better-auth

Bug Fixes

• Fixed verification value consumption hanging on Cloudflare Workers when an earlier request for the same identifier ended mid-query (#12451)
• Fixed module-scope auth instances on Cloudflare Workers logging a schema validation error on every cold start by validating on first use (#12448)
• Fixed deferSessionRefresh refresh requests failing with a 415 error in Next.js and Nuxt (#12330)
• Fixed ReferenceError: window is not defined when a client session subscription is cleaned up after a test environment tears down its globals (#12324)
• Fixed client session refresh listeners piling up on the server during SSR (#12324)
• Fixed session polling never firing when the runtime's navigator does not report connectivity (#12462)
• Fixed OAuth sign-up rejected by a user.create.before hook returning false logging a TypeError (#12331)
• Fixed deleteOrganization clearing the session's active organization when a beforeDeleteOrganization hook rejected the delete (#12334)
• Fixed revokeSession, revokeSessions, and deleteUser({ token }) to expire session cookies when revoking the current session or deleting the user (#12321)
• Fixed getSession to no longer leave an expired session in the request context after returning null (#12459)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed introspected access tokens that fail aud, iss, exp, or nbf claim checks to return a 401 instead of a 500 (#12432)
• Fixed getSession failing with "Failed to get session" when a user.additionalFields entry references a table outside the Better Auth schema (#12333)
• Fixed resource-server challenges turning rejected requests into 500 errors, and added invalid_token error details when a presented token fails verification (#12445)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed failed requests using the DPoP authorization scheme to receive a DPoP challenge instead of a Bearer challenge (#12447)
• Fixed resource-server challenges turning rejected requests into 500 errors, and added invalid_token error details when a presented token fails verification (#12445)
• Fixed /oauth2/userinfo to send a WWW-Authenticate challenge on every 401 response, including DPoP failures and requests with no token (#12446)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed getSession failing with "Failed to get session" when a user.additionalFields entry references a table outside the Better Auth schema (#12333)

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

• Fixed failed requests using the DPoP authorization scheme to receive a DPoP challenge instead of a Bearer challenge (#12447)

For detailed changes, see CHANGELOG

@better-auth/prisma-adapter

Bug Fixes

• Fixed getSession failing with "Failed to get session" when a user.additionalFields entry references a table outside the Better Auth schema (#12333)

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

• Fixed Stripe customer.subscription.updated webhooks for customers with no local subscription to log a clear warning instead of failing with a TypeError (#12473)

For detailed changes, see CHANGELOG

@better-auth/telemetry

Bug Fixes

• Fixed requests failing on Cloudflare Workers for module-scope auth instances when telemetry is enabled without a static baseURL (#12448)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.7.21...v1.7.22

Action required

• If you use SCIM with an adapter that has no native transactions, switch to an adapter with native transactions to provision users and groups. (#12413)
• If you use the MongoDB adapter and an index build fails because of duplicate values, missing createIndex permission, or a conflicting index on the same field, fix the cause and restart. (#12299)
• If you rely on update changing every row that matches a non-unique filter, use updateMany instead. (#12390)
• If you set discoveryHeaders and your discoveryUrl redirects to another origin, set discoveryUrl to the final URL, because discovery now fails on cross-origin redirects. (#12179)
• If your clients match on the invalid_client_metadata error code for rejected post_logout_redirect_uris, update them to check for invalid_redirect_uri. (#12391)
• If you throw from sendVerificationEmail to reject a sign-up, use a databaseHooks.user.create.before hook instead, because a thrown error is now logged and the sign-up still succeeds. (#12052)
• If a wildcard in baseURL.allowedHosts covers your passkey rpID, you don't set origin, and you add tenants at runtime, return their origins from a trustedOrigins function that checks your tenant records. (#12388)

