better-auth

Bug Fixes

• Added native database transaction support to test instances for PostgreSQL and MySQL.
• Updated bundled dependencies (jose, nanostores, noble crypto packages, SimpleWebAuthn) to their latest compatible releases, with no changes required to existing projects.

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Fixed case-insensitive parsing of string Boolean values for SCIM User active and the primary sub-attribute of emails, phoneNumbers, addresses, roles, and entitlements at the HTTP ingress, improving Microsoft Entra interoperability.
• Added an optional SCIM-owned connection and credential catalog: configure managedConnections to allow trusted server code to create runtime tenant connections and issue, rotate, and revoke bearer credentials through server-only auth.api methods, without a code-defined connection or an application-owned verifier.
• Fixed an issue where trusted server code could not retain a terminal connection binding before a dynamic SCIM connection's first authenticated request when supplying a provisioning domain during decommissioning.

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed SSO provider registration to allow reusing a SCIM connection ID, as SCIM connections no longer participate in the authentication provider namespace.
• Fixed SAML assertion signature verification to validate signatures on the raw assertion instead of trusting an already-parsed response, and enforced signing policy and size limits on SP metadata. wantAssertionsSigned now correctly controls whether the SP requires signed assertions, matching real-world IdP signing behavior.

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

• Fixed Client ID Metadata Document caching to follow shared-cache freshness rules: the plugin now prefers s-maxage over max-age and Expires, honors s-maxage=0, conditionally revalidates with ETag or Last-Modified, and treats invalid or duplicate freshness directives as immediately stale. Concurrent refreshes now converge on a single client-resource link instead of failing on a unique constraint.

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed native adapter transactions for raw database instances (better-sqlite3, node:sqlite, bun:sqlite, mysql2, pg) passed directly as database, matching the behavior of the explicit { db }/{ dialect } config shapes. Plugins requiring native transactions (such as @better-auth/scim) now work correctly when using the quickstart database: new Database(...) form.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed scope error responses so MCP clients now receive a 403 with an RFC 6750 insufficient_scope WWW-Authenticate challenge naming every missing scope, allowing clients to request all needed scopes in a single authorization request.

For detailed changes, see CHANGELOG

auth

Bug Fixes

• Fixed the CLI to refuse adding required columns without default values to already-populated tables (#10863)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.7.0...v1.7.1

Blog post: Better Auth 1.7

better-auth

❗ Breaking Changes

• Moved database joins out of experimental into the stable advanced.database.joins option (#10359)

  Migration: Replace experimental: { joins: true } with advanced: { database: { joins: true } }. Drizzle and Prisma users should regenerate their schema (npx auth@latest generate) so it includes the required relations.

• Scoped account identity by trusted issuer, keying accounts on (issuer, accountId) (#10403)

  Migration: Accounts now require Account.issuer. Read provider identity from accountInfo.account.accountId, drop mapping.id from SSO configs, and give the microsoftEntraId helper a concrete tenant GUID. Apply the account-identity backfill in the 1.7 upgrade guide before deploying.

• Required captcha endpoint entries to match full auth paths, with wildcard support (#10004)

  Migration: Replace partial paths such as /sign-in with explicit wildcards like /sign-in/* or /sign-in/**.

• Moved the MCP plugin into its own @better-auth/mcp package built on the OAuth provider (#9992)

  Migration: Install @better-auth/mcp and @better-auth/cimd, add the now-required jwt() plugin, and move options nested under oidcConfig to flat mcp({ ... }) options. Rename withMcpAuth to requireMcpAuth and mcpHandler to createMcpProtectedRequestHandler. Regenerate the schema (npx auth migrate): oauthApplication becomes oauthClient, plus new oauthRefreshToken and oauthClientAssertion tables.

• Added OIDC back-channel logout so ending a session cuts off every connected app's API access (#9304)

  Migration: Introspecting an access token whose session has ended now returns { active: false }, and /oauth2/userinfo rejects it. Clients opt into notifications by registering backchannel_logout_uri. Run the schema migration for the new oauthClient and oauthAccessToken columns.

• Modeled OAuth protected resources explicitly, with per-resource TTLs, scopes, claims, and signing pins (#9648)

  Migration: validAudiences is removed: move each resource identifier into resources and link restricted clients through oauthClientResource. @better-auth/mcp now requires an explicit resource. Run npx @better-auth/cli generate and apply the migration before deploying.

• Decoupled SCIM provisioning from the organization plugin (#10390)

  Migration: SCIM configuration, client APIs, database schema, and the Group model are all replaced, and provisioning state cannot migrate in place. Follow the SCIM cutover in the 1.7 upgrade guide, including a full directory reprovision, before resuming traffic.

• Added OTP-only two-factor enablement with a discriminated enableTwoFactor response (#9057)

  Migration: enableTwoFactor now returns a method field ("otp" or "totp"); narrow on it before reading totpURI and backupCodes. Pass method: "otp" for OTP enrollment, which requires otpOptions.sendOTP.

• Resolved the auth origin from Host by default when using a dynamic baseURL (#9134)

  Migration: If your proxy exposes the public hostname only through x-forwarded-host, set advanced.trustedProxyHeaders: true. Deployments where the proxy rewrites Host (nginx default, Vercel, Cloudflare, Netlify) are unaffected.

• Added unique lookup indexes for the device authorization deviceCode and userCode columns (#10059)

  Migration: Resolve duplicate code values before applying the migration. MySQL and SQL Server installations must also convert both columns to bounded strings and clean up values longer than 191 characters.

• Enforced S256 PKCE in the Electron sign-in flow and hardened custom-scheme origin checks (#9645)

  Migration: Upgrade the @better-auth/electron client and server together and add your app's scheme to trustedOrigins. The code_challenge_method parameter and disableOriginOverride option are removed, and host-bearing custom-scheme entries now match that host exactly.

• Identified Microsoft Entra accounts by the stable oid claim (#10204)

  Migration: Migrate existing Microsoft account rows created from sub before upgrading. Tokens without a valid oid are rejected.

• Required a Google client ID before Google One Tap verifies ID tokens (#10036)

  Migration: Configure oneTap({ clientId }) or socialProviders.google.clientId.

• Removed the deprecated oidcProvider plugin (#10031)

  Migration: Move OIDC authorization-server integrations to @better-auth/oauth-provider.

• Rewrote the generic OAuth plugin as a first-class social provider with OAuth 2.1 defaults (#9069)

  Migration: Replace signIn.oauth2({ providerId }) with signIn.social({ provider }), oauth2.link() with linkSocial(), and drop genericOAuthClient(). Callbacks move to /api/auth/callback/:id, pkce now defaults to true, and issuer and requireIssuerValidation are removed in favor of OIDC discovery.

• Separated OAuth device grant ownership into oauthDeviceAuthorization() (#10746)

  Migration: The OAuth integration replaces the optional resource column with oauthClientId and resources, so regenerate and apply the schema. Let pending device codes expire before upgrading from an earlier 1.7 prerelease.

• Verified provider id_tokens with a single shared verifier (#9828)

  Migration: Custom UpstreamProvider implementations replace the removed verifyIdToken method with an idToken config carrying a JWKS source, issuer, and audience. PayPal client id_token sign-in now returns ID_TOKEN_NOT_SUPPORTED; its redirect flow is unchanged.

