@better-auth/core

❗ Breaking Changes

• Changed Paybin to use its published /oauth/* endpoints and return UserInfo data instead of stored ID-token claims, so profile mappings must handle omitted email and custom ID-token sign-ins using the default profile reader must supply accessToken (#11860)
• Changed Spotify profile fields to match the current user profile, so mappings must handle nullable display names, omitted email, and nullable image dimensions, and a missing display name leaves the local name unset while raw profile fields remain available (#11865)
• Changed Twitch to fetch current profile data with access tokens instead of using stored ID-token claims, so profile mappings must handle optional fields and custom ID-token sign-ins using the default profile reader must supply accessToken (#11848)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@bytaesu

Full changelog: v1.8.0-beta.3...v1.8.0-beta.4

better-auth

Bug Fixes

• Fixed organization and API key metadata, and OAuth proxy sign-ins with a constructor field in additionalData, failing with a prototype pollution error (#12142)
• Improved BETTER_AUTH_SECRETS error messages to report the entry position instead of including the entry value (#12098)
• Fixed the admin update-user endpoint to reject data.id with a 400 error instead of attempting to change the user's primary key (#12099)
• Fixed the admin plugin to reject banned users when a session is created outside an endpoint, such as through internalAdapter.createSession (#12100)
• Fixed headers and cookies set by a non-returning hooks.before hook being dropped from the response, with the endpoint's value winning when both set the same header or cookie (#12145)
• Fixed the Vue client's useSession(useFetch) returning no session during Nuxt SSR when baseURL is inferred from the environment (#12109)
• Fixed the genericOAuth HubSpot helper truncating access tokens with reserved characters and now returning null instead of requesting /access-tokens/undefined when no token is present (#12108)
• Fixed /sign-in/username and /is-username-available rejecting usernames that sign-up accepts when validationOrder.username is post-normalization (#12097)

For detailed changes, see CHANGELOG

auth

Bug Fixes

• Fixed auth init for Remix and React Router v7 to generate an app/routes/api.auth.$.ts resource route that mounts auth.handler instead of a second auth instance with an unsupported database option (#12118)
• Fixed auth ai overwriting MCP config files it cannot parse, such as those with comments or trailing commas, by leaving them unchanged and printing the config to add manually (#12111)
• Fixed auth login and auth logout re-launching the CLI through npx auth@latest in an endless loop (#12110)
• Fixed auth init hanging during database migration and removed a stray debug line about path aliases (#12148)

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

• Fixed /subscription/success returning a 500 for non-string callbackURL and checkoutSessionId query values by rejecting them with a 400 (#12105)
• Fixed /subscription/success to validate callbackURL against trusted origins after replacing {CHECKOUT_SESSION_ID}, preventing redirects to untrusted origins via checkoutSessionId (#12102)

For detailed changes, see CHANGELOG

@better-auth/api-key

Bug Fixes

• Fixed API keys in secondary storage failing to verify, load, and list when the storage client returns already-parsed JSON, such as @upstash/redis (#12107)

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

• Fixed the Node metadata transport crashing the process on responses with an out-of-range status or invalid reason phrase by reporting the client as invalid_client (#12103)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed built-in social providers following HTTP redirects on token exchange, refresh, verification, and JWKS signing key requests (#12106)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@bytaesu

Full changelog: v1.7.14...v1.7.15

better-auth

Bug Fixes

• Fixed ACCOUNT_NOT_FOUND when retrieving an access token after stateless OAuth sign-in links a new provider to an existing user (#11300)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed SAML sign-in for providers that use samlConfig.callbackUrl as their ACS URL without spMetadata.metadata, which had failed with invalid_saml_response since 1.6.21 (#11730)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@bytaesu, @gustavovalverde

Full changelog: v1.6.33...v1.6.34

better-auth

❗ Breaking Changes

• Fixed the Gumroad OAuth helper to return undefined for accounts without a name, matching its declared profile type (#11864)
• Fixed the Patreon OAuth helper to normalize null names and images to missing values while preserving empty strings, and to allow email to be null or omitted when email access is not granted (#11863)
• Fixed Slack sign-in to support scoped profiles with optional SlackProfile email and profile claims, use POST for userinfo in the built-in provider and Generic OAuth helper, and reject Slack errors returned with HTTP 200 (#11851)