better-auth

Bug Fixes

• Fixed plugin packages importing from the better-auth root, so bundlers no longer emit unused Kysely chunks when used with better-auth/minimal (#12404)
• Fixed magic link and email OTP sign-in failing with a 500 for users with an unverified email on Prisma with MongoDB when id columns use @db.ObjectId (#12126)
• Fixed the device approval page showing a valid code as invalid when the same signed-in user looked it up twice at once, such as under React Strict Mode (#12392)
• Fixed sign-ins with a genericOAuth provider using discoveryUrl and OAuth provider requests using resources hanging on Cloudflare Workers (#12395)
• Fixed Generic OAuth to send authorizationHeaders on access token refresh, added an optional headers input to refreshAccessToken and refreshAccessTokenRequest, and prevented invalid combined headers with differently cased client authentication headers (#12401)
• Fixed generic OAuth to send discoveryHeaders when fetching same-origin jwks_uri keys, and to follow discovery redirects only within the discoveryUrl origin (#12179)
• Fixed intermittent schema does not exist and relation does not exist errors on PostgreSQL during the startup schema check and npx auth@latest migrate when other schemas are dropped concurrently (#11912)
• Fixed email sign-up to keep database writes made while sending verification emails or running onExistingUserSignUp when using a background task handler with a transactional adapter (#12052)
• Fixed SIWE verification to stop exposing internal error messages in its 401 response and log them on the server instead (#12403)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed the OAuth provider returning [object Promise] instead of the refresh token when formatRefreshToken.encrypt is async (#12409)
• Fixed magic link and email OTP sign-in failing with a 500 for users with an unverified email on Prisma with MongoDB when id columns use @db.ObjectId (#12126)
• Fixed sign-ins with a genericOAuth provider using discoveryUrl and OAuth provider requests using resources hanging on Cloudflare Workers (#12395)
• Changed OAuth provider client registration and updates to return invalid_redirect_uri instead of invalid_client_metadata for rejected post_logout_redirect_uris entries (#12391)
• Fixed OAuth provider returning a 500 on near-simultaneous refresh token reuse for opaque access tokens on databases that enforce foreign keys (#11911)
• Fixed OAuth provider consent denial to redirect to the client only while the client is enabled and its redirect_uri is still valid (#12385)
• Fixed OAuth provider to revoke in-flight opaque access tokens after refresh token reuse or a replayed authorization code on databases without foreign keys (#12389)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed null filters on id and reference fields being coerced to 0 when advanced.database.generateId is "serial" (#12402)
• Fixed authentication requests hanging on Cloudflare Workers when the request that started schema validation ended before validation finished (#11716)
• Fixed magic link and email OTP sign-in failing with a 500 for users with an unverified email on Prisma with MongoDB when id columns use @db.ObjectId (#12126)
• Fixed Generic OAuth to send authorizationHeaders on access token refresh, added an optional headers input to refreshAccessToken and refreshAccessTokenRequest, and prevented invalid combined headers with differently cased client authentication headers (#12401)
• Fixed telemetry to report Cloudflare Workers as workerd instead of node when nodejs_compat is enabled, and exported the runtime detection from @better-auth/core/env (#12425)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed plugin packages importing from the better-auth root, so bundlers no longer emit unused Kysely chunks when used with better-auth/minimal (#12404)
• Fixed SAML Single Logout so refreshing a session extends that session's own logout record, for users signed in more than once with the same NameID on the Prisma or MongoDB adapter (#12424)
• Fixed SAML Single Logout (saml.enableSingleLogout) for users who stay signed in past their session's first expiry, for both IdP-initiated and SP-initiated logout (#12417)
• Fixed SAML replay protection to reject a signed response resubmitted with its assertion ID written as XML character references when allowIdpInitiated: true or enableInResponseToValidation: false is set (#12421)

For detailed changes, see CHANGELOG

@better-auth/prisma-adapter

Bug Fixes

• Fixed magic link and email OTP sign-in failing with a 500 for users with an unverified email on Prisma with MongoDB when id columns use @db.ObjectId (#12126)
• Fixed Prisma adapter updates comparing a unique field with null failing with a validation error, and update now changes only one matching row (#12390)
• Fixed the Prisma adapter with provider: "mongodb" to match contains, starts_with, ends_with, and case-insensitive filters as literal text instead of regex patterns (#11807)

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Fixed plugin packages importing from the better-auth root, so bundlers no longer emit unused Kysely chunks when used with better-auth/minimal (#12404)
• Fixed SCIM Groups with more than 100 members to sync in full, including Group creation, updates, deletion, role mapping, and managed connection listings (#12070)
• Fixed apps using the SCIM plugin on adapters without native transactions, such as Cloudflare D1, failing at startup; /scim/v2 requests now return 501 Not Implemented on those adapters (#12413)

For detailed changes, see CHANGELOG

@better-auth/electron

Bug Fixes

• Fixed failed deep link authentication in Electron to be logged instead of causing an unhandled promise rejection in the main process (#12409)
• Fixed plugin packages importing from the better-auth root, so bundlers no longer emit unused Kysely chunks when used with better-auth/minimal (#12404)

For detailed changes, see CHANGELOG

@better-auth/api-key

Bug Fixes

• Fixed plugin packages importing from the better-auth root, so bundlers no longer emit unused Kysely chunks when used with better-auth/minimal (#12404)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed plugin packages importing from the better-auth root, so bundlers no longer emit unused Kysely chunks when used with better-auth/minimal (#12404)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed intermittent schema does not exist and relation does not exist errors on PostgreSQL during the startup schema check and npx auth@latest migrate when other schemas are dropped concurrently (#11912)

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

• Added indexes in the MongoDB adapter for schema fields marked unique or index, preventing duplicate users from concurrent sign-ups with the same email (#12299)