Features

• Added clientAssertion support to the Microsoft Entra ID social provider (#9898)
• Made the Auth instance directly fetchable (#9431)
• Added per-provider requireEmailVerification for social sign-in (#9929)
• Added a user.validateUserInfo gate for rejecting an identity before a user is created or linked (#9864)
• Added hydrateSession so useSession returns server-fetched data on the first render (#8733)
• Added compound table indexes to plugin database schemas (#10402)
• Added allowIdpInitiated support for IdP-initiated flows through a secure server-side bounce (#9301)
• Added RP-initiated logout so signOut() can also sign users out of the OpenID provider (#9368)
• Added refreshTokenParams for forwarding extra parameters on generic OAuth token refresh (#9948)
• Verified discovery id_tokens against the provider JWKS and enabled id_token sign-in for generic OAuth (#9966)
• Added the OAuth device authorization grant (RFC 8628) (#10135)
• Added DPoP sender-constrained access tokens (RFC 9449) (#10039)
• Added the at_hash claim to ID tokens issued alongside an access token, per OIDC Core §3.1.3.6 (#9079)
• Added private_key_jwt client authentication for token endpoint requests (RFC 7523) (#8836)
• Sent Cache-Control: no-store on every OAuth response that carries credentials (#10065)
• Added per-request additionalParams and loginHint across signIn.social, linkSocial, and signIn.sso (#9305)
• Added a server-trusted OAuth state channel, fixing anonymous account linking in in-app browsers (#9930)
• Allowed passing userId and organizationId to the listUserTeams API (#8977)
• Added organization.getOrganization() for metadata-only fetches (#10397)
• Added a server-only consumePhoneNumberOTP API for custom phone OTP flows (#9766)
• Added JWKS-backed asymmetric JWTs for the session cookie cache (#8931)
• Added transactional OIDC user resolution for SSO sign-ins (#10473)
• Added an immutable username option (#9240)
• Allowed omitting the username plugin's separate displayUsername field (#10330)

Bug Fixes

• Allowed test instances to enable native database transactions for PostgreSQL and MySQL.
• Refreshed bundled dependencies (jose, nanostores, the noble crypto packages, and SimpleWebAuthn) to their latest compatible releases. These updates are backward compatible and require no changes to existing projects.
• Widened the drizzle-kit peer dependency range (#10299)
• Decoupled the session cookie cache from JWT plugin internals (#10666)
• Allowed auth migrate to add required columns with static defaults and nullable unique columns to existing tables (#10293)
• Bound the ID token nonce to the authorization request in the generic OAuth redirect flow (#10095)
• Fixed a sign-up deadlock when JWT cookie caching ran on a single-connection SQLite database with native transactions (#10622)
• Created new OAuth accounts inside the user creation transaction (#10125)
• Derived the OAuth redirect_uri from the per-request base URL in multi-host deployments (#10127)
• Preserved previously granted account.scope values across re-authentication and token refresh (#10128)
• Preserved the resolved OAuth user when overrideUserInfo returns null (#10124)
• Fired session-delete hooks and revoked bound OAuth tokens for preserved sessions on secondaryStorage (#9969)
• Issued SIWE nonces before the wallet address and chain ID are known (#10234)
• Fixed client plugin composition so One Tap, Electron, and Expo type-check with createAuthClient (#10505)
• Single-sourced HTTP Basic credential encoding and decoding for OAuth client authentication (#9657)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

❗ Breaking Changes

• Moved the MCP plugin into its own @better-auth/mcp package built on the OAuth provider (#9992)

  Migration: Install @better-auth/mcp and @better-auth/cimd, add the now-required jwt() plugin, and move options nested under oidcConfig to flat mcp({ ... }) options. Rename withMcpAuth to requireMcpAuth and mcpHandler to createMcpProtectedRequestHandler. Regenerate the schema (npx auth migrate): oauthApplication becomes oauthClient, plus new oauthRefreshToken and oauthClientAssertion tables.

• Added OIDC back-channel logout so ending a session cuts off every connected app's API access (#9304)

  Migration: Introspecting an access token whose session has ended now returns { active: false }, and /oauth2/userinfo rejects it. Clients opt into notifications by registering backchannel_logout_uri. Run the schema migration for the new oauthClient and oauthAccessToken columns.

• Aligned OAuth client registration and metadata with MCP authorization 2026-07-28 (#10577)

  Migration: Add applicationType and nullable clientDiscoveryId columns, deduplicate existing (clientId, resourceId) links before the new compound unique index, then drop the legacy type and public columns. Replace clientCredentialGrantDefaultScopes with per-client clientCredentialsScopes, backfilling every client to [] and reassigning approved machine scopes after an audit. mcp() no longer enables unauthenticated DCR: compose it with cimd() or enable both DCR flags explicitly.

• Enforced the max_age authorization request parameter (#9936)

  Migration: Users who authenticated longer ago than the requested max_age are now sent back to log in, and the ID token's auth_time reflects the fresh login. Flows that relied on max_age being ignored will prompt again.

• Made ID token claim authority explicit, reserving OIDC protocol claims for the provider (#10140)

  Migration: customIdTokenClaims, extension claims, and per-issuance idTokenClaims can no longer set protocol claims such as issuer, subject, audience, nonce, auth_time, acr, amr, or azp; use namespaced custom claims instead. ID tokens now carry acr: "0" and discovery advertises only "0".

• Modeled OAuth protected resources explicitly, with per-resource TTLs, scopes, claims, and signing pins (#9648)

  Migration: validAudiences is removed: move each resource identifier into resources and link restricted clients through oauthClientResource. @better-auth/mcp now requires an explicit resource. Run npx @better-auth/cli generate and apply the migration before deploying.

• Bound OAuth client authentication to the grant being issued (#10063)

  Migration: Remove grantType from provider.authenticateClient(...), and return { clientId, confirmation? } from a custom OAuthClientAuthenticationStrategy.authenticate instead of a client record.

• Bound RFC 8707 resource indicators to the authorization grant (#9836)

  Migration: Token and refresh requests may only narrow the authorization's resource; a broader request returns invalid_target. customAccessTokenClaims now receives a resources array in place of the resource string. Run the schema migration to add the new resource columns.

• Returned RFC-compliant OAuth error envelopes from validation failures (#9277)

  Migration: Authorization errors now redirect to a registered client's trusted redirect URI with state and iss instead of rendering the server error page, and confidential clients must use their registered token_endpoint_auth_method.

• Rewrote the generic OAuth plugin as a first-class social provider with OAuth 2.1 defaults (#9069)

  Migration: Replace signIn.oauth2({ providerId }) with signIn.social({ provider }), oauth2.link() with linkSocial(), and drop genericOAuthClient(). Callbacks move to /api/auth/callback/:id, pkce now defaults to true, and issuer and requireIssuerValidation are removed in favor of OIDC discovery.

• Separated OAuth device grant ownership into oauthDeviceAuthorization() (#10746)

  Migration: The OAuth integration replaces the optional resource column with oauthClientId and resources, so regenerate and apply the schema. Let pending device codes expire before upgrading from an earlier 1.7 prerelease.

Features

• Added token endpoint client authentication configuration across the OAuth stack (#9625)
• Added the @better-auth/cimd Client ID Metadata Document plugin (#9159)
• Added the OAuth device authorization grant (RFC 8628) (#10135)
• Added DPoP sender-constrained access tokens (RFC 9449) (#10039)
• Added an extension surface for registering grants, client authentication methods, discovery metadata, and claim contributors (#10030)
• Added a refresh token reuse interval that replays the same response for duplicate refresh requests (#10145)
• Allowed confidential DCR clients to complete authorization-code flows without PKCE (#10146)
• Added the at_hash claim to ID tokens issued alongside an access token, per OIDC Core §3.1.3.6 (#9079)
• Made token introspection consistent across opaque and JWT tokens and scoped it to the audience (#10045)
• Exposed the issuing sessionId to id_token claim contributors (#10113)
• Honored requested UserInfo claims through a claim registry (#10156)
• Removed the silenceWarnings option and the well-known endpoint warnings it suppressed (#10703)
• Added protected dynamic client registration using RFC 7591 initial access tokens (#10037)
• Added private_key_jwt client authentication for token endpoint requests (RFC 7523) (#8836)
• Sent Cache-Control: no-store on every OAuth response that carries credentials (#10065)
• Added a server-trusted OAuth state channel, fixing anonymous account linking in in-app browsers (#9930)

