From 9c8ded67b192997b6c02150c3423bbc99d9bdb6b Mon Sep 17 00:00:00 2001 From: Gustavo Valverde Date: Sat, 30 May 2026 23:52:38 +0100 Subject: [PATCH] docs(two-factor): mark `viewBackupCodes` as server-only in its API comment (#9822) --- .changeset/two-factor-view-backup-codes-jsdoc.md | 7 +++++++ .../src/plugins/two-factor/backup-codes/index.ts | 7 ++++--- 2 files changed, 11 insertions(+), 3 deletions(-) create mode 100644 .changeset/two-factor-view-backup-codes-jsdoc.md diff --git a/.changeset/two-factor-view-backup-codes-jsdoc.md b/.changeset/two-factor-view-backup-codes-jsdoc.md new file mode 100644 index 0000000000..515f50c337 --- /dev/null +++ b/.changeset/two-factor-view-backup-codes-jsdoc.md @@ -0,0 +1,7 @@ +--- +"better-auth": patch +--- + +Document `viewBackupCodes` as a server-only function so its API comment no longer reads like an HTTP route. + +The JSDoc above `auth.api.viewBackupCodes` advertised `POST /two-factor/view-backup-codes`, but the endpoint is server-only: it is not registered on the HTTP router and has no client method. The comment now states that it is callable only from trusted server code and that the `userId` should come from an authenticated session. diff --git a/packages/better-auth/src/plugins/two-factor/backup-codes/index.ts b/packages/better-auth/src/plugins/two-factor/backup-codes/index.ts index 85944ff4f1..d4ca1eacb2 100644 --- a/packages/better-auth/src/plugins/two-factor/backup-codes/index.ts +++ b/packages/better-auth/src/plugins/two-factor/backup-codes/index.ts @@ -507,9 +507,10 @@ export const backupCode2fa = (opts: BackupCodeOptions) => { }, ), /** - * ### Endpoint - * - * POST `/two-factor/view-backup-codes` + * A server-only function that returns a user's decrypted two-factor + * backup codes. It is not exposed over HTTP and has no client method; + * call it from trusted server code with a `userId` taken from an + * authenticated session. * * ### API Methods *