For detailed changes, see CHANGELOG

@better-auth/passkey

Bug Fixes

• Fixed passkey startup to no longer require origin when a wildcard in baseURL.allowedHosts covers your rpID, accepting exact trusted origins instead (#12388)

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

• Fixed plugin packages importing from the better-auth root, so bundlers no longer emit unused Kysely chunks when used with better-auth/minimal (#12404)

For detailed changes, see CHANGELOG

@better-auth/telemetry

Bug Fixes

• Fixed telemetry to report Cloudflare Workers as workerd instead of node when nodejs_compat is enabled, and exported the runtime detection from @better-auth/core/env (#12425)

For detailed changes, see CHANGELOG

@better-auth/test-utils

Bug Fixes

• Fixed the adapter test for findMany with multiple operators to create users from generated data like other adapter tests (#12409)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.7.20...v1.7.21

Action required

• If your issuer (baseURL, or jwt.issuer when set) uses http on a non-loopback host behind a TLS-terminating proxy, set baseURL to the public https URL, since discovery and the iss parameter no longer rewrite it to https. (#11904)

@better-auth/oauth-provider

Bug Fixes

• Fixed POST /oauth2/public-client-prelogin with allowPublicClientPrelogin to return a client only when its client_id matches the signed oauth_query, otherwise responding with 401 invalid_client (#12237)
• Fixed oauthProviderResourceClient(auth) defaults to accept issued access tokens when baseURL is only an origin, by including the auth path in the default issuer, JWKS, and introspection URLs (#12234)
• Added an allowInsecureRedirectUri option so OAuth provider deployments served over HTTP on private networks can accept http redirect URIs (#11904)

For detailed changes, see CHANGELOG

@better-auth/prisma-adapter

Bug Fixes

• Fixed Prisma adapter incrementOne and update calls using mode: "insensitive" filters to match case-insensitively on PostgreSQL and MongoDB (#11809)
• Fixed Prisma adapter queries with eq null on MongoDB to also match records where the optional field was never set (#11806)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Added an allowInsecureRedirectUri option so OAuth provider deployments served over HTTP on private networks can accept http redirect URIs (#11904)

For detailed changes, see CHANGELOG

@better-auth/memory-adapter

Bug Fixes

• Fixed ne null where clauses in the memory adapter to no longer match records where the field was never set (#11806)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed SAML assertion validation to apply the default 5-minute saml.clockSkew to the NotBefore and NotOnOrAfter checks in samlify (#12309)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.7.19...v1.7.20

better-auth

Bug Fixes

• Fixed /admin/create-user leaving a user without a credential account when creating that account failed, such as a database hook throwing, which made retrying with the same email fail with USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL (#12338)
• Fixed /admin/create-user leaving a user without a credential account when the password was rejected, such as by the Have I Been Pwned plugin, which made retrying with the same email fail with USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL (#12335)
• Fixed client actions ignoring the HTTP method passed in second-argument fetch options, and attaching a request body when the method was a lowercase get or HEAD (#12336)
• Fixed plugin schema overrides (modelName and field names) leaking into other instances of the same plugin in one process (#12319)
• Fixed /device/token returning invalid_grant instead of invalid_client when validateClient rejects the client_id, matching /device/code and RFC 6749 section 5.2 (#12246)
• Fixed OAuth sign-in failing with state_mismatch during the daylight saving time fall-back hour when OAuth state is stored in the database and the server's time zone observes daylight saving time (#12320)
• Fixed the OpenAPI schema to document query parameters for endpoints whose query schema is wrapped in z.optional(), such as /get-session and Stripe's /subscription/list (#12337)
• Fixed organization.getInvitation to return the INVITATION_NOT_FOUND code for a missing, expired, or non-pending invitation (#12332)
• Fixed listMembers failing with a syntax error on PostgreSQL and MSSQL when the filter matches no members or the offset is past the last member (#12318)
• Fixed the active-sessions list in secondary storage being stored without an expiry when every remaining session had less than a second left (#12323)
• Fixed SIWE sign-in leaving a user behind when creating its wallet address or account failed, which blocked that wallet from signing in again (#12366)
• Fixed social sign-up hanging on single-connection databases when the username plugin is enabled and the provider profile maps a username (#12340)