Bug Fixes

• Enforced RFC 8628 request cardinality and client authentication on the device flow endpoints (#10752)
• Accepted the OpenID Provider issuer as the aud of private_key_jwt client assertions (#10811)
• Accepted UserInfo bearer tokens sent in a form-encoded request body (#10155)
• Allowed nonce-bound confidential clients to request offline_access without PKCE (#10153)
• Returned a 401 invalid_token challenge from /oauth2/userinfo for invalid tokens (#10068)
• Completed the RP-initiated logout flow with form-encoded POST support and confirmation pages (#10812)
• Deferred token revocation and back-channel logout delivery until the session deletion commits (#10472)
• Accepted form-encoded POST authorization requests and rejected unsupported OIDC request objects (#10151)
• Handled voluntary and essential acr claim requests per OIDC Core (#10790)
• Kept profile and email scope claims on the UserInfo response instead of ID tokens (#10152)
• Made the private_key_jwt jti single-use atomic across processes (#9964)
• Made redirect_uri conditional at the token endpoint, required only when the authorization included one (#10159)
• Preserved client key metadata and the requested authentication method during dynamic client registration (#10144)
• Redirected authorization requests missing response_type to the verified client redirect URI (#10149)
• Rejected authorization code replay with invalid_grant and revoked tokens issued from that code (#10150)
• Reported unsupported_token_type when revoking a JWT access token (#9970)
• Required the openid scope for authorization requests that use the claims parameter (#10791)
• Returned invalid_grant when a client presents a refresh token issued to another client (#10154)
• MCP clients that hit a scope wall now learn exactly which scopes to ask for: missing protected scopes produce a 403 with an RFC 6750 insufficient_scope challenge naming every one of them, so clients can request them in a single authorization redirect.
• Single-sourced HTTP Basic credential encoding and decoding for OAuth client authentication (#9657)

For detailed changes, see CHANGELOG

@better-auth/core

❗ Breaking Changes

• Moved database joins out of experimental into the stable advanced.database.joins option (#10359)

  Migration: Replace experimental: { joins: true } with advanced: { database: { joins: true } }. Drizzle and Prisma users should regenerate their schema (npx auth@latest generate) so it includes the required relations.

• Scoped account identity by trusted issuer, keying accounts on (issuer, accountId) (#10403)

  Migration: Accounts now require Account.issuer. Read provider identity from accountInfo.account.accountId, drop mapping.id from SSO configs, and give the microsoftEntraId helper a concrete tenant GUID. Apply the account-identity backfill in the 1.7 upgrade guide before deploying.

• Decoupled SCIM provisioning from the organization plugin (#10390)

  Migration: SCIM configuration, client APIs, database schema, and the Group model are all replaced, and provisioning state cannot migrate in place. Follow the SCIM cutover in the 1.7 upgrade guide, including a full directory reprovision, before resuming traffic.

• Identified Microsoft Entra accounts by the stable oid claim (#10204)

  Migration: Migrate existing Microsoft account rows created from sub before upgrading. Tokens without a valid oid are rejected.

• Verified provider id_tokens with a single shared verifier (#9828)

  Migration: Custom UpstreamProvider implementations replace the removed verifyIdToken method with an idToken config carrying a JWKS source, issuer, and audience. PayPal client id_token sign-in now returns ID_TOKEN_NOT_SUPPORTED; its redirect flow is unchanged.

Features

• Added clientAssertion support to the Microsoft Entra ID social provider (#9898)
• Added per-provider requireEmailVerification for social sign-in (#9929)
• Added a user.validateUserInfo gate for rejecting an identity before a user is created or linked (#9864)
• Added compound table indexes to plugin database schemas (#10402)
• Added allowIdpInitiated support for IdP-initiated flows through a secure server-side bounce (#9301)
• Added RP-initiated logout so signOut() can also sign users out of the OpenID provider (#9368)
• Added refreshTokenParams for forwarding extra parameters on generic OAuth token refresh (#9948)
• Added an includeGrantedScopes option to the Google provider (#10129)
• Added DPoP sender-constrained access tokens (RFC 9449) (#10039)
• Added private_key_jwt client authentication for token endpoint requests (RFC 7523) (#8836)
• Sent Cache-Control: no-store on every OAuth response that carries credentials (#10065)
• Added per-request additionalParams and loginHint across signIn.social, linkSocial, and signIn.sso (#9305)
• Added JWKS-backed asymmetric JWTs for the session cookie cache (#8931)
• Added transactional OIDC user resolution for SSO sign-ins (#10473)

Bug Fixes

• Routed CIMD client_id SSRF checks through the shared host classifier, which now rejects IPv4-compatible IPv6, the 6to4 relay prefix, and site-local addresses (#10126)
• Derived the OAuth redirect_uri from the per-request base URL in multi-host deployments (#10127)
• Preserved previously granted account.scope values across re-authentication and token refresh (#10128)
• Fixed client plugin composition so One Tap, Electron, and Expo type-check with createAuthClient (#10505)
• Single-sourced HTTP Basic credential encoding and decoding for OAuth client authentication (#9657)

For detailed changes, see CHANGELOG

@better-auth/sso

❗ Breaking Changes

• Scoped account identity by trusted issuer, keying accounts on (issuer, accountId) (#10403)

  Migration: Accounts now require Account.issuer. SSO subjects are protocol-defined (sub for OIDC, signed NameID for SAML) and mapping.id is removed; a manual SAML config without metadata XML must set idpMetadata.entityID. Apply the account-identity backfill in the 1.7 upgrade guide before deploying.

• Added rolling SAML certificate rotation by accepting an array of IdP signing certificates (#8805)

  Migration: getSSOProvider, listSSOProviders, and updateSSOProvider now always return samlConfig.certificate as an array, so drop any Array.isArray branching. Registration rejects SAML configs with no signing-cert source with CERT_SOURCE_MISSING.

• Hardened the validateUserInfo source contract so it cannot be bypassed or spoofed (#9940)

  Migration: createUser now fails closed when validateUserInfo is configured but no endpoint context or provisioning source is available. Read SSO metadata from source.sso instead of source.oauth, and handle the source.method values sso-oidc and sso-saml.

• Hardened SAML response validation for InResponseTo, audience restriction, and SessionIndex (#9055)

  Migration: allowIdpInitiated now defaults to false. Set saml.allowIdpInitiated: true to keep accepting unsolicited SAML responses.

• Consolidated the SAML ACS endpoint, made spMetadata optional, and fixed Single Logout (#9117)

  Migration: Point your IdP's ACS URL at /sso/saml2/sp/acs/:providerId; /sso/saml2/callback/:providerId is removed. callbackUrl is now the post-auth redirect only, and the unused decryptionPvk, additionalParams, idpMetadata.entityURL, and idpMetadata.redirectURL fields are gone.

Features

• Added a user.validateUserInfo gate for rejecting an identity before a user is created or linked (#9864)
• Added allowIdpInitiated support for IdP-initiated flows through a secure server-side bounce (#9301)
• Added private_key_jwt client authentication for token endpoint requests (RFC 7523) (#8836)
• Added per-request additionalParams and loginHint across signIn.social, linkSocial, and signIn.sso (#9305)
• Added a server-trusted OAuth state channel, fixing anonymous account linking in in-app browsers (#9930)
• Added transactional OIDC user resolution for SSO sign-ins (#10473)
• Extended resolveUser to SAML sign-ins and hardened the provider lifecycle (#10621)
• Added additionalFields support on ssoProvider (#9445)

Bug Fixes

• Allowed an SSO provider registration to reuse a SCIM connection ID, since SCIM connections no longer share the authentication provider namespace.
• Rejected redirecting OIDC discovery, token, userinfo, and JWKS endpoints so SSO works on Cloudflare Workers (#10072)
• Updated samlify to 2.13.1 for a signed-assertion XML injection fix (#9821)
• Upgraded samlify to 2.12.0 with XPath injection and XXE fixes (#9121)
• Single-sourced HTTP Basic credential encoding and decoding for OAuth client authentication (#9657)
• Verified SAML assertion signatures directly instead of trusting an already-parsed response, and applied the same signing policy and size limit to SP metadata as to IdP metadata. wantAssertionsSigned now controls whether signed assertions are required rather than signed response messages, matching how IdPs sign SAML responses in practice.

