@better-auth/oauth-provider

[!IMPORTANT]
Action required

• If you use ID token sign-in with a provider that has no clientId, set clientId to every client ID your apps sign in with.

better-auth

Bug Fixes

• Fixed the JWT plugin to verify JWTs and session cookie-cache JWTs with the stored key's algorithm instead of the token header's, and to warn when signing or verifying a JWT without an issuer or audience

• Fixed OAuth callbacks completed through the OAuth proxy to run the same checks as the standard OAuth callback, including issuer and ID token nonce validation

• Fixed auth.api.getSession() to keep the original database error as error.cause when the session lookup fails

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed mapProfileToUser failing to typecheck under exactOptionalPropertyTypes when it returns undefined for name, email, or image

• Fixed ID token sign-in to reject tokens when the provider has no client ID, since their audience cannot be checked

• Fixed a custom Facebook getUserInfo to no longer receive client-submitted access tokens issued to another Facebook app, and ID tokens missing exp or iat are now rejected

• Restored the Twitch and Paybin ID token handling from before 1.7.11, which made account info fail once the ID token stored at sign-in expired

• Added a cause option as a third argument to APIError.from() to keep the underlying error for server-side callers without exposing it in the response

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

• Fixed requireMcpAuth to accept only OAuth access tokens and reject session JWTs from the JWT plugin, even when they share the issuer and audience

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed OIDC SSO sign-in to reject ID tokens missing exp or iat and providers with an empty client ID, matching social sign-in

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed OpenAPI schemas for /oauth2/consent and /oauth2/continue to match their redirect responses.

• Fixed CIMD metadata refreshes overwriting concurrent administrator changes to discovered clients.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

• Added optional self-service signing key rotation for private_key_jwt clients.

Bug Fixes

• Fixed valid DPoP proofs being rejected for parameterized routes and URLs with trailing slashes.

• Fixed native clients with HTTP loopback callbacks being rejected when application type inference is enabled.

• Fixed device-code clients being unable to refresh access for approved resources omitted from a token poll.

• Fixed OAuth consent without a reference overwriting or reusing consent for a different reference.

• Fixed dynamic client registration rejecting requests that include both supported and unsupported grants.

• Fixed attempts to change cached trusted clients returning HTTP 500 instead of HTTP 400.

• Improved errors for unknown OAuth client_id values to say client not found.

• Fixed PKCE verifier errors to return the specified HTTP 400 response and error code.

• Fixed unknown OAuth clients receiving invalid_grant instead of invalid_client at the token endpoint.

• Fixed unverifiable JWT access tokens causing server errors at /oauth2/userinfo, /oauth2/introspect, and /oauth2/revoke.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Added isContinuation to postLogin.shouldRedirect so users can complete authorization after selecting an organization

• Fixed DPoP validation for token and UserInfo requests behind proxies that rewrite request URLs

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

• Added support for pausing and resuming OAuth clients through adminUpdateOAuthClient

• Added support for linking protected resources when registering a client with adminCreateOAuthClient

• Added resource identifier validation for adminCreateOAuthResource and configured resources

• Added clientId to clientPrivileges checks for actions on existing OAuth clients

Bug Fixes

• Fixed sign-in failures, replay checks, and SIWE email handling with generateId: "uuid"

• Aligned @better-auth/utils and better-call dependency versions across official packages

• Added support for host-bearing custom-scheme redirect URIs for native OAuth clients

• Fixed startup resource-seeding failures from blocking authentication routes until restart

• Fixed type errors when using oauthProvider() or mcp() with exactOptionalPropertyTypes

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

• Added optional validateRedirectUri validation for trusted deployments with dynamic OAuth redirect URIs.

• Added verifyOAuthQueryParams to verify signed authorization queries before rendering a custom consent page.

For detailed changes, see CHANGELOG

better-auth

Features

• Added support for a bannedUserMessage function that receives the banned user, allowing sign-in errors to include details such as the ban reason.

• Added Vercel BotID as a captcha provider for protected authentication routes.

Bug Fixes

• Passwords over maxPasswordLength are now rejected with PASSWORD_TOO_LONG before hashing or verification.

• Fixed React hydration mismatches when session or plugin auth queries resolve before streamed components hydrate.

• Prevented older auth-query responses from overwriting newer results when requests overlap.