For detailed changes, see CHANGELOG

auth

Bug Fixes

• Fixed CLI commands hanging or exiting with code 0 at a prompt in CI or without a terminal. They now exit with code 2 and name what they need, such as --yes, and prompts appear on stderr so redirecting stdout no longer hides them (#12286)
• Fixed CLI notices mixing into command output. auth info --json --copy now prints valid JSON, auth secret prints only the BETTER_AUTH_SECRET line on stdout, auth login and auth logout messages go to stderr, and auth info shows tips only in an interactive terminal (#12287)
• Fixed CLI errors printing a stack trace instead of the cause. Config and database errors now show their message, and a mistyped --config path reports that the file doesn't exist. auth mcp and auth ai no longer report success after a failed step (#12305)
• Fixed the CLI exiting with code 0 after a canceled or failed run. Canceling or declining a prompt, or pressing Ctrl+C, now exits with 130, and failures such as a missing config file or a failed auth mcp setup exit with 1 (#12275)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed auth.api.oauth2Consent({ headers, body }) failing with request not found when called from a server route (#12325)
• Fixed a client secret without the configured prefix.clientSecret getting a different error than other wrong secrets. It now gets the standard invalid_client response: 401 with a WWW-Authenticate: Basic challenge for client_secret_basic, and 400 for client_secret_post (#12327)
• Fixed OAuth client metadata being stored as a JSON string in its json column. It is now written as an object, so Postgres jsonb operators such as -> and @> work with adapters that pass JSON through natively (Drizzle pg). Rows written as strings by earlier versions are still read (#12328)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed failed fallback join queries printing the raw database error, including SQL and bound values, with console.error in addition to the configured logger (#12317)
• Fixed getAccessToken and refreshToken returning the expired access token when a provider refuses a token refresh with a 200 status, as GitHub does (#12369)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed the Expo authorization proxy logging a provider configuration error on every OAuth sign-in when a social provider is set up for ID token sign-in only, such as Apple without a client secret (#12368)

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

• Fixed MCP rejecting plain-HTTP resource URLs on .localhost subdomains as non-HTTPS (#12322)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.7.18...v1.7.19

Action required

• If you use getTestInstance with testWith: "mysql", run a MySQL server at 127.0.0.1:3306 with the root password set to root_password. (#12244)

better-auth

Bug Fixes

• Fixed "revoke all sessions" with secondaryStorage and storeSessionInDatabase to also revoke sessions created while the revocation is running, except sessions created by a session.delete.after hook, which stay active (#12259)
• Fixed getTestInstance from better-auth/test to close its own Postgres connection pool and SQLite database when the test file finishes, while with Vitest's default sequence.hooks: "stack" your afterAll hooks still run first and can keep using the instance (#12250)
• Fixed getTestInstance with testWith: "mysql" hanging, and added a separate database per instance so several instances can run in one test file (#12244)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed resource servers rejecting all introspected tokens when verifyOptions.typ is set together with remoteVerify (#12249)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.7.17...v1.7.18

better-auth

Bug Fixes

• Fixed sessions created by a session.delete.after hook being treated as revoked during "revoke all sessions" when using secondaryStorage with storeSessionInDatabase (#12212)
• Fixed remembered sign-ins and sign-ups to refresh their session even if an earlier sign-in in the same browser used rememberMe: false (#12181)
• Fixed denying a device authorization request to reject a revoked session that is still in the cookie cache (#12216)
• Fixed IP wildcard trusted origins such as exp://192.168.*.*:* matching custom-scheme hosts with out-of-range or zero-padded octets (#12217)
• Fixed the phone number plugin storing an empty phoneNumber on sign-up and replacing a verified number when linking an account with an empty phone number (#12219)
• Fixed TOTP verification rejecting API key sessions so they can now finish two-factor enrollment (#12211)
• Fixed trusted devices being ignored when an app runs the two-factor sign-in step from its own hook on another sign-in path, such as email OTP (#12228)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed Expo social sign-in to reject authorization URLs without a state parameter when OAuth state is stored in a cookie (#12218)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed MySQL create with generateId: "serial" leaving an inserted row behind when the table reports no auto-increment id (#12220)

For detailed changes, see CHANGELOG

@better-auth/passkey

Bug Fixes

• Fixed passkey registration and sign-in when one passkey() plugin is shared between auth instances where only some set baseURL (#12225)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.7.16...v1.7.17

better-auth

Bug Fixes

• Fixed revoked sessions staying usable with secondary storage or the cookie cache. Bulk revocation now ends sessions missing from the cached list, and passkey registration, device authorization, two-factor, social account linking, and phone number changes check the session store (#12198)
• Fixed phone numbers being stored before they are verified. Sign-up and sign-in reject a phoneNumber in the request, social profiles no longer set an unverified number, and verification codes use their own namespace (#12198)
• Fixed /admin/update-user changing phone numbers without permission. It now requires user:set-phone, so add set-phone to custom access control statements (#12198)
• Fixed email OTP accepting more guesses than allowedAttempts under concurrent requests, and bound email change codes to the requesting account (#12198)
• Fixed user lookup by email matching a different address on accent-insensitive database collations (#12198)
• Fixed email verification and change email links working for an account other than the one they were issued to (#12198)
• Fixed OAuth sign-in treating a string email_verified value such as "false" as verified, and bound generic OAuth profiles to the ID token subject (#12198)
• Fixed organization roles with extra whitespace passing role checks, and limited pending invitations to members who can manage them (#12198)
• Fixed wildcard trusted origins matching URLs outside the intended scheme, host, or path (#12198)
• Fixed anonymous users being linked on a sign-in still waiting for a second factor (#12198)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed the Zoom provider ignoring disableSignUp, requireEmailVerification, and overrideUserInfoOnSignIn (#12198)
• Fixed string email_verified claims from Cognito and Microsoft Entra ID being read as verified (#12198)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed the authorization proxy signing a state the server did not issue and redirecting to hosts that are not configured providers (#12198)