For detailed changes, see CHANGELOG

@better-auth/scim

❗ Breaking Changes

• Decoupled SCIM provisioning from the organization plugin (#10390)

  Migration: SCIM configuration, client APIs, database schema, and the Group model are all replaced, and provisioning state cannot migrate in place. Follow the SCIM cutover in the 1.7 upgrade guide, including a full directory reprovision, before resuming traffic.

• Isolated SCIM provider connections from the organization and SSO plugins (#10249)

  Migration: Define connections statically, resolve them with authentication.verifyBearerToken, or use the optional managedConnections catalog, and connect SCIM resources to users and roles through identity and projection callbacks. Legacy SCIM state is not migrated: back it up, issue new credentials, and fully reprovision Users and Groups.

• Bound personal SCIM connections to their creator and removed user-session connection management (#9840)

  Migration: The legacy connection management endpoints and providerOwnership are gone, so authorize SCIM administration in your own application. Legacy scimProvider rows and credentials are not migrated: follow the 1.7 SCIM upgrade guide, issue new credentials, and reprovision Users and Groups.

Features

• Added a user.validateUserInfo gate for rejecting an identity before a user is created or linked (#9864)
• Added durable SCIM Group resources with connection-scoped membership and lifecycle endpoints (#10018)
• Added the SCIM Enterprise User extension and the standard User attributes for interop conformance (#10620)
• Added a managed connection catalog and runtime connection resolution (#10592)
• Added acquireActiveSCIMUserLink for transaction-safe authentication of provisioned users (#10474)

Bug Fixes

• Accepted exact case-insensitive string boolean values for SCIM User active and the primary sub-attribute of emails, phoneNumbers, addresses, roles, and entitlements at the HTTP ingress, for Microsoft Entra interoperability.
• Added an optional SCIM-owned connection and credential catalog. Configure managedConnections so trusted server code can create runtime tenant connections and issue, rotate, and revoke their bearer credentials through server-only auth.api methods, without a code-defined connection or an application-owned verifier.
• Allowed trusted server code to retain a terminal connection binding before a dynamic SCIM connection's first authenticated request by supplying its provisioning domain during decommissioning.
• Created filtered SCIM PATCH values when no target matches instead of rejecting the request (#10682)

For detailed changes, see CHANGELOG

@better-auth/mcp ✨

❗ Breaking Changes

• Moved the MCP plugin into its own @better-auth/mcp package built on the OAuth provider (#9992)

  Migration: Install @better-auth/mcp and @better-auth/cimd, add the now-required jwt() plugin, and move options nested under oidcConfig to flat mcp({ ... }) options. Rename withMcpAuth to requireMcpAuth and mcpHandler to createMcpProtectedRequestHandler. Regenerate the schema (npx auth migrate): oauthApplication becomes oauthClient, plus new oauthRefreshToken and oauthClientAssertion tables.

• Aligned OAuth client registration and metadata with MCP authorization 2026-07-28 (#10577)

  Migration: Add applicationType and nullable clientDiscoveryId columns, deduplicate existing (clientId, resourceId) links before the new compound unique index, then drop the legacy type and public columns. Replace clientCredentialGrantDefaultScopes with per-client clientCredentialsScopes, backfilling every client to [] and reassigning approved machine scopes after an audit. mcp() no longer enables unauthenticated DCR: compose it with cimd() or enable both DCR flags explicitly.

• Modeled OAuth protected resources explicitly, with per-resource TTLs, scopes, claims, and signing pins (#9648)

  Migration: mcp() now requires an explicit resource identifier, for example resource: "https://api.example.com/mcp". validAudiences is removed: move each resource identifier into resources. Run npx @better-auth/cli generate and apply the migration before deploying.

Features

• Added DPoP sender-constrained access tokens (RFC 9449) (#10039)
• Added a refresh token reuse interval that replays the same response for duplicate refresh requests (#10145)

For detailed changes, see CHANGELOG

@better-auth/electron

❗ Breaking Changes

• Enforced S256 PKCE in the Electron sign-in flow and hardened custom-scheme origin checks (#9645)

  Migration: Upgrade the @better-auth/electron client and server together and add your app's scheme to trustedOrigins. The code_challenge_method parameter and disableOriginOverride option are removed, and host-bearing custom-scheme entries now match that host exactly.

• Rewrote the generic OAuth plugin as a first-class social provider with OAuth 2.1 defaults (#9069)

  Migration: Replace signIn.oauth2({ providerId }) with signIn.social({ provider }), oauth2.link() with linkSocial(), and drop genericOAuthClient(). Callbacks move to /api/auth/callback/:id, pkce now defaults to true, and issuer and requireIssuerValidation are removed in favor of OIDC discovery.

Bug Fixes

• Fixed client plugin composition so One Tap, Electron, and Expo type-check with createAuthClient (#10505)

For detailed changes, see CHANGELOG

@better-auth/expo

❗ Breaking Changes

• Switched Expo secure storage to async access so apps no longer crash when the iOS Keychain is unavailable (#10438)

  Migration: getCookie() now returns a promise, and custom storage implementations must provide both synchronous and asynchronous SecureStore methods. storageAdapter.setItem() stays synchronous, so use setItemAsync() when the write must be awaited.

• Rewrote the generic OAuth plugin as a first-class social provider with OAuth 2.1 defaults (#9069)

  Migration: Replace signIn.oauth2({ providerId }) with signIn.social({ provider }), oauth2.link() with linkSocial(), and drop genericOAuthClient(). Callbacks move to /api/auth/callback/:id, pkce now defaults to true, and issuer and requireIssuerValidation are removed in favor of OIDC discovery.

Bug Fixes

• Fixed client plugin composition so One Tap, Electron, and Expo type-check with createAuthClient (#10505)

For detailed changes, see CHANGELOG

@better-auth/stripe

❗ Breaking Changes

• Made the event parameter of onSubscriptionCancel required (#9531)

  Migration: Declare event as a required parameter in your callback and remove any undefined guards around it.

• Removed the optional marker from the onSubscriptionCancel event parameter (#9359)

  Migration: event is always supplied, so drop undefined handling from the callback.

For detailed changes, see CHANGELOG

auth

❗ Breaking Changes

• Accumulated OAuth granted scopes in a new grantedScopes string array (#9825)

  Migration: grantedScopes replaces the comma-joined account.scope string with no read-time fallback, so backfill it from the existing values. The client provider contract is renamed from OAuthProvider to UpstreamProvider.

Features

• Added a create-admin command for creating an initial admin user (#9547)
• Added compound table indexes to plugin database schemas (#10402)

Bug Fixes

• Preserved issuer-scoped account identities by restoring Account.accountId alongside the required issuer (#10668)
• Exported the generated pgSchema binding so drizzle-kit can emit CREATE SCHEMA for custom PostgreSQL namespaces (#10770)
• Loaded the auth config through c12 v4 resolveModule, adding support for the export default { auth } shape (#9477)
• Reverted the granted scopes architecture, restoring the previous account.scope storage (#10123)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

❗ Breaking Changes

• Moved database joins out of experimental into the stable advanced.database.joins option (#10359)

  Migration: Replace experimental: { joins: true } with advanced: { database: { joins: true } }, and regenerate the schema (npx auth@latest generate) so it includes the required relations.