• Fixed model identity when a custom model name matches another schema key.

• Fixed schema validation for Cloudflare D1 when the Kysely dialect cannot introspect the database.

• Fixed social account linking through the OAuth Proxy plugin.

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed model identity when a custom model name matches another schema key.

• Fixed schema validation for SQLite-generated primary keys, including INTEGER PRIMARY KEY columns without AUTOINCREMENT.

• Fixed schema validation for Cloudflare D1 when the Kysely dialect cannot introspect the database.

For detailed changes, see CHANGELOG

@better-auth/prisma-adapter

Bug Fixes

• Fixed model identity when a custom model name matches another schema key.

• Fixed schema validation for capitalized custom Prisma model names.

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed model identity when a custom model name matches another schema key.

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed model identity when a custom model name matches another schema key.

For detailed changes, see CHANGELOG

@better-auth/memory-adapter

Bug Fixes

• Fixed model identity when a custom model name matches another schema key.

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

• Fixed model identity when a custom model name matches another schema key.

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

• Fixed automatic seat updates after an organization resubscribes, even when canceled subscriptions remain in its history.

For detailed changes, see CHANGELOG

auth

Features

• Added read-only check and check schema commands to validate your configured adapter schema on demand.

For detailed changes, see CHANGELOG

better-auth

Features

• Added database.schemaName support for direct PostgreSQL connections.

Bug Fixes

• Improved server-side logging for Cloudflare Turnstile verification failures.

• Fixed PostgreSQL migrations incorrectly identifying tables and views across schemas.

• Fixed MySQL index validation for existing string columns.

• Removed the unused optional better-sqlite3 peer dependency to prevent installation conflicts.

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added database.schemaName support for direct PostgreSQL connections.

Bug Fixes

• Fixed database option type inference outside Cloudflare Workers.

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

• Fixed unnecessary pacing of consecutive CIMD OAuth requests when metadata cannot be cached.

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed lazy database initialization when using Drizzle relations.

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Features

• Added database.schemaName support for direct PostgreSQL connections.

For detailed changes, see CHANGELOG

better-auth

Features

• Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance.

• Added support for additional session fields in testUtils auth helpers.

• Added Vitest 5 support to the testing utilities.

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance.

Bug Fixes

• Fixed Metro bundling when the optional OpenTelemetry API is not installed.

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed multibyte session data storage in Expo SecureStore.

• Fixed stale Expo secure-storage session data and corrupted cookies during concurrent updates.

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Improved schema validation for the Drizzle Relations v2 adapter.

For detailed changes, see CHANGELOG

@better-auth/test-utils

Features

• Added Vitest 5 support to the testing utilities.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Allowed native OAuth clients using localhost loopback redirects to use ephemeral callback ports.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server.

• Improved validation of relative callback and redirect URLs with paths, queries, and fragments.

• Fixed relative redirect URLs containing fragments.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed scope error responses so MCP clients now receive a 403 with an RFC 6750 insufficient_scope WWW-Authenticate challenge naming every missing scope, allowing clients to request all needed scopes in a single authorization request.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Breaking Changes

• breaking

  Moved the MCP plugin into its own @better-auth/mcp package built on the OAuth provider

  Migration: Install @better-auth/mcp and @better-auth/cimd, add the now-required jwt() plugin, and move options nested under oidcConfig to flat mcp({ ... }) options. Rename withMcpAuth to requireMcpAuth and mcpHandler to createMcpProtectedRequestHandler. Regenerate the schema (npx auth migrate): oauthApplication becomes oauthClient, plus new oauthRefreshToken and oauthClientAssertion tables.

• breaking

  Added OIDC back-channel logout so ending a session cuts off every connected app's API access

  Migration: Introspecting an access token whose session has ended now returns { active: false }, and /oauth2/userinfo rejects it. Clients opt into notifications by registering backchannel_logout_uri. Run the schema migration for the new oauthClient and oauthAccessToken columns.

• breaking

  Aligned OAuth client registration and metadata with MCP authorization 2026-07-28

  Migration: Add applicationType and nullable clientDiscoveryId columns, deduplicate existing (clientId, resourceId) links before the new compound unique index, then drop the legacy type and public columns. Replace clientCredentialGrantDefaultScopes with per-client clientCredentialsScopes, backfilling every client to `` and reassigning approved machine scopes after an audit. mcp() no longer enables unauthenticated DCR: compose it with cimd() or enable both DCR flags explicitly.