For detailed changes, see CHANGELOG

@better-auth/electron

Bug Fixes

• Fixed sign-in returning the internal auth context when the transfer cookie is not a transfer request, and bound desktop authorization codes to the browser session that issued them (#12198)

For detailed changes, see CHANGELOG

@better-auth/passkey

Bug Fixes

• Fixed the expected WebAuthn origin coming from the request instead of server configuration. Set origin when rpID is set and a wildcard in baseURL.allowedHosts covers it (#12198)
• Fixed userVerification: "required" not being enforced, and applied it to authentication as well as registration (#12198)

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

• Fixed sign-up and update-user requests setting stripeCustomerId. Server code that sets it through auth.api.updateUser must write it through the database adapter instead (#12198)
• Fixed webhooks attributing a subscription to the wrong record when several records share a Stripe customer ID (#12198)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed MySQL with generateId: "serial" returning another request's record on connection pools (#12198)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed MySQL with generateId: "serial" returning another request's record on connection pools (#12198)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.7.15...v1.7.16

better-auth

Bug Fixes

• Fixed organization and API key metadata, and OAuth proxy sign-ins with a constructor field in additionalData, failing with a prototype pollution error (#12142)
• Improved BETTER_AUTH_SECRETS error messages to report the entry position instead of including the entry value (#12098)
• Fixed the admin update-user endpoint to reject data.id with a 400 error instead of attempting to change the user's primary key (#12099)
• Fixed the admin plugin to reject banned users when a session is created outside an endpoint, such as through internalAdapter.createSession (#12100)
• Fixed headers and cookies set by a non-returning hooks.before hook being dropped from the response, with the endpoint's value winning when both set the same header or cookie (#12145)
• Fixed the Vue client's useSession(useFetch) returning no session during Nuxt SSR when baseURL is inferred from the environment (#12109)
• Fixed the genericOAuth HubSpot helper truncating access tokens with reserved characters and now returning null instead of requesting /access-tokens/undefined when no token is present (#12108)
• Fixed /sign-in/username and /is-username-available rejecting usernames that sign-up accepts when validationOrder.username is post-normalization (#12097)

For detailed changes, see CHANGELOG

auth

Bug Fixes

• Fixed auth init for Remix and React Router v7 to generate an app/routes/api.auth.$.ts resource route that mounts auth.handler instead of a second auth instance with an unsupported database option (#12118)
• Fixed auth ai overwriting MCP config files it cannot parse, such as those with comments or trailing commas, by leaving them unchanged and printing the config to add manually (#12111)
• Fixed auth login and auth logout re-launching the CLI through npx auth@latest in an endless loop (#12110)
• Fixed auth init hanging during database migration and removed a stray debug line about path aliases (#12148)

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

• Fixed /subscription/success returning a 500 for non-string callbackURL and checkoutSessionId query values by rejecting them with a 400 (#12105)
• Fixed /subscription/success to validate callbackURL against trusted origins after replacing {CHECKOUT_SESSION_ID}, preventing redirects to untrusted origins via checkoutSessionId (#12102)

For detailed changes, see CHANGELOG

@better-auth/api-key

Bug Fixes

• Fixed API keys in secondary storage failing to verify, load, and list when the storage client returns already-parsed JSON, such as @upstash/redis (#12107)

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

• Fixed the Node metadata transport crashing the process on responses with an out-of-range status or invalid reason phrase by reporting the client as invalid_client (#12103)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed built-in social providers following HTTP redirects on token exchange, refresh, verification, and JWKS signing key requests (#12106)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.7.14...v1.7.15

better-auth

Bug Fixes

• Fixed type declarations so type-only exports are no longer listed as values, making a value import fail type checking instead of failing at runtime (#11985)

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added token endpoint authentication options to the Vercel social provider, including dynamic OIDC tokens and private key JWT client assertions, without replacing the built-in sign-in flow (#11948)

Bug Fixes

• Added tokenEndpointAuth: { method } to the Cloudflare provider and deprecated tokenEndpointAuthMethod, which remains supported (#11997)

For detailed changes, see CHANGELOG

@better-auth/stripe

Features

• Added support for Stripe SDK v23 in the Stripe plugin (#11954)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.7.12...v1.7.13

