From 2ac4f9db3585d53355ef9e31df72e08d1100fe90 Mon Sep 17 00:00:00 2001
From: CaoMeiYouRen <40430746+CaoMeiYouRen@users.noreply.github.com>
Date: Thu, 17 Jul 2025 12:13:31 +0800
Subject: [PATCH] feat(generic-oauth): add support for additional token URL
 params in generic OAuth (#3410)

* feat(generic-oauth): add support for additional token URL params in generic OAuth

fix #3402

* Update packages/better-auth/src/oauth2/validate-authorization-code.ts

Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>

* fix: syntax error

---------

Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com>
---
 .../better-auth/src/oauth2/validate-authorization-code.ts  | 7 +++++++
 packages/better-auth/src/plugins/generic-oauth/index.ts    | 7 +++++++
 2 files changed, 14 insertions(+)

diff --git a/packages/better-auth/src/oauth2/validate-authorization-code.ts b/packages/better-auth/src/oauth2/validate-authorization-code.ts
index 0e120fd230..9a0021f353 100644
--- a/packages/better-auth/src/oauth2/validate-authorization-code.ts
+++ b/packages/better-auth/src/oauth2/validate-authorization-code.ts
@@ -13,6 +13,7 @@ export async function validateAuthorizationCode({
 	authentication,
 	deviceId,
 	headers,
+	additionalParams = {},
 }: {
 	code: string;
 	redirectURI: string;
@@ -22,6 +23,7 @@ export async function validateAuthorizationCode({
 	tokenEndpoint: string;
 	authentication?: "basic" | "post";
 	headers?: Record<string, string>;
+	additionalParams?: Record<string, string>;
 }) {
 	const body = new URLSearchParams();
 	const requestHeaders: Record<string, any> = {
@@ -46,6 +48,11 @@ export async function validateAuthorizationCode({
 		body.set("client_id", options.clientId);
 		body.set("client_secret", options.clientSecret);
 	}
+
+	for (const [key, value] of Object.entries(additionalParams)) {
+		if (!body.has(key)) body.append(key, value);
+	}
+
 	const { data, error } = await betterFetch<object>(tokenEndpoint, {
 		method: "POST",
 		body: body,
diff --git a/packages/better-auth/src/plugins/generic-oauth/index.ts b/packages/better-auth/src/plugins/generic-oauth/index.ts
index f85c3ee97b..47155f7b80 100644
--- a/packages/better-auth/src/plugins/generic-oauth/index.ts
+++ b/packages/better-auth/src/plugins/generic-oauth/index.ts
@@ -113,6 +113,12 @@ export interface GenericOAuthConfig {
 	 * Warning: Search-params added here overwrite any default params.
 	 */
 	authorizationUrlParams?: Record<string, string>;
+
+	/**
+	 * Additional search-params to add to the tokenUrl.
+	 * Warning: Search-params added here overwrite any default params.
+	 */
+	tokenUrlParams?: Record<string, string>;
 	/**
 	 * Disable implicit sign up for new users. When set to true for the provider,
 	 * sign-in need to be called with with requestSignUp as true to create new users.
@@ -605,6 +611,7 @@ export const genericOAuth = (options: GenericOAuthOptions) => {
 							},
 							tokenEndpoint: finalTokenUrl,
 							authentication: provider.authentication,
+							additionalParams: provider.tokenUrlParams,
 						});
 					} catch (e) {
 						ctx.context.logger.error(