Features

• Added compound table indexes to plugin database schemas (#10402)
• Added a relations-v2 entry point for projects using Drizzle Relations v2 (#9489)
• Added a schemaName option that generates the Drizzle schema inside a pgSchema namespace (#7169)

Bug Fixes

• Exported the generated pgSchema binding so drizzle-kit can emit CREATE SCHEMA for custom PostgreSQL namespaces (#10770)

For detailed changes, see CHANGELOG

@better-auth/cimd ✨

❗ Breaking Changes

• Aligned OAuth client registration and metadata with MCP authorization 2026-07-28 (#10577)

  Migration: Add applicationType and nullable clientDiscoveryId columns, deduplicate existing (clientId, resourceId) links before the new compound unique index, then drop the legacy type and public columns. Client ID Metadata Documents preserve an omitted application_type as null and cannot assign clientCredentialsScopes. Compose mcp() with cimd() for metadata-document clients.

Features

• Added the @better-auth/cimd Client ID Metadata Document plugin (#9159)

Bug Fixes

• Client ID Metadata Documents now follow shared-cache freshness rules and fail closed when freshness is ambiguous. The plugin prefers s-maxage over max-age and Expires, honors s-maxage=0, revalidates conditionally with ETag or Last-Modified, and treats invalid or duplicate freshness directives as immediately stale. Concurrent refreshes converge on one client-resource link instead of failing on its unique constraint.

For detailed changes, see CHANGELOG

@better-auth/api-key

❗ Breaking Changes

• Hardened atomic state transitions so concurrent requests cannot race past single-use or rate-limit guards (#10000)

  Migration: Custom adapters must implement native consumeOne and incrementOne, secondary storage needs atomic consume and increment operations, and custom rate-limit storage makes one consume decision per request. The read-then-delete and read-then-update fallbacks are removed.

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed SQLite dialect bundles on Kysely 0.29 by mirroring the migration-table constants locally (#10377)
• Raw database instances (better-sqlite3, node:sqlite, bun:sqlite, mysql2, pg) passed directly as database now get native adapter transactions automatically, matching the behavior of the explicit { db } and { dialect } config shapes. This unblocks plugins that require native transactions (such as @better-auth/scim) when the database is provided in the quickstart database: new Database(...) shape.

For detailed changes, see CHANGELOG

@better-auth/i18n

Features

• Added built-in translations for 22 languages (#9157)

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Features

• Added compound table indexes to plugin database schemas (#10402)

For detailed changes, see CHANGELOG

@better-auth/passkey

Features

• Added an optional createSession setting that signs the user in on successful passkey registration (#9873)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.6.30...v1.7.0

better-auth

Bug Fixes

• Prevented duplicate session requests during React Suspense retries while preserving revalidation for interrupted refreshes (#10769)
• Restored client plugin declaration compatibility for downstream TypeScript consumers (#10794)

For detailed changes, see the CHANGELOG.

@better-auth/electron

Bug Fixes

• Restored client plugin declaration compatibility for downstream TypeScript consumers (#10794)

For detailed changes, see the CHANGELOG.

@better-auth/expo

Bug Fixes

• Restored client plugin declaration compatibility for downstream TypeScript consumers (#10794)

For detailed changes, see the CHANGELOG.

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.6.27...v1.6.28

better-auth

Bug Fixes

• Fixed duplicate session requests being made across Suspense retries (#10676)

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Fixed auth endpoint types to align with better-call (#10657)

For detailed changes, see CHANGELOG

auth

Bug Fixes

• Fixed the CLI to align installed packages with the running CLI version (#10743)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.6.26...v1.6.27

better-auth

Bug Fixes

• Fixed session cleanup on user deletion to also remove sessions from secondary storage (#10520)
• Fixed findSessions to skip invalid secondary-storage session entries without discarding other valid sessions (#10580)
• Fixed email OTP sign-up to pass the verification type to custom OTP generators (#10608)
• Fixed email OTP password reset to allow retrying after entering an invalid password (#10552)
• Fixed email OTP verification to no longer reveal whether an email is registered before the OTP is verified (#10605)
• Fixed jwtClient() collapsing createAuthClient type inference when combined with other client plugins (#10513)
• Fixed JWT key minting inside database transactions to use the transaction-scoped adapter, preventing deadlocks on SQLite and ensuring keys commit with their surrounding transaction on Postgres and MySQL (#10623)
• Fixed oAuthProxy to preserve Apple user data from form_post callbacks (#10599)
• Fixed oneTapClient() collapsing createAuthClient type inference when combined with other client plugins (#10635)
• Fixed database rate-limit cleanup to complete when no background task handler is configured (#10619)
• Improved nextCookies performance in instrumented Next.js applications by reusing the next/headers import promise (#10467)

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added a utility for creating stable, namespaced placeholder emails on the reserved placeholder.invalid domain (#10576)

For detailed changes, see CHANGELOG

@better-auth/redis-storage

Bug Fixes

• Fixed listKeys() and clear() to use SCAN instead of KEYS so large keyspaces no longer block the Redis server (#10507)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.6.25...v1.6.26

better-auth

Features

• Added request context (ctx) as a third argument to verifyIdToken, enabling custom ID token verifiers to read request headers (#10376)
• Added beforeStoreCookie option to the last-login-method plugin for GDPR compliance (#5753)

Bug Fixes

• Replaced flaky MongoDB where-coercion integration test with a direct unit test for more reliable test runs (#10369)
• Fixed the get-session endpoint to include no-store cache control headers, preventing stale session data from being served (#10222)
• Fixed SQLite migration diffs to recognize BIGINT as a valid number type, preventing spurious pending changes on rate limiter columns (#10316)
• Fixed auth requests failing when request cloning throws an error inside verification callbacks (#10336)
• Fixed useSession({ throw: true }) incorrectly excluding null from its data type (#9787)
• Fixed auth query revalidation and signal listeners not being restored after a client component remounts (#10379)
• Fixed the CookieAttributes index signature type to be more precise (#10442)
• Fixed silent misrouting of adapter queries when user.modelName was set to a value that collides with another schema key (#10235)
• Fixed Kysely migration generation producing duplicate indexes for fields marked both unique and index (#10357)
• Fixed magic-link and email-OTP send endpoints to validate the Origin header on cookieless requests, preventing cross-origin abuse (#10368)
• Fixed remote MCP auth 401 challenge headers being hidden from browser clients due to missing CORS exposure (#10290)
• Fixed OpenAPI schema to include plugin user fields (such as username and displayUsername) in /sign-up/email and /update-user request bodies (#10453)
• Fixed organization.listMembers failing with "User not found for member" for organizations with more than ~100 members (#10342)
• Fixed organization invitations to use database-generated IDs when advanced.database.generateId is configured, matching the behavior of other models (#10040)
• Fixed getDefaultModelName to prefer exact schema key matches over modelName aliases, preventing adapter queries from being misrouted when a built-in table's name collides with another schema key

For detailed changes, see CHANGELOG

auth

Bug Fixes

• Fixed SvelteKit builds by stubbing explicit-environment-variables modules (#10221)
• Fixed Drizzle schema generation producing duplicate indexes for fields marked both unique and index (#10333)
• Fixed Drizzle schema generation for tables with multiple foreign keys to the same model by adding disambiguating relationName values (#10352)
• Fixed auth generate failing when the config file imports the not-yet-generated output file (e.g. on a Convex first run) (#10302)

For detailed changes, see CHANGELOG

@better-auth/electron

Bug Fixes

• Updated compatibility testing to include Electron 43 (peer range unchanged at >=36.0.0) (#10440)
• Fixed /electron/init-oauth-proxy forwarding multiple Set-Cookie headers as a single comma-joined string, which caused the browser to drop the transfer-token cookie during OAuth handoff (#9672)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed an intermittent "No request state found" error caused by a race condition in AsyncLocalStorage initialization on serverless cold starts (e.g. Cloudflare Workers) (#9862)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed IdP-initiated SAML sign-ins in split-origin deployments to redirect users to the configured application URL instead of the authentication server, using idpInitiatedCallbackUrl (#10388)

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

• Fixed beforeDeleteOrganization and afterDeleteOrganization hooks not receiving the endpoint context as the second argument (#10190)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.6.23...v1.6.24

better-auth

Features

• Added Yandex as a social OAuth provider (#9138)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed affected row counting for D1 and postgres-js adapters (#10257)

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

• Fixed organization subscription actions (cancel, upgrade, restore, and the billing portal) that could act on the wrong organization.