Action required

• If you use ID token sign-in with a provider that has no clientId, set clientId to every client ID your apps sign in with. (#11931)

better-auth

Bug Fixes

• Fixed the JWT plugin to verify JWTs and session cookie-cache JWTs with the stored key's algorithm instead of the token header's, and to warn when signing or verifying a JWT without an issuer or audience (#11925)
• Fixed OAuth callbacks completed through the OAuth proxy to run the same checks as the standard OAuth callback, including issuer and ID token nonce validation (#11930)
• Fixed auth.api.getSession() to keep the original database error as error.cause when the session lookup fails (#11924)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed mapProfileToUser failing to typecheck under exactOptionalPropertyTypes when it returns undefined for name, email, or image (#11918)
• Fixed ID token sign-in to reject tokens when the provider has no client ID, since their audience cannot be checked (#11931)
• Fixed a custom Facebook getUserInfo to no longer receive client-submitted access tokens issued to another Facebook app, and ID tokens missing exp or iat are now rejected (#11919)
• Restored the Twitch and Paybin ID token handling from before 1.7.11, which made account info fail once the ID token stored at sign-in expired (#11920)
• Added a cause option as a third argument to APIError.from() to keep the underlying error for server-side callers without exposing it in the response (#11924)

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

• Fixed requireMcpAuth to accept only OAuth access tokens and reject session JWTs from the JWT plugin, even when they share the issuer and audience (#11934)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed OIDC SSO sign-in to reject ID tokens missing exp or iat and providers with an empty client ID, matching social sign-in (#11935)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.7.11...v1.7.12

better-auth

Bug Fixes

• Fixed repeated PostgreSQL migration diffs for int8 columns. (#10719)
• Fixed database-backed rate limiting returning an excessively large X-Retry-After value. (#11521)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed plugin init returns with options: undefined failing type checks under exactOptionalPropertyTypes. (#11907)
• Fixed ID token signature and claim validation for Twitch and Paybin sign-in. Custom Paybin issuers must publish RS256 signing keys at <issuer>/.well-known/jwks.json. (#11884)
• Reduced installation size while preserving OpenTelemetry instrumentation attributes. (#11623)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed OpenAPI schemas for /oauth2/consent and /oauth2/continue to match their redirect responses. (#10881)
• Fixed CIMD metadata refreshes overwriting concurrent administrator changes to discovered clients. (#11830)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed Expo social account linking with ID tokens when a session cookie is present. (#10207)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.7.10...v1.7.11

better-auth

Bug Fixes

• Fixed Captcha and OpenAPI plugin subpath imports and type resolution for better-auth/plugins/multi-session and better-auth/test. (#11822)
• Fixed Google One Tap sign-ins not recording google as the last login method. (#11393)
• Fixed imports from better-auth/plugins/one-tap failing with a not-exported error. (#11696)
• Fixed Google One Tap ignoring plugin-level autoSelect and cancelOnTapOutside settings. (#11820)
• Fixed Google One Tap sign-ins ignoring configured Google profile mapping and user info updates. (#11819)
• Fixed Google One Tap calling a prompt method unsupported by FedCM and retrying skipped prompts. (#11821)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

• Added optional self-service signing key rotation for private_key_jwt clients. (#11695)

Bug Fixes

• Fixed valid DPoP proofs being rejected for parameterized routes and URLs with trailing slashes. (#11786)
• Fixed native clients with HTTP loopback callbacks being rejected when application type inference is enabled. (#11798)
• Fixed device-code clients being unable to refresh access for approved resources omitted from a token poll. (#11815)
• Fixed OAuth consent without a reference overwriting or reusing consent for a different reference. (#11801)
• Fixed dynamic client registration rejecting requests that include both supported and unsupported grants. (#11797)
• Fixed attempts to change cached trusted clients returning HTTP 500 instead of HTTP 400. (#11781)
• Improved errors for unknown OAuth client_id values to say client not found. (#11799)
• Fixed PKCE verifier errors to return the specified HTTP 400 response and error code. (#11724)
• Fixed unknown OAuth clients receiving invalid_grant instead of invalid_client at the token endpoint. (#11176)
• Fixed unverifiable JWT access tokens causing server errors at /oauth2/userinfo, /oauth2/introspect, and /oauth2/revoke. (#11596)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Limited JWKS refetches for unknown key IDs to protect servers from repeated requests. (#11805)
• Fixed unreachable JWKS endpoints being reported as invalid tokens instead of server errors. (#11612)