For detailed changes, see CHANGELOG

@better-auth/core

❗ Breaking Changes

• Fixed Apple profile types to align with identity tokens, making private-email status, user status, and pictures optional and accepting boolean or string email-verification claims (#11842)
• Fixed CognitoProfile to make profile and token claims optional, accept boolean or "true"/"false" verification values, fall back to cognito:username for ID-token names, and verify tokens against both documented issuer formats (#11843)
• Fixed Discord profile types to reflect optional user metadata, added avatar decoration, collectible, and primary guild details, and defaulted missing email verification to false (#11867)
• Fixed Dropbox profile types to include account status, locale, referral links, pairing status, account type, team policies, and root information, with home_path required for team roots (#11846)
• Fixed Facebook Limited Login profile callbacks to accept tokens without name, email, or picture claims (#11856)
• Fixed GithubProfile types to match GitHub API responses, with numeric id and account counters, nullable details, and omitted scope-dependent fields such as twitter_username (#11839)
• Fixed GitLab profile handling for nullable details and omitted conditional fields, made locked a required boolean, and preserved stored images for null avatars when profile updates are enabled (#11853)
• Fixed LinearUser.avatarUrl to be required and typed as string | null, preserved stored images for null avatars during enabled profile updates, and made authorization scopes comma-separated (#11855)
• Fixed MicrosoftEntraIDProfile claim types so timestamps are numbers, groups, acrs, and xms_cc are string arrays, in_corp is boolean, and conditional claims and profile photos can be omitted (#11854)
• Fixed Notion users without an avatar to keep their existing profile image when profile updates are enabled, with optional type, nullable name and avatar_url, missing image as undefined, and optional person.email_verified metadata (#11859)
• Fixed PayPal profile types to handle omitted names, email, and verification claims when personal permissions are not granted, defaulting missing email verification to false (#11862)
• Fixed RailwayProfile to make email, name, and picture optional, reflecting the granted scopes (#11861)
• Fixed Slack sign-in to support scoped profiles with optional SlackProfile email and profile claims, use POST for userinfo in the built-in provider and Generic OAuth helper, and reject Slack errors returned with HTTP 200 (#11851)
• Fixed TwitterProfile types so nested entity objects, arrays, and URL details can be omitted or null, and added description cashtags, mentions, and URL preview metadata (#11852)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@bytaesu

Full changelog: v1.8.0-beta.2...v1.8.0-beta.3

better-auth

Bug Fixes

• Fixed two-factor TOTP to accept imported Base32 secrets stored as base32:<secret> (#12031)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed Kakao sign-in to forward loginHint so the Kakao Account login page opens with the ID field prefilled (#12045)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@bytaesu, @honuuk

Full changelog: v1.7.13...v1.7.14

better-auth

Bug Fixes

• Fixed type declarations so type-only exports are no longer listed as values, making a value import fail type checking instead of failing at runtime (#11985)

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added token endpoint authentication options to the Vercel social provider, including dynamic OIDC tokens and private key JWT client assertions, without replacing the built-in sign-in flow (#11948)

Bug Fixes

• Added tokenEndpointAuth: { method } to the Cloudflare provider and deprecated tokenEndpointAuthMethod, which remains supported (#11997)

For detailed changes, see CHANGELOG

@better-auth/stripe

Features

• Added support for Stripe SDK v23 in the Stripe plugin (#11954)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@allenzhou101, @bytaesu, @godwit-bo

