clients.

Bug Fixes

• Fixed valid DPoP proofs being rejected for parameterized routes and URLs with trailing slashes.

• Fixed native clients with HTTP loopback callbacks being rejected when application type inference is enabled.

• Fixed device-code clients being unable to refresh access for approved resources omitted from a token poll.

• Fixed OAuth consent without a reference overwriting or reusing consent for a different reference.

• Fixed dynamic client registration rejecting requests that include both supported and unsupported grants.

• Fixed attempts to change cached trusted clients returning HTTP 500 instead of HTTP 400.

• Improved errors for unknown OAuth client_id values to say client not found.

• Fixed PKCE verifier errors to return the specified HTTP 400 response and error code.

• Fixed unknown OAuth clients receiving invalid_grant instead of invalid_client at the token endpoint.

• Fixed unverifiable JWT access tokens causing server errors at /oauth2/userinfo, /oauth2/introspect, and /oauth2/revoke.

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Limited JWKS refetches for unknown key IDs to protect servers from repeated requests.

• Fixed unreachable JWKS endpoints being reported as invalid tokens instead of server errors.

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

• Fixed MongoDB findMany ignoring ID sorting and potentially repeating or skipping paginated results.

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Fixed onAPIError.onError handlers to finish before responses are sent and log failures without interrupting requests

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Added isContinuation to postLogin.shouldRedirect so users can complete authorization after selecting an organization

• Fixed DPoP validation for token and UserInfo requests behind proxies that rewrite request URLs

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

• Fixed @better-auth/mcp type errors with exactOptionalPropertyTypes and skipLibCheck: false

• Fixed type errors when using oauthProvider() or mcp() with exactOptionalPropertyTypes

For detailed changes, see CHANGELOG

better-auth

Magic Link upgrade: Upgrade servers sharing verification storage together, request new Magic Links, and restart pending OAuth/SAML sign-ins. No database migration is required. See the critical advisory for affected configurations and custom storage changes.

Bug Fixes

• security

  Fixed a critical Magic Link account-takeover vulnerability.

• Fixed ID-token sign-in ignoring the social provider’s disableSignUp setting.

• Fixed OAuth Proxy accepting sign-in state as a provider profile.
  Upgrade all OAuth Proxy participants together; see the OAuth Proxy upgrade guidance.

• Fixed CAPTCHA errors missing the JSON Content-Type header.

• Fixed the active organization failing to refresh after sign-in when a session hook selects the initial organization.

• Fixed rate-limit errors missing the JSON Content-Type header.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

• Added optional validateRedirectUri validation for trusted deployments with dynamic OAuth redirect URIs.

• Added verifyOAuthQueryParams to verify signed authorization queries before rendering a custom consent page.

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed concurrent PostgreSQL requests exceeding database-backed rate limits.

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed consumeOne deleting a record after a concurrent write invalidates its original condition.

For detailed changes, see CHANGELOG

better-auth

Features

• Added support for a bannedUserMessage function that receives the banned user, allowing sign-in errors to include details such as the ban reason.

• Added Vercel BotID as a captcha provider for protected authentication routes.

Bug Fixes

• Passwords over maxPasswordLength are now rejected with PASSWORD_TOO_LONG before hashing or verification.

• Fixed React hydration mismatches when session or plugin auth queries resolve before streamed components hydrate.

• Prevented older auth-query responses from overwriting newer results when requests overlap.

• Fixed model identity when a custom model name matches another schema key.

• Fixed schema validation for Cloudflare D1 when the Kysely dialect cannot introspect the database.

• Fixed social account linking through the OAuth Proxy plugin.

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed model identity when a custom model name matches another schema key.

• Fixed schema validation for SQLite-generated primary keys, including INTEGER PRIMARY KEY columns without AUTOINCREMENT.

• Fixed schema validation for Cloudflare D1 when the Kysely dialect cannot introspect the database.

For detailed changes, see CHANGELOG

@better-auth/prisma-adapter

Bug Fixes

• Fixed model identity when a custom model name matches another schema key.

• Fixed schema validation for capitalized custom Prisma model names.

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed model identity when a custom model name matches another schema key.

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed model identity when a custom model name matches another schema key.

For detailed changes, see CHANGELOG

@better-auth/memory-adapter

Bug Fixes

• Fixed model identity when a custom model name matches another schema key.

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

• Fixed model identity when a custom model name matches another schema key.

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

• Fixed automatic seat updates after an organization resubscribes, even when canceled subscriptions remain in its history.

For detailed changes, see CHANGELOG

auth

Features

• Added read-only check and check schema commands to validate your configured adapter schema on demand.

For detailed changes, see CHANGELOG

better-auth

Features

• Added database.schemaName support for direct PostgreSQL connections.

Bug Fixes

• Improved server-side logging for Cloudflare Turnstile verification failures.

• Fixed PostgreSQL migrations incorrectly identifying tables and views across schemas.

• Fixed MySQL index validation for existing string columns.