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

• Fixed MongoDB findMany ignoring ID sorting and potentially repeating or skipping paginated results. (#11801)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.7.9...v1.7.10

better-auth

Bug Fixes

• Aligned cookie security attributes with RFC 6265bis (#11540)
• Added SvelteKit 3 to the supported peer dependency range (#11488)
• Fixed stale cookies persisting after customSession sessions expire or are revoked (#10591)
• Fixed customSession treating session lookup errors as signed-out users (#11391)
• Fixed sign-in failures, replay checks, and SIWE email handling with generateId: "uuid" (#11625)
• Removed non-returned custom fields from inferred output schema types (#11565)
• Fixed Kysely migration foreign keys when custom table names match another model key (#11505)
• Reduced organization plugin server bundles by excluding unused Zod locales (#10866)
• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)
• Fixed generic OAuth providers remaining unavailable after discovery fails at startup by retrying on subsequent requests (#11750)
• Fixed lastLoginMethod sign-in failures when cookieName or maxAge is explicitly undefined (#11549)
• Fixed magic link verification changing percent-encoded characters in callback URLs (#11174)
• Fixed type errors when using oauthProvider() or mcp() with exactOptionalPropertyTypes (#10266)
• Fixed organization plugin type errors in projects with skipLibCheck: false (#11637)
• Fixed failed password resets consuming reset links or OTPs before the new password is saved (#11646)
• Fixed password resets and changes retaining the new password when database session revocation fails (#11626)
• Fixed phone number password resets to use a configured verifyOTP callback (#10698)
• Fixed secondary-storage session failures leaving sign-ups, passkey registrations, or SSO sign-ins in an inconsistent state (#11643)
• Fixed missing device sessions and failed automatic session switching after cache eviction (#11718)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed ID token sign-in failures caused by up to 30 seconds of clock difference with identity providers (#11749)
• Fixed Atlassian user info errors being mislabeled as Figma errors in logs (#11592)
• Fixed authentication requests hanging after interrupted async context initialization (#11711)
• Fixed recognition of valid AsyncLocalStorage initialized after importing Better Auth but before first use, and corrected misleading errors for invalid runtime-provided values in edge and browser fallbacks. (#11712)
• Fixed after hooks being skipped for writes retained after a failed request on adapters without transactions (#11645)
• Fixed Microsoft Entra ID sign-in and account linking with ID tokens when signing keys omit alg (#11663)
• Fixed sign-in failures, replay checks, and SIWE email handling with generateId: "uuid" (#11625)
• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)
• Fixed concurrent MongoDB writes failing with transaction conflicts by retrying transient errors (#11515)
• Added support for host-bearing custom-scheme redirect URIs for native OAuth clients (#10956)
• Fixed password resets and changes retaining the new password when database session revocation fails (#11626)
• Fixed secondary-storage session failures leaving sign-ups, passkey registrations, or SSO sign-ins in an inconsistent state (#11643)
• Fixed missing device sessions and failed automatic session switching after cache eviction (#11718)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

• Added support for pausing and resuming OAuth clients through adminUpdateOAuthClient (#11654)
• Added support for linking protected resources when registering a client with adminCreateOAuthClient (#11655)
• Added resource identifier validation for adminCreateOAuthResource and configured resources (#11655)
• Added clientId to clientPrivileges checks for actions on existing OAuth clients (#11658)

Bug Fixes

• Fixed sign-in failures, replay checks, and SIWE email handling with generateId: "uuid" (#11625)
• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)
• Added support for host-bearing custom-scheme redirect URIs for native OAuth clients (#10956)
• Fixed startup resource-seeding failures from blocking authentication routes until restart (#11726)
• Fixed type errors when using oauthProvider() or mcp() with exactOptionalPropertyTypes (#10266)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)
• Fixed SSO provider registration and updates rejecting partial mapping values that omit defaulted fields (#11378)
• Fixed SAML providers with linked accounts rejecting IdP signing certificate rotation (#11687)
• Rejected OIDC SSO providers whose configured issuer does not match discovery, preventing later sign-in failures (#11438)
• Fixed SAML providers with linked accounts rejecting changes to their post-login callbackUrl (#11743)
• Fixed OIDC sign-in when the mapped email claim contains a list of addresses (#11640)

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Fixed SCIM reprovisioning of inactive users with an existing externalId (#11167)
• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)
• Fixed SCIM requests silently ignoring attribute names with different letter case (#11644)
• Fixed concurrent SCIM updates to return 409 instead of 500 when a unique value is already claimed (#11669)
• Fixed SCIM User and Group requests rejecting nullable attributes sent as JSON null (#11638)

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)
• Fixed failed MongoDB transaction commits leaving transactions open and blocking other writes (#11602)
• Fixed concurrent MongoDB writes failing with transaction conflicts by retrying transient errors (#11515)
• Fixed MongoDB authentication errors masking the original transaction commit failure (#11014)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)
• Fixed Drizzle sign-in, session refresh, and date filtering with string-based date columns (#11731)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)
• Fixed cross-request I/O errors from concurrent D1 queries on a shared auth instance with Kysely 0.29 (#11490)

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

• Fixed @better-auth/mcp type errors with exactOptionalPropertyTypes and skipLibCheck: false (#11635)
• Fixed type errors when using oauthProvider() or mcp() with exactOptionalPropertyTypes (#10266)