For detailed changes, see CHANGELOG

auth

Bug Fixes

• Fixed string default values not being properly escaped in the generated Drizzle schema (#10259)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.6.22...v1.6.23

better-auth

Bug Fixes

• Fixed unproven credentials not being revoked during magic link and email OTP sign-in (#10239)
• Fixed server-side OAuth requests to refuse redirect responses instead of following them (#10241)

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Fixed SCIM write-path operations to be properly scoped and to correctly honor the active attribute (#10242)

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

• Fixed organization subscription actions (cancel, upgrade, restore, and the billing portal) that could act on the wrong organization.

For detailed changes, see CHANGELOG

auth

Bug Fixes

• Added account-level verification lockout for two-factor authentication (#10240)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.6.21...v1.6.22

better-auth

Bug Fixes

• Fixed rate limits to be enforced before plugin request handlers run (#10191)
• Fixed admin permission changes and bans to take effect immediately, even when session cookie cache is enabled (#10187)
• Fixed deviceAuthorization() throwing a ZodError when called without a schema option under Zod v4 (#9939)
• Fixed Google hosted-domain validation to apply consistently across all sign-in flows, including Google One Tap (#10197)
• Fixed OAuth proxy to reject profile callbacks that do not match an issued OAuth state, preventing session creation with stale state (#10183)
• Fixed OAuth sign-up and account linking to ignore provider profile values for fields marked input: false (#10196)
• Fixed PayPal sign-in to validate user info against the verified ID token subject (#10192)
• Fixed SIWE sign-in to reject emails that already belong to another account, preventing one email from being attached to two accounts (#10228)
• Fixed two-factor verification to lock out after five wrong codes for TOTP and backup codes, returning TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE (#10210)
• Fixed the username plugin to only store displayUsername fallbacks that pass username validation during email sign-up (#10182)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed SSO provider deletion to also remove linked accounts, preventing reuse by a later provider with the same ID (#10224)
• Fixed SSO domain verification to require DNS proof for every domain listed on a provider (#10227)
• Fixed SAML single logout to reject IdP SLO POST URLs that use non-http(s) schemes such as javascript: or data: (#10225)
• Fixed SAML SSO to reject responses whose audience, recipient, or destination does not match the configured Service Provider (#10226)

For detailed changes, see CHANGELOG

@better-auth/api-key

Bug Fixes

• Fixed client IP resolution to prevent X-Forwarded-For spoofing in multi-hop proxy chains (#10203)
• Refactored request IP resolution into a centralized core resolver (#10216)

For detailed changes, see CHANGELOG

auth

Bug Fixes

• Fixed disableMigration: true to be respected on plugin schema tables during generation and runtime migration (#10198)
• Fixed the CLI to generate BETTER_AUTH_SECRET values with 32 characters instead of 16 (#10186)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed adapter.update to return null when no matching row is found (#10180)

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

• Fixed organization subscription actions (cancel, upgrade, restore, and the billing portal) that could act on the wrong organization.

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.6.20...v1.6.21

better-auth

Features

• Added support for pre-binding device codes to a specific user in the device authorization plugin (#9995)

Bug Fixes

• Fixed headerless session checks (#10053)
• Fixed cookie cache fallback lookup (#9348)
• Fixed sendVerificationEmail errors not being surfaced to the client (#8863)
• Fixed auth client return types not being emitted correctly in TypeScript declaration builds (#10071)
• Fixed session and account cache cookies being silently dropped when near the browser's per-cookie size limit by splitting them into chunks (#10088)
• Fixed single-use verification flows (such as magic-link) hanging on connection-limited database adapters by reusing active transactions (#10070)
• Fixed the domain not being included when clearing cross-subdomain cookies in the last-login-method plugin (#9319)
• Fixed the oauth-popup plugin leaking internal OAuth state keys into additionalData (#10067)
• Reverted the headerless session check fix (#10074)

For detailed changes, see CHANGELOG

auth

Bug Fixes

• Fixed the generate command not handling a directory path passed to --output (#9564)
• Fixed array additionalField default values not being serialized correctly in the Drizzle schema generator (#10048)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed password reset tokens not working with the Drizzle MySQL adapter after being consumed (#10081)

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

• Fixed guarded state transitions (token rotation, revocation, two-factor backup-code regeneration, device-code claiming, and organization invitation acceptance) failing on Prisma and on MongoDB servers older than 5.0 (#10086)

For detailed changes, see CHANGELOG

@better-auth/passkey

Bug Fixes

• Fixed invalid OpenAPI output for callback, session, and passkey routes so client generators can consume the schema (#9555)

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Stopped logging SCIM user filter values when listing users (#10087)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.6.18...v1.6.19

better-auth

Bug Fixes

• Fixed getCookieCache to return null for expired sessions instead of treating stale signed cookies as live sessions.
• Fixed the delete-account confirmation link to prevent duplicate account deletions from concurrent callback requests.
• Fixed one-time tokens from being redeemable multiple times under concurrent requests.
• Fixed password reset tokens from changing a password more than once under concurrent requests.
• Fixed Reddit sign-in to assign a non-routable placeholder address (<id>@reddit.invalid) to users with no email, preventing accidental matches with real mailboxes.
• Fixed Sign-In with Ethereum nonces from being accepted multiple times under concurrent sign-in requests.
• Added internalAdapter.reserveVerificationValue to atomically record single-use markers, ensuring only one concurrent caller succeeds for replay-protected operations.
• Added the incrementOne adapter method and SecondaryStorage.increment for atomic counter updates, enabling strict rate-limit and usage-counter enforcement under concurrent load.
• Fixed expired two-factor challenges from completing login and prevented duplicate session creation from concurrent verifications.
• Fixed captcha verification to time out after 10 seconds, preventing slow or unreachable captcha providers from hanging requests indefinitely.
• Fixed /delete-user/callback to reject account deletion when the session has been revoked server-side (cookie-only session deployments are unaffected).
• Fixed rate limiting to prevent concurrent requests from slipping past configured limits, with a new optional consume method for custom storage backends to opt into strict enforcement.
• Fixed team deletion to preserve pending invitations by removing only the deleted team's reference rather than invalidating the invitations entirely.
• Fixed expected authentication validation failures to log as warnings instead of errors.
• Fixed MCP bearer token validation to reject expired access tokens and require the offline_access scope for refresh token usage.
• Fixed plugin API inference in composite monorepo setups where the core package resolved through multiple paths (#9583)
• Fixed OpenAPI generation to accurately serialize Zod request schemas, including optional, nullable, intersected, and record-shaped types (#9315)
• Fixed a memory leak where the JWKS cache could grow on every access token verification.
• Fixed Google One Tap to require a configured client ID (set via the oneTap plugin or socialProviders.google) and reject tokens issued for other applications.
• Fixed device-authorization token polling to prevent the same approved device code from being redeemed multiple times under concurrent polls.
• Fixed account cookie preservation when switching users in the same browser session.
• Fixed email OTP sign-in to prevent concurrent requests from signing in multiple times or exceeding the attempt limit.
• Fixed phone-number OTP sign-in to prevent concurrent requests from signing in multiple times or exceeding the attempt limit.
• Fixed two-factor OTP sign-in to prevent concurrent requests from signing in multiple times or exceeding the attempt limit.
• Fixed the Have I Been Pwned plugin to check breached passwords on additional endpoints, including email-OTP and phone-number reset-password routes and admin password-setting routes.
• Fixed the multi-session set-active and revoke endpoints to only act on sessions the caller holds a signed cookie for, preventing unauthorized session manipulation.
• Fixed the OIDC /oauth2/endsession endpoint to reject cross-site logout requests that carry only a session cookie without a valid id_token_hint.
• Fixed WeChat sign-in to work without an email address by assigning a stable placeholder email, with mapProfileToUser available to supply a real one.

