Better Auth 1.7 RC

We've put a lot into Better Auth 1.7. It's a big release, and some of it means migration work. We wanted to support a wider range of login flows, make the system more robust, and ship security fixes that needed structural changes.

Here's what this release brings.

Your app can be the login provider for other apps. If other apps sign in through your app, Better Auth now handles more OAuth and OpenID Connect rules. This includes DPoP tokens, single sign-out, forced re-login, per-API token rules, and safer token checks.

More login providers work. Better Auth now supports login setups that did not work well before: Amazon Cognito, Microsoft Entra ID with certificate login, standard OpenID providers, and school-login providers like Clever.

More secure by default. We hardened flows that were previously unsafe. As security keeps moving to the foreground, we would rather disclose a security gap and fix it quickly than keep it in place for backward compatibility.

Highlights

Better Auth as an identity provider

This is the biggest area of the release. The OAuth provider grows from "it issues tokens" into a standards-based authorization server that other apps can sign in through.

• Protected resources: describe each API behind your login server as its own resource, with its own token lifetime, scopes, and claims. A token is locked to the API it was issued for and can no longer be replayed against another. This replaces the flat validAudiences list.
• DPoP-bound tokens: an access token binds to a key held by the client, so a stolen token is not enough to call the API.
• Single sign-out: OIDC Back-Channel Logout tells every app a user signed into to end its own session when they sign out of your provider.
• Forced re-login: max_age is now honored instead of ignored.
• Consistent introspection: opaque tokens return the same claims as JWTs, and a separate API service can introspect a token issued to another client.
• Protocol-safe ID tokens: custom claims can no longer overwrite reserved protocol claims such as issuer, subject, and audience.
• Self-service and machine clients: a backend registers without a logged-in user using a pre-shared token, and Client ID Metadata Documents (@better-auth/cimd) let a client identify itself by a hosted URL, which is how MCP clients connect without being registered ahead of time. Real MCP clients like Claude and Codex now keep the authentication method they register with, confidential by default rather than forced to public.
• Request specific user details: a client can ask for individual user claims through the standard claims.userinfo parameter, and the request becomes part of the user's consent.
• An extension surface: extendOAuthProvider lets a companion plugin add grant types, client-authentication methods, discovery metadata, and claims without changing core.
• Conformance polish: standard { error, error_description } envelopes, no-store on credential responses, an at_hash claim on ID tokens, form-encoded requests, and a refresh-retry window for native clients.

The old oidcProvider plugin, deprecated in 1.6, is removed. Move OpenID provider setups to @better-auth/oauth-provider.

Connecting to more identity providers

The other half of the OAuth work is about Better Auth as the app receiving a login.

• Generic OAuth is rebuilt on the same path as built-in social providers, with PKCE on by default and automatic issuer validation through discovery. The API you call and the callback URL both change.
• Identity tokens are verified consistently against a provider's published keys, including for mobile and single-page apps. Custom providers move from a verifyIdToken method to an idToken config.
• Granted scopes are preserved across re-login and token refresh instead of being overwritten, and Google's includeGrantedScopes is now configurable (still on by default).
• Google One Tap signs in the account owner by validating the identity token subject, not just the email.
• Per-request login options (additionalParams) unlock Cognito upstream routing, Microsoft Entra ID domain_hint, and offline or incremental Google access. Certificate and signed-assertion login (clientAssertion, tokenEndpointAuth) add Entra ID certificate login and generic private_key_jwt.
• Provider-started login restarts safely with allowIdpInitiated: true, per-provider email verification (requireEmailVerification) withholds the session until the email is verified, and anonymous account linking now works in Expo and other in-app browsers.

New integrations unlocked

These setups were impossible, broken, or unsafe before, and work now.

Logging your users in with an external provider

Other apps logging in through you

Enterprise SSO

Enterprise SSO, SAML, and SCIM

• Rotate SAML certificates without downtime: signing certificates can now be a list, so an administrator publishes a new certificate next to the old one. The management endpoints return the certificate as a list, or omit it when certs live in an idpMetadata document.
• Unsolicited SAML logins are off by default: allowIdpInitiated now defaults to false, so a provider-started login is rejected unless you opt in with allowIdpInitiated: true.
• Simpler SAML configuration: the callback URL is derived automatically, service-provider metadata is generated, several unused fields are removed, and Single Logout ends the session correctly. One endpoint path changes.
• SCIM groups and organization scoping: SCIM gains durable group resources, and every connection is now bound to an organization through a required organizationId, with the old per-user ownership option removed. This needs a migration and one manual reclaim of pre-1.7 connections that have no organization.

Drizzle Relations v2

Drizzle ORM v1 is now in release candidate, bringing its new relations API. Better Auth supports it through a new adapter entry point, so the generated auth relations slot in alongside your app's own relations.

import { betterAuth } from "better-auth/minimal";
import { drizzleAdapter } from "@better-auth/drizzle-adapter/relations-v2"; 
import { db } from "./db";
import * as schema from "./schema";

export const auth = betterAuth({
  database: drizzleAdapter(db, { provider: "pg", schema }),
});

Built-in i18n for 22 languages

@better-auth/i18n ships built-in translations for 22 languages, and the English fallback is fixed. Drop it in to localize Better Auth's user-facing messages without maintaining your own translation table.

Secure by default

• Forwarded proxy headers are not trusted by default: your app reads its own address from the Host header and ignores x-forwarded-* unless you opt in with advanced.trustedProxyHeaders: true. Platforms like nginx, Vercel, Cloudflare, and Netlify usually need no change.
• Atomic state, no more races: "check, then write" database logic is replaced with single atomic operations, so a one-time token cannot be used twice, a team cannot exceed its limit, and a rate limit holds under load. Custom adapters and storage backends gain required methods.
• Electron requires modern PKCE: the Electron flow now requires S256 PKCE and no longer trusts a custom origin header. Upgrade the client and server together.
• Captcha matches full paths: replace a partial path like /sign-in with /sign-in/* or /sign-in/**.
• Stricter custom-scheme origins: a host-bearing trustedOrigins entry like myapp://callback now matches that host exactly and no longer accepts myapp://callback.attacker.tld.
• Passwordless sign-in clears unproven credentials: when an account email was never confirmed, proven mailbox control wins, so an unproven password and any other linked accounts are removed before sign-in.
• A gate for new identities: the new user.validateUserInfo hook can reject an identity before a user is created or an account is linked, across every sign-up method.

Important changes

Breaking changes

Behavior changes

New additions

Deprecations and removals

Migrating to v1.7

Because this release carries large changes, we're shipping it as a release candidate first, so there's a window to migrate. We'll keep watching feedback and release the stable 1.7 from there.

Install it from the rc tag, and do the same for any @better-auth/* packages you use:

npm install better-auth@rc

Then run npx auth generate for any schema changes. The table below shows whether these changes affect you. For the detailed migration guide, see the 1.7 upgrade guide.

What's next?

We're planning Better Auth 1.7 as the last feature release on the v1 line. Once it is stable, v1 moves into maintenance, where security, bug, and compatibility fixes continue while our focus shifts to v2. v1 stays maintained and remains a solid base to build on. v2 is our chance to improve the foundation. We're making it more modular and focused. More soon.

Contributors

Thanks to all the contributors for making this release possible!