Verify SSO domains

Enable domain verification

To require proof of domain ownership, set domainVerification.enabled. Without it, a provider can sign users in for any domain its registrant lists, even one the registrant does not own. With it, every new provider starts unverified, and sign-in through it returns 401 with "Provider domain has not been verified" until its domains are verified. A verified domain also lets SSO link existing users whose email matches it, and enables domain-based organization assignment. Providers configured in defaultSSO count as verified.

With domain verification disabled, Better Auth never creates organization memberships from email-domain matches. Providers linked to an organization still provision members, and signIn.sso still finds providers by email or domain.

Enable the option on the server and on the client. On the client, it adds the verification endpoints to the types.

import { betterAuth } from "better-auth";
import { sso } from "@better-auth/sso";

export const auth = betterAuth({
  plugins: [
    sso({
      domainVerification: { enabled: true }, 
    }),
  ],
});

The option adds the domainVerified field to the ssoProvider table, so migrate the database again.

npx auth migrate

See the Schema section to add the fields manually.

Verify your domain

const { data, error } = await authClient.sso.verifyDomain({    providerId: "acme", // required, The ID of the provider to verify.});

const data = await auth.api.verifyDomain({    body: {        providerId: "acme", // required, The ID of the provider to verify.    },    // This endpoint requires session cookies.    headers: await headers(),});

The call returns 204 and marks the provider verified only if every listed domain answers with the record. Sign-in through the provider then no longer returns 401 for an unverified domain. You do not need to call verify-domain again unless the provider's domain changes.

If the provider changes while the check runs, verify-domain returns 409 with SSO_PROVIDER_CHANGED:

• If its domains changed, reload the provider and retry.
• If it was deleted, there is nothing left to verify.

Request a verification token

const { data, error } = await authClient.sso.requestDomainVerification({    providerId: "acme", // required, The ID of the provider to issue a token for.});

const data = await auth.api.requestDomainVerification({    body: {        providerId: "acme", // required, The ID of the provider to issue a token for.    },    // This endpoint requires session cookies.    headers: await headers(),});

It returns the current domainVerificationToken while that token is valid. When no valid token exists, it issues a new one. Update the TXT record with each new token. Tokens last one week.

Changing domain through update-provider resets domainVerified. Sign-in through the provider then returns 401 until you verify it again.

Errors

Both endpoints require access to the provider: the signed-in user must own it, or be an owner or admin of its organization. Without that access they return 403, and 404 when the provider does not exist.