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed SAML assertion replay protection to hold under concurrent requests, preventing a duplicate submission from being accepted more than once.
• Fixed organization admins and owners to verify domain ownership for SSO providers their organization owns, not just the member who originally registered the provider.
• Fixed trustEmailVerified to treat only a boolean true or the string "true" as a verified email, rejecting the string "false" as unverified.

For detailed changes, see CHANGELOG

@better-auth/memory-adapter

Bug Fixes

• Fixed the memory adapter to not discard concurrent writes when a transaction fails, and made update and delete no-ops on empty filters instead of modifying every row.
• Fixed counter updates on the memory, Kysely, Drizzle, Prisma, and MongoDB adapters to be atomic on the default configuration, preventing race conditions in rate limiting and API-key usage limits.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed signed OAuth redirect parameters to be canonicalized by key and value, preventing CDN or proxy reordering from breaking signature verification (#9941)
• Fixed token introspection and revocation endpoints to cache signing keys per auth instance rather than fetching them from the database on every request.

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Fixed organization-scoped SCIM deletes to remove user membership through the organization adapter, so team memberships and member-removal hooks are applied correctly.
• Fixed SCIM bearer token comparison to use constant-time comparison during request authentication, closing a timing side channel across all storage modes.

For detailed changes, see CHANGELOG

@better-auth/api-key

Bug Fixes

• Fixed concurrent API key verification to prevent the remaining-uses count from going below zero or the rate limit from being exceeded.

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed updateMany to return the number of rows it affected, as the adapter contract specifies.

For detailed changes, see CHANGELOG

@better-auth/electron

Bug Fixes

• Fixed Electron authorization codes from being exchangeable for a session more than once under concurrent exchange attempts.

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed SQLite mutations through the Bun and Node drivers to correctly report affected row counts and inserted row IDs, fixed multi-parameter binding on the Bun driver, and fixed consumeOne compatibility with SQL Server.

For detailed changes, see CHANGELOG

@better-auth/passkey

Bug Fixes

• Fixed passkey challenge validation to reject cross-purpose challenges, preventing an authentication challenge from being used to complete registration and vice versa.

For detailed changes, see CHANGELOG

@better-auth/prisma-adapter

Bug Fixes

• Fixed the Prisma adapter's delete operation to surface errors instead of silently reporting success when the failure is not a missing-record error.

For detailed changes, see CHANGELOG

@better-auth/redis-storage

Bug Fixes

• Fixed Redis-backed rate-limit windows to set expiry only when the window first opens, preventing continued traffic from extending the window, and added an atomic increment method for strict enforcement.

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.6.17...v1.6.18

better-auth

Features

• Added an experimental oauthPopup plugin for popup-based OAuth sign-in, enabling sign-in inside cross-site iframes by completing the OAuth flow in a popup and passing the session token back via the bearer plugin (#9890)

Bug Fixes

• Fixed getCookieCache to return null for an expired session instead of stale data, so middleware no longer treats an expired signed cookie as a live session.
• Fixed a race condition where a delete-account confirmation link could delete the account more than once when its callback was opened concurrently.
• Fixed a race condition where a one-time token could be redeemed for a session more than once when redeemed concurrently.
• Fixed a race condition where a password reset token could change the password more than once when used from concurrent requests.
• Fixed Reddit sign-in to assign a non-routable placeholder address (<id>@reddit.invalid) to users with no email, instead of one on the real reddit.com domain, preventing accidental mailbox matches. The address stays unverified, and mapProfileToUser can supply a real email.
• Fixed Sign-In with Ethereum to prevent a nonce from being used to sign in more than once when submitted from concurrent requests.
• Added internalAdapter.reserveVerificationValue for atomic single-use markers, ensuring exactly one concurrent caller succeeds and the rest see the marker as already taken, hardening replay protection across all verification flows. Database-backed storage is atomic
• Added the optional incrementOne adapter method and SecondaryStorage.increment for atomic counter updates with conditional row guards, enabling strict enforcement of rate limits and usage counters. Adapters without native support fall back to a transaction-based approach.
• Fixed expired two-factor sign-in challenges from completing login, and prevented the same challenge from creating more than one session when verified concurrently.
• Fixed captcha provider verification to time out after 10 seconds and fail closed, preventing a slow or unreachable provider from blocking requests indefinitely.
• Fixed /delete-user/callback to reject account deletion when the session has been revoked server-side, instead of proceeding within the cookie-cache window. Deployments that keep sessions only in the cookie are unaffected.
• Fixed concurrent requests from slipping past the configured rate limit, resolved unbounded memory growth in the in-memory rate-limit store, and made the database backend remove expired entries automatically. A custom rate-limit storage may implement a new optional consume method for strict enforcement.
• Fixed team deletion to preserve pending invitations, which now drop the removed team and remain valid for their remaining teams or as organization-level invitations.
• Downgraded expected auth validation failures from error logs to warnings.
• Fixed expired MCP access tokens from being accepted, and restricted refresh token acceptance to authorizations that included the offline_access scope.
• Fixed team member limits to be enforced on addMember and add-team-member paths, preventing teams from exceeding their maximumMembersPerTeam cap, and ensured a rejected addMember does not create the organization member (#10002)
• Fixed generic OAuth sign-in for providers whose userinfo response lacks a sub or id field when mapProfileToUser derives the account id (#9987)
• Fixed single-use credentials, counters, and replay markers to be handled atomically under concurrent requests (#9993)
• Fixed stateless OAuth deployments to correctly read account info and tokens when different server instances handle sign-in and subsequent requests (#9979)
• Fixed admin.setUserPassword to create a credential account for users who only have social or magic-link accounts, enabling direct password assignment without manually modifying the account table (#9482)
• Fixed updateSession to accept custom session fields inferred from inferAdditionalFields (#9777)
• Fixed duplicate /get-session requests triggered by focus and other browser events, stabilized client hook data references to reduce unnecessary re-renders, and resolved session state getting stuck loading after unmounting during an in-flight request (#8760)
• Fixed the OpenAPI schema to mark model id fields as required (#9704)
• Fixed updateMemberRole to reject unknown or malformed role values, validating them against configured static and dynamic roles (#9962)
• Fixed a memory leak where the JWKS cache grew on every access token verification.
• Fixed Google One Tap to require a configured client ID and reject ID tokens issued for a different application, preventing unauthorized sign-ins.
• Fixed a race condition where polling for a device-authorization token could redeem the same approved device code more than once.
• Fixed account cookie handling when switching users in the same browser, preserving the fresh cookie instead of expiring it from stale request state.
• Refactored role.authorize control flow without changing existing authorization behavior (#9677)
• Fixed a race condition where submitting the same email OTP from concurrent requests could sign in more than once or exceed the attempt limit.
• Fixed a race condition where submitting the same phone-number OTP from concurrent requests could sign in more than once or exceed the attempt limit.
• Fixed a race condition where submitting the same two-factor OTP from concurrent requests could sign in more than once or exceed the attempt limit.
• Improved the Have I Been Pwned plugin to check submitted passwords on more endpoints by default, including email-OTP and phone-number reset-password routes and admin create-user and set-user-password routes.
• Fixed multi-session set-active and revoke endpoints to only act on sessions the caller holds a signed cookie for, preventing unauthorized activation or revocation of other sessions.
• Fixed the OIDC /oauth2/endsession endpoint to reject cross-site GET logout requests carrying only a session cookie, while leaving logout authenticated by a valid id_token_hint unaffected.
• Fixed WeChat sign-in to succeed without an email address by assigning a stable placeholder, matching the behavior expected from the default configuration.