• Removed the unused optional better-sqlite3 peer dependency to prevent installation conflicts.

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added database.schemaName support for direct PostgreSQL connections.

Bug Fixes

• Fixed database option type inference outside Cloudflare Workers.

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

• Fixed unnecessary pacing of consecutive CIMD OAuth requests when metadata cannot be cached.

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed lazy database initialization when using Drizzle relations.

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Features

• Added database.schemaName support for direct PostgreSQL connections.

For detailed changes, see CHANGELOG

better-auth

Features

• Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance.

• Added support for additional session fields in testUtils auth helpers.

• Added Vitest 5 support to the testing utilities.

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance.

Bug Fixes

• Fixed Metro bundling when the optional OpenTelemetry API is not installed.

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed multibyte session data storage in Expo SecureStore.

• Fixed stale Expo secure-storage session data and corrupted cookies during concurrent updates.

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Improved schema validation for the Drizzle Relations v2 adapter.

For detailed changes, see CHANGELOG

@better-auth/test-utils

Features

• Added Vitest 5 support to the testing utilities.

For detailed changes, see CHANGELOG

Upgrading from 1.7.0–1.7.2:

We restored the 1.6 account core schema to avoid requiring a disruptive backfill for existing users. We recognize the cost to users who already migrated and are committed to keeping the core schema stable throughout v1.

If you applied the 1.7 issuer schema, follow the upgrade guide for the required cleanup. No backfill is needed.

better-auth

Features

• Added Cloudflare as a built-in social provider with client-secret and PKCE support.

• Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches.

• Added isPasswordCompromised for checking passwords against Have I Been Pwned in custom server-side flows.

Bug Fixes

• Aligned generated OpenAPI required fields with runtime validation.

• Handled malformed custom-scheme callback URLs without excessive processing.

• Improved Auth0 domain normalization to avoid slow trailing-slash processing.

• Prevented generic OAuth discovery failures from taking down the authentication API.

• Tracked email OTP sign-ins in the last login method plugin.

• deprecated

  Fixed callback hooks being skipped after proxied OAuth sign-ins and preserved server state when callback cookies are unavailable. The legacy /oauth-proxy-callback endpoint is deprecated and will be removed in the next minor release.

• Fixed getSession failures when cookie caching is disabled and cached session cookies remain.

• Fixed TOTP re-enrollment replacing an active authenticator and its backup codes.

• Prevented duplicate session requests and hydration mismatches in Nuxt useFetch.

• Improved dynamic organization role permission check performance.

• Added type-safe Nuxt useFetch integration for the Vue client's useSession hook.

• Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer.

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added Cloudflare as a built-in social provider with client-secret and PKCE support.

• Added initialization-time schema validation and actionable mismatch guidance for Drizzle and Prisma adapters.

• Enabled schema validation during initialization by default, including in production, and rejected authentication requests on detected mismatches.

• Added custom token endpoint authentication strategies for providers with non-standard request parameters.

Bug Fixes

• Restored optional consumeOne and incrementOne methods for custom database adapters.

• Fixed TikTok sign-in and token refresh with the documented clientKey and clientSecret options.

• Improved request IP validation performance.

• Improved PayPal authorization code and refresh token requests, including PKCE handling.

• Improved Reddit token requests with OAuth-compliant Basic authentication and redirect protection.

• Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer.

For detailed changes, see CHANGELOG

auth

Features

• Added Cloudflare as a built-in social provider with client-secret and PKCE support.

• Added diagnostics in auth generate for required fields in existing Prisma schemas that Better Auth never writes.

• Added Codex as a supported target for configuring the Better Auth documentation MCP server.

• Added schema diagnostics to auth migrate and auth generate, blocking migrations when required columns that Better Auth never writes need manual repair.

Bug Fixes

• Updated auth info to report installed dependency versions instead of declared specifiers.

• Allowed auth init to complete when generated setup groups have no dependencies.

• Skipped unsupported dependency specifiers during auth upgrade with a clear warning.

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Features

• Added initialization-time schema validation and actionable mismatch guidance for Drizzle and Prisma adapters.

For detailed changes, see CHANGELOG

@better-auth/test-utils

Bug Fixes

• Improved adapter test suite performance by avoiding redundant cleanup queries.

• Updated adapter test suites to remove issuer-specific account requirements.

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

• Fixed CIMD client metadata discovery failures with ERR_INVALID_IP_ADDRESS on supported Node.js versions.

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Prevented Expo apps from sending unauthenticated requests during interrupted cookie storage updates.

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Features

• Enabled database schema validation by default and rejected authentication requests when the live schema does not match.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Allowed native OAuth clients using localhost loopback redirects to use ephemeral callback ports.

For detailed changes, see CHANGELOG

@better-auth/prisma-adapter

Features

• Added initialization-time schema validation and actionable mismatch guidance for Drizzle and Prisma adapters.

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer.

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Fixed permanent user bans to clear expiration dates from previous temporary bans.