• breaking

  Enforced the max_age authorization request parameter

  Migration: Users who authenticated longer ago than the requested max_age are now sent back to log in, and the ID token's auth_time reflects the fresh login. Flows that relied on max_age being ignored will prompt again.

• breaking

  Made ID token claim authority explicit, reserving OIDC protocol claims for the provider

  Migration: customIdTokenClaims, extension claims, and per-issuance idTokenClaims can no longer set protocol claims such as issuer, subject, audience, nonce, auth_time, acr, amr, or azp; use namespaced custom claims instead. ID tokens now carry acr: "0" and discovery advertises only "0".

• breaking

  Modeled OAuth protected resources explicitly, with per-resource TTLs, scopes, claims, and signing pins

  Migration: validAudiences is removed: move each resource identifier into resources and link restricted clients through oauthClientResource. @better-auth/mcp now requires an explicit resource. Run npx @better-auth/cli generate and apply the migration before deploying.

• breaking

  Bound OAuth client authentication to the grant being issued

  Migration: Remove grantType from provider.authenticateClient(...), and return { clientId, confirmation? } from a custom OAuthClientAuthenticationStrategy.authenticate instead of a client record.

• breaking

  Bound RFC 8707 resource indicators to the authorization grant

  Migration: Token and refresh requests may only narrow the authorization's resource; a broader request returns invalid_target. customAccessTokenClaims now receives a resources array in place of the resource string. Run the schema migration to add the new resource columns.

• breaking

  Returned RFC-compliant OAuth error envelopes from validation failures

  Migration: Authorization errors now redirect to a registered client's trusted redirect URI with state and iss instead of rendering the server error page, and confidential clients must use their registered token_endpoint_auth_method.

• breaking

  Rewrote the generic OAuth plugin as a first-class social provider with OAuth 2.1 defaults

  Migration: Replace signIn.oauth2({ providerId }) with signIn.social({ provider }), oauth2.link() with linkSocial(), and drop genericOAuthClient(). Callbacks move to /api/auth/callback/:id, pkce now defaults to true, and issuer and requireIssuerValidation are removed in favor of OIDC discovery.

• breaking

  Separated OAuth device grant ownership into oauthDeviceAuthorization()

  Migration: The OAuth integration replaces the optional resource column with oauthClientId and resources, so regenerate and apply the schema. Let pending device codes expire before upgrading from an earlier 1.7 prerelease.

Features

• Added token endpoint client authentication configuration across the OAuth stack

• Added the @better-auth/cimd Client ID Metadata Document plugin

• Added the OAuth device authorization grant (RFC 8628)

• Added DPoP sender-constrained access tokens (RFC 9449)

• Added an extension surface for registering grants, client authentication methods, discovery metadata, and claim contributors

• Added a refresh token reuse interval that replays the same response for duplicate refresh requests

• Allowed confidential DCR clients to complete authorization-code flows without PKCE

• Added the at_hash claim to ID tokens issued alongside an access token, per OIDC Core §3.1.3.6

• Made token introspection consistent across opaque and JWT tokens and scoped it to the audience

• Exposed the issuing sessionId to id_token claim contributors

• Honored requested UserInfo claims through a claim registry

• removed

  Removed the silenceWarnings option and the well-known endpoint warnings it suppressed

• Added protected dynamic client registration using RFC 7591 initial access tokens

• Added private_key_jwt client authentication for token endpoint requests (RFC 7523)

• Sent Cache-Control: no-store on every OAuth response that carries credentials

• Added a server-trusted OAuth state channel, fixing anonymous account linking in in-app browsers

Bug Fixes

• Enforced RFC 8628 request cardinality and client authentication on the device flow endpoints

• Accepted the OpenID Provider issuer as the aud of private_key_jwt client assertions

• Accepted UserInfo bearer tokens sent in a form-encoded request body

• Allowed nonce-bound confidential clients to request offline_access without PKCE

• Returned a 401 invalid_token challenge from /oauth2/userinfo for invalid tokens

• Completed the RP-initiated logout flow with form-encoded POST support and confirmation pages

• Deferred token revocation and back-channel logout delivery until the session deletion commits