For detailed changes, see CHANGELOG

@better-auth/api-key

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

• Added support for host-bearing custom-scheme redirect URIs for native OAuth clients (#10956)

For detailed changes, see CHANGELOG

@better-auth/electron

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)

For detailed changes, see CHANGELOG

@better-auth/memory-adapter

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)

For detailed changes, see CHANGELOG

@better-auth/passkey

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)

For detailed changes, see CHANGELOG

@better-auth/prisma-adapter

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

• Stopped reporting completed one-time Stripe checkouts as webhook failures (#9684)

For detailed changes, see CHANGELOG

@better-auth/telemetry

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages (#11512)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.7.7...v1.7.8

better-auth

Magic Link upgrade: Upgrade servers sharing verification storage together, request new Magic Links, and restart pending OAuth/SAML sign-ins. No database migration is required. See the critical advisory for affected configurations and custom storage changes.

Bug Fixes

• Fixed a critical Magic Link account-takeover vulnerability. (#11494)
• Fixed ID-token sign-in ignoring the social provider’s disableSignUp setting. (#11491)
• Fixed OAuth Proxy accepting sign-in state as a provider profile. (#11494) Upgrade all OAuth Proxy participants together; see the OAuth Proxy upgrade guidance.
• Fixed CAPTCHA errors missing the JSON Content-Type header. (#11476)
• Fixed the active organization failing to refresh after sign-in when a session hook selects the initial organization. (#11375)
• Fixed rate-limit errors missing the JSON Content-Type header. (#11469)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

• Added optional validateRedirectUri validation for trusted deployments with dynamic OAuth redirect URIs. (#8686)
• Added verifyOAuthQueryParams to verify signed authorization queries before rendering a custom consent page. (#11402)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed concurrent PostgreSQL requests exceeding database-backed rate limits. (#11331)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed consumeOne deleting a record after a concurrent write invalidates its original condition. (#11495)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.7.6...v1.7.7

better-auth

Features

• Added support for a bannedUserMessage function that receives the banned user, allowing sign-in errors to include details such as the ban reason. (#11325)
• Added Vercel BotID as a captcha provider for protected authentication routes. (#11016)

Bug Fixes

• Passwords over maxPasswordLength are now rejected with PASSWORD_TOO_LONG before hashing or verification. (#11324)
• Fixed React hydration mismatches when session or plugin auth queries resolve before streamed components hydrate. (#11316)
• Prevented older auth-query responses from overwriting newer results when requests overlap. (#11376)
• Fixed model identity when a custom model name matches another schema key. (#11333)
• Fixed schema validation for Cloudflare D1 when the Kysely dialect cannot introspect the database. (#11366)
• Fixed social account linking through the OAuth Proxy plugin. (#11268)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed model identity when a custom model name matches another schema key. (#11333)
• Fixed schema validation for SQLite-generated primary keys, including INTEGER PRIMARY KEY columns without AUTOINCREMENT. (#11374)
• Fixed schema validation for Cloudflare D1 when the Kysely dialect cannot introspect the database. (#11366)

For detailed changes, see CHANGELOG

@better-auth/prisma-adapter

Bug Fixes

• Fixed model identity when a custom model name matches another schema key. (#11333)
• Fixed schema validation for capitalized custom Prisma model names. (#11319)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed model identity when a custom model name matches another schema key. (#11333)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed model identity when a custom model name matches another schema key. (#11333)

For detailed changes, see CHANGELOG

@better-auth/memory-adapter

Bug Fixes

• Fixed model identity when a custom model name matches another schema key. (#11333)

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

• Fixed model identity when a custom model name matches another schema key. (#11333)

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

• Fixed automatic seat updates after an organization resubscribes, even when canceled subscriptions remain in its history. (#11347)

For detailed changes, see CHANGELOG

auth

Features

• Added read-only check and check schema commands to validate your configured adapter schema on demand. (#11314)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.7.5...v1.7.6

better-auth

Features

• Added database.schemaName support for direct PostgreSQL connections. (#11203)

Bug Fixes

• Improved server-side logging for Cloudflare Turnstile verification failures. (#11283)
• Fixed PostgreSQL migrations incorrectly identifying tables and views across schemas. (#11270)
• Fixed MySQL index validation for existing string columns. (#11272)
• Removed the unused optional better-sqlite3 peer dependency to prevent installation conflicts. (#11209)

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added database.schemaName support for direct PostgreSQL connections. (#11203)

Bug Fixes

• Fixed database option type inference outside Cloudflare Workers. (#11290)

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

• Fixed unnecessary pacing of consecutive CIMD OAuth requests when metadata cannot be cached. (#11161)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed lazy database initialization when using Drizzle relations. (#11263)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Features

• Added database.schemaName support for direct PostgreSQL connections. (#11203)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

Full changelog: v1.7.4...v1.7.5