• Fixed client types with more plugins being assignable to types declaring fewer plugins.

• Added warnings for invalid signed session data in the cookie cache.

• Fixed disabled MyISAM indexes from satisfying migration index checks.

• Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation.

• Allowed ~ in relative callback URLs validated by trusted-origin checks.

• Improved validation of relative callback and redirect URLs with paths, queries, and fragments.

• Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins.

• Improved getTestInstance performance with a faster default password hasher.

• Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format.

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions.

• Fixed auth request logs to respect the configured logger, log level, and disabled setting.

• Improved validation of relative callback and redirect URLs with paths, queries, and fragments.

• Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format.

• Added synchronous and optional access to the current auth endpoint context.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server.

• Improved validation of relative callback and redirect URLs with paths, queries, and fragments.

• Fixed relative redirect URLs containing fragments.

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed one-to-one Drizzle relations when usePlural is enabled.

• Added validation for missing Drizzle schema fields in compound where clauses.

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation.

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Improved validation of relative callback and redirect URLs with paths, queries, and fragments.

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Added native database transaction support to test instances for PostgreSQL and MySQL.

• Updated bundled dependencies (jose, nanostores, noble crypto packages, SimpleWebAuthn) to their latest compatible releases, with no changes required to existing projects.

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Fixed case-insensitive parsing of string Boolean values for SCIM User active and the primary sub-attribute of emails, phoneNumbers, addresses, roles, and entitlements at the HTTP ingress, improving Microsoft Entra interoperability.

• Added an optional SCIM-owned connection and credential catalog: configure managedConnections to allow trusted server code to create runtime tenant connections and issue, rotate, and revoke bearer credentials through server-only auth.api methods, without a code-defined connection or an application-owned verifier.

• Fixed an issue where trusted server code could not retain a terminal connection binding before a dynamic SCIM connection's first authenticated request when supplying a provisioning domain during decommissioning.

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed SSO provider registration to allow reusing a SCIM connection ID, as SCIM connections no longer participate in the authentication provider namespace.

• Fixed SAML assertion signature verification to validate signatures on the raw assertion instead of trusting an already-parsed response, and enforced signing policy and size limits on SP metadata. wantAssertionsSigned now correctly controls whether the SP requires signed assertions, matching real-world IdP signing behavior.

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

• Fixed Client ID Metadata Document caching to follow shared-cache freshness rules: the plugin now prefers s-maxage over max-age and Expires, honors s-maxage=0, conditionally revalidates with ETag or Last-Modified, and treats invalid or duplicate freshness directives as immediately stale. Concurrent refreshes now converge on a single client-resource link instead of failing on a unique constraint.

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed native adapter transactions for raw database instances (better-sqlite3, node:sqlite, bun:sqlite, mysql2, pg) passed directly as database, matching the behavior of the explicit { db }/{ dialect } config shapes. Plugins requiring native transactions (such as @better-auth/scim) now work correctly when using the quickstart database: new Database(...) form.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed scope error responses so MCP clients now receive a 403 with an RFC 6750 insufficient_scope WWW-Authenticate challenge naming every missing scope, allowing clients to request all needed scopes in a single authorization request.

For detailed changes, see CHANGELOG

auth

Bug Fixes

• Fixed the CLI to refuse adding required columns without default values to already-populated tables

For detailed changes, see CHANGELOG

@better-auth/mcp

Breaking Changes

• breaking

  Moved the MCP plugin into its own @better-auth/mcp package built on the OAuth provider

  Migration: Install @better-auth/mcp and @better-auth/cimd, add the now-required jwt() plugin, and move options nested under oidcConfig to flat mcp({ ... }) options. Rename withMcpAuth to requireMcpAuth and mcpHandler to createMcpProtectedRequestHandler. Regenerate the schema (npx auth migrate): oauthApplication becomes oauthClient, plus new oauthRefreshToken and oauthClientAssertion tables.

• breaking

  Aligned OAuth client registration and metadata with MCP authorization 2026-07-28

  Migration: Add applicationType and nullable clientDiscoveryId columns, deduplicate existing (clientId, resourceId) links before the new compound unique index, then drop the legacy type and public columns. Replace clientCredentialGrantDefaultScopes with per-client clientCredentialsScopes, backfilling every client to `` and reassigning approved machine scopes after an audit. mcp() no longer enables unauthenticated DCR: compose it with cimd() or enable both DCR flags explicitly.

• breaking

  Modeled OAuth protected resources explicitly, with per-resource TTLs, scopes, claims, and signing pins

  Migration: mcp() now requires an explicit resource identifier, for example resource: "https://api.example.com/mcp". validAudiences is removed: move each resource identifier into resources. Run npx @better-auth/cli generate and apply the migration before deploying.

Features

• Added DPoP sender-constrained access tokens (RFC 9449)

• Added a refresh token reuse interval that replays the same response for duplicate refresh requests

For detailed changes, see CHANGELOG