• Accepted form-encoded POST authorization requests and rejected unsupported OIDC request objects

• Handled voluntary and essential acr claim requests per OIDC Core

• Kept profile and email scope claims on the UserInfo response instead of ID tokens

• Made the private_key_jwt jti single-use atomic across processes

• Made redirect_uri conditional at the token endpoint, required only when the authorization included one

• Preserved client key metadata and the requested authentication method during dynamic client registration

• Redirected authorization requests missing response_type to the verified client redirect URI

• Rejected authorization code replay with invalid_grant and revoked tokens issued from that code

• Reported unsupported_token_type when revoking a JWT access token

• Required the openid scope for authorization requests that use the claims parameter

• Returned invalid_grant when a client presents a refresh token issued to another client

• MCP clients that hit a scope wall now learn exactly which scopes to ask for: missing protected scopes produce a 403 with an RFC 6750 insufficient_scope challenge naming every one of them, so clients can request them in a single authorization redirect.

• Single-sourced HTTP Basic credential encoding and decoding for OAuth client authentication

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed database option type inference for projects that do not use Cloudflare Workers.

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Improved diagnostics for Cloudflare Turnstile verification failures

For detailed changes, see CHANGELOG

better-auth

Features

• Added an option to disable OpenTelemetry span creation for individual auth instances

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added an option to disable OpenTelemetry span creation for individual auth instances

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Fixed concurrent cold-start requests from intermittently losing authentication or transaction context due to an async storage initialization race

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed automatic organization assignment via email domain to require both a verified provider domain and a verified stored user email, preventing social sign-in from joining an organization whose SSO provider merely claims that domain.

• Fixed domain verification to snapshot the provider's domains at request start, returning 409 with SSO_PROVIDER_CHANGED if the provider changes during DNS resolution so callers can reload and retry.

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Improved deleteSessions performance by running deletes in parallel instead of sequentially

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed automatic email-domain organization assignment to require both a verified provider domain and a verified user email, preventing social sign-in from granting access when an SSO provider merely claims a domain.

• Fixed domain verification to snapshot the provider's domains at request start, returning 409 with SSO_PROVIDER_CHANGED if the provider changes during DNS verification so callers can reload and retry.

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Prevented duplicate session requests during React Suspense retries while preserving revalidation for interrupted refreshes

• Restored client plugin declaration compatibility for downstream TypeScript consumers

For detailed changes, see the CHANGELOG.

@better-auth/electron

Bug Fixes

• Restored client plugin declaration compatibility for downstream TypeScript consumers

For detailed changes, see the CHANGELOG.

@better-auth/expo

Bug Fixes

• Restored client plugin declaration compatibility for downstream TypeScript consumers

For detailed changes, see the CHANGELOG.

better-auth

Bug Fixes

• Fixed duplicate session requests being made across Suspense retries

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Fixed auth endpoint types to align with better-call

For detailed changes, see CHANGELOG

auth

Bug Fixes

• Fixed the CLI to align installed packages with the running CLI version

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Fixed session cleanup on user deletion to also remove sessions from secondary storage

• Fixed findSessions to skip invalid secondary-storage session entries without discarding other valid sessions

• Fixed email OTP sign-up to pass the verification type to custom OTP generators

• Fixed email OTP password reset to allow retrying after entering an invalid password

• Fixed email OTP verification to no longer reveal whether an email is registered before the OTP is verified

• Fixed jwtClient() collapsing createAuthClient type inference when combined with other client plugins

• Fixed JWT key minting inside database transactions to use the transaction-scoped adapter, preventing deadlocks on SQLite and ensuring keys commit with their surrounding transaction on Postgres and MySQL

• Fixed oAuthProxy to preserve Apple user data from form_post callbacks

• Fixed oneTapClient() collapsing createAuthClient type inference when combined with other client plugins

• Fixed database rate-limit cleanup to complete when no background task handler is configured

• Improved nextCookies performance in instrumented Next.js applications by reusing the next/headers import promise

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added a utility for creating stable, namespaced placeholder emails on the reserved placeholder.invalid domain

For detailed changes, see CHANGELOG

@better-auth/redis-storage

Bug Fixes

• Fixed listKeys() and clear() to use SCAN instead of KEYS so large keyspaces no longer block the Redis server

For detailed changes, see CHANGELOG