For detailed changes, see CHANGELOG

@better-auth/api-key

Bug Fixes

• Fixed API key updates to fail when the caller's session has been revoked server-side, instead of succeeding within the cookie-cache window (#9991)
• Prevented server-only endpoints from being accidentally exposed over HTTP (#9835)
• Fixed concurrent API key verification from driving the remaining-uses count below zero or exceeding the rate limit. Secondary-storage-only deployments remain best-effort for these counters.

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed SAML replay protection to hold under concurrent requests, preventing a SAML assertion submitted twice simultaneously from being accepted more than once.
• Fixed SSO domain verification to allow organization admins and owners to verify domains for providers their organization owns, not just the member who originally registered the provider.
• Fixed trustEmailVerified to no longer treat the string "false" as a verified email, accepting only a boolean true or the string "true" as confirmation.

For detailed changes, see CHANGELOG

auth

Bug Fixes

• Fixed the CLI to resolve SvelteKit ($app/*, $env/*), Vite asset imports (?raw, ?url), and Cloudflare Workers (cloudflare:workers) virtual-module imports when loading the auth config (#9834)
• Fixed the CLI to skip Unsupported() fields when regenerating the Prisma schema (#10011)
• Fixed the CLI to update existing Prisma field types when regenerating the schema, such as correctly emitting BigInt or Int when bigint configuration changes (#9729)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Hardened request trust validation for the Expo authorization proxy, including rejecting redirect and callback targets not in trustedOrigins (#9990)
• Fixed Expo social account linking to include the stored session cookie when using an ID token with linkSocial (#9953)

For detailed changes, see CHANGELOG

@better-auth/memory-adapter

Bug Fixes

• Fixed the memory adapter to not discard writes from concurrent operations on a failed transaction, made update and delete with an empty filter a no-op instead of affecting all rows, and made updateMany return the number of affected rows.
• Fixed counter updates on the memory, Kysely, Drizzle, Prisma, and MongoDB adapters to be atomic by default, ensuring correct rate limiting and API-key usage limit enforcement.

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Fixed organization-scoped SCIM deletes to remove members through the organization adapter, ensuring team memberships and member-removal hooks are applied correctly.
• Fixed SCIM bearer token comparison to use constant-time evaluation, closing a timing side channel that could help an attacker recover a valid token.

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed provider identity validation for Google One Tap, Microsoft Entra ID, SSO, WeChat, and Reddit sign-in to enforce tenant restrictions and reject tokens issued for other applications (#10003)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed updateMany to return the number of rows it affected, as the adapter contract specifies.

For detailed changes, see CHANGELOG

@better-auth/electron

Bug Fixes

• Fixed a race condition where an Electron authorization code could be exchanged for a session more than once when the exchange was attempted concurrently.

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed SQLite mutations through the Bun and Node Kysely drivers to correctly report affected row counts and inserted row IDs, fixed multiple query parameter binding in the Bun driver, and made consumeOne work on SQL Server.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed token introspection and revocation to cache signing keys per auth instance instead of fetching them from the database on every request.

For detailed changes, see CHANGELOG

@better-auth/passkey

Bug Fixes

• Fixed passkey challenge validation to reject registration challenges used for authentication (and vice versa), and to fail when the target user cannot be resolved.

For detailed changes, see CHANGELOG

@better-auth/prisma-adapter

Bug Fixes

• Fixed the Prisma adapter to surface delete errors instead of silently reporting success when a deletion fails for any reason other than the record being absent.

For detailed changes, see CHANGELOG

@better-auth/redis-storage

Bug Fixes

• Fixed Redis-backed rate-limit windows to set expiry once when the window opens instead of extending it with continued traffic, and added an atomic increment method to Redis secondary storage.

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

• Fixed several Stripe subscription issues: reused existing customers by email only when verified, synced subscription status from the checkout session on success, scoped cancellation and restoration to the targeted subscription, validated returnUrl against trustedOrigins, and checked all subscriptions on organization deletion (#9971)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.6.16...v1.6.17

better-auth

Bug Fixes

• Fixed SIWE verification to bind the signed message to server state before creating a session, preventing acceptance of signatures produced for a different message, earlier nonce, or unrelated domain.
• Fixed PayPal ID token verification to validate the signature, issuer, audience, expiration, and nonce against PayPal's JWKS (RS256) or client secret (HS256), rejecting tokens that pass only structural checks.
• Fixed Google hd (hosted domain) enforcement to verify the hd claim on the verified ID token and callback profile, preventing accounts outside the configured Workspace domain from signing in.
• Fixed verifyAccessToken remote introspection to reject tokens with a missing or mismatching aud claim
• Fixed the admin plugin to enforce permissions on role, ban, and email fields in /admin/create-user and /admin/update-user, and prevent data from overriding protected fields. (#9974)
• Fixed email sign-in and sign-up to validate Origin and Referer headers against trustedOrigins even when requests carry no cookies. (#9973)
• Fixed /update-session to reject plugin-managed fields (activeOrganizationId, activeTeamId, impersonatedBy) with a 400 error
• Fixed /update-session and account token routes to immediately reject deleted sessions when cookie cache is enabled alongside database or secondary storage. (#9967)
• Fixed /refresh-token to only trust the account cookie when its userId, providerId, and accountId match the resolved session user.
• Fixed generic OAuth sign-in to reject sign-ins when no account ID can be resolved from the provider response, preventing account collisions on providers that omit sub.
• Fixed createInvitation and acceptInvitation to validate that all requested team IDs belong to the invitation's organization, preventing cross-organization team membership.
• Fixed the JWKS cache to be scoped per verification source with a TTL, preventing key cross-contamination when verifying tokens against multiple issuers simultaneously.
• Fixed the Reddit provider to stop storing oauth_client_id as the user email, preventing all users of the same app from sharing a single email address
• Fixed Facebook token verification to validate tokens against the configured app via the debug_token endpoint, requiring is_valid, a matching app_id, and a client secret for direct sign-in.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed the token endpoint to enforce per-client grant types, preventing clients registered only for authorization_code from requesting client_credentials tokens.
• Fixed /oauth2/continue to derive post-login gate completion from a server-issued session marker rather than the client-submitted postLogin flag.
• Fixed token introspection to require an azp claim and a valid client on JWT access tokens, preventing session JWTs from being reported as active access tokens.

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed SAML AuthnRequest handling to consume the request atomically, preventing replay attacks on concurrent requests. (#9972)
• Fixed SSO provider IDs to be isolated from the OAuth/social account-linking namespace, preventing unintended account linking when an SSO provider ID matches a trusted OAuth provider name.
• Fixed OIDC endpoint validation to reject server-side requests resolving to non-publicly-routable addresses, protecting against SSRF on token, userinfo, and JWKS endpoints.

For detailed changes, see CHANGELOG

@better-auth/api-key

Bug Fixes

• Fixed API key verification to persist only the fields it mutates rather than the full record, preventing concurrent disables, permission changes, or expiry updates from being reverted by an in-flight verification.
• Fixed /api-key/create to verify the session against the authoritative store with disableCookieCache: true, preventing revoked sessions from being accepted within the cookie-cache window.

For detailed changes, see CHANGELOG

@better-auth/electron

Bug Fixes

• Fixed Electron auth transfers to require S256 PKCE at both minting and exchange, rejecting plain and missing code_challenge_method values.

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Fixed SCIM user provisioning to return 409 when a user with the same email already exists unless linkExistingUsers is set, changed org-scoped DELETE to deprovision the user rather than delete the global account, and added canGenerateToken to control SCIM token creation.

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.6.15...v1.6.16