Full changelog: v1.7.12...v1.7.13

@better-auth/core

❗ Breaking Changes

• Fixed GoogleProfile to reflect Google's optional ID token claims and to treat an absent email verification claim as unverified (#11847)
• fix(huggingface)!: align organization profile types (#11845)
• Fixed Kakao profiles to make KakaoProfile.kakao_account optional and to separate consent scopes with commas in authorization requests, as Kakao documents (#11857)
• Fixed KickProfile.user_id to be a number instead of a string (#11841)
• fix(linkedin)!: correct profile locale type (#11844)
• Fixed NaverProfile.response to make personal profile fields optional, matching what Naver may omit (#11858)
• Fixed Polar accounts to be identified by their userinfo subject and exposed the scoped, nullable userinfo claims in mapProfileToUser instead of unrelated user profile fields (#11840)
• Fixed Roblox userinfo types so scoped RobloxProfile fields are optional, picture can be null, and custom claims are unknown, and preserved stored images when a Roblox avatar is missing and profile updates are enabled (#11866)
• fix(vk)!: correct profile phone number type (#11849)
• Fixed Zoom profile types to include the phone number, WeChat, and Alipay login types (11, 21, and 23) (#11850)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

• feat(oauth-provider): give consentReferenceId the request and the user's choice (#11967)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@bytaesu, @gustavovalverde

Full changelog: v1.8.0-beta.1...v1.8.0-beta.2

better-auth

Bug Fixes

• Fixed the JWT plugin to verify JWTs and session cookie-cache JWTs with the stored key's algorithm instead of the token header's, and to warn when signing or verifying a JWT without an issuer or audience (#11925)
• Fixed OAuth callbacks completed through the OAuth proxy to run the same checks as the standard OAuth callback, including issuer and ID token nonce validation (#11930)
• Fixed auth.api.getSession() to keep the original database error as error.cause when the session lookup fails (#11924)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed mapProfileToUser failing to typecheck under exactOptionalPropertyTypes when it returns undefined for name, email, or image (#11918)
• Fixed ID token sign-in to reject tokens when the provider has no client ID, since their audience cannot be checked (#11931)
• Fixed a custom Facebook getUserInfo to no longer receive client-submitted access tokens issued to another Facebook app, and ID tokens missing exp or iat are now rejected (#11919)
• Restored the Twitch and Paybin ID token handling from before 1.7.11, which made account info fail once the ID token stored at sign-in expired (#11920)
• Added a cause option as a third argument to APIError.from() to keep the underlying error for server-side callers without exposing it in the response (#11924)

For detailed changes, see CHANGELOG

@better-auth/mcp

Bug Fixes

• Fixed requireMcpAuth to accept only OAuth access tokens and reject session JWTs from the JWT plugin, even when they share the issuer and audience (#11934)

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed OIDC SSO sign-in to reject ID tokens missing exp or iat and providers with an empty client ID, matching social sign-in (#11935)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@alpcanaydin, @bytaesu

Full changelog: v1.7.11...v1.7.12

better-auth

Bug Fixes

• Fixed repeated PostgreSQL migration diffs for int8 columns. (#10719)
• Fixed database-backed rate limiting returning an excessively large X-Retry-After value. (#11521)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed plugin init returns with options: undefined failing type checks under exactOptionalPropertyTypes. (#11907)
• Fixed ID token signature and claim validation for Twitch and Paybin sign-in. Custom Paybin issuers must publish RS256 signing keys at <issuer>/.well-known/jwks.json. (#11884)
• Reduced installation size while preserving OpenTelemetry instrumentation attributes. (#11623)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed OpenAPI schemas for /oauth2/consent and /oauth2/continue to match their redirect responses. (#10881)
• Fixed CIMD metadata refreshes overwriting concurrent administrator changes to discovered clients. (#11830)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed Expo social account linking with ID tokens when a session cookie is present. (#10207)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@aryan1306, @bytaesu, @cpojer, @gustavovalverde, @noobnooc, @rendermani, @sahiljagtap08

Full changelog: v1.7.10...v1.7.11

better-auth

Features

• Added a browser account chooser for Google sign-in buttons using FedCM on supported Chrome browsers (#11343)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• fix(drizzle-adapter): preserve required fields in relations v2 schemas (#11836)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

• Added support for assigning client_credentials scopes during protected OAuth client registration (#11832)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@bytaesu, @gustavovalverde, @qamarq

Full changelog: v1.8.0-beta.0...v1.8.0-beta.1