An upgrade to oidc-provider plugin that makes it oauth2.1 compliant and has a configuration that is secure by default.
Plans for the deprecation of oidc-provider plugin due to many inherent flaws in its design. Internally, plugin functions now share logic, providing for better future extensibility if new code_grants need to be written or user/client jwt or opaque tokens need to be written. Furthermore, as an oAuth 2.1 provider, it provides logic valid for an MCP server. When using the scope "openid" (optional, enabled by default), the server acts like an OpenId server able to issue id tokens and provides a /userinfo endpoint.
Features
OAuth 2.1 by default
Properly supports authorization_code, refresh_token, and client_credentials grants
PKCE by default (removes plain completely)
Public and confidential client registration
JWT plugin is required by default, but can be disabled using disableJWTPlugin flag
Access tokens can now be received in JWT verifiable format using the resource parameter (ie JWT aud field)
Id tokens are still verifiable by JWKS when using JWT Plugin, or clientSecret if disabled. Fixes issue to prevent public clients when disableJWTPlugin: true from obtaining id tokens directly even when they shouldn't be allowed an id token and should use /userinfo instead.
Protects /userinfo with scope check
Separates Refresh Token and Access token on database schema to allow multiple access tokens per refresh and multiple refresh tokens per login session.
oauthAccessToken strictly deals with opaque tokens
Opaque tokens are given only when resource parameter (aka audience) is not provided
Option to Encode and Decode refresh tokens
allowDynamicClientRegistration with allowUnauthenticatedClientRegistration flags
Separation of default expiration times
Proper creation of public and confidential clients
Prevents misconfiguration between .well-known/openid-configuration endpoint and plugin settings
scopeExpirations to assign scopes specific expiration
Custom claims through separated functions: customAccessTokenClaims, customIdTokenClaims, and customUserInfoClaims
Organizational support through activeOrganizationalId on a session such as through the organizational plugin. Attaches to oAuthClient via reference_id.
Rp-initiated logout
Account Selection via prompt=select_account.
Account Creation via prompt=create.
Prompt combinations prompt=select_account+consent and prompt=login+consent
Docs available at https://www.better-auth.com/docs/plugins/oauth-provider (pr: https://github.com/better-auth/better-auth/blob/main/docs/content/docs/plugins/oauth-provider.mdx)
* fix: do not prompt before overwriting schema on `@better-auth/cli generate --yes ...`
* chore: changeset
---------
Co-authored-by: Bereket Engida <86073083+Bekacru@users.noreply.github.com>
Refactors
- Updated all imports and type references to use zod/v4.
- Replaced deprecated or changed Zod APIs and options across the codebase.
- Adjusted validation schemas and error messages to match Zod v4 requirements.
- Updated dependencies and lockfiles to use Zod v4.
* fix(cli): init cmd types
* fix(init): deps do not install if env is skipped
- also made the CLI show which packages it will install
* fix(typecheck): specify tsconfig for declarations
---------
Co-authored-by: Bereket Engida <bekacru@gmail.com>
* update: init command now can do plugins & DB generation
* fix: revert nextjs auth.ts file
* add: pacakge @clack/prompts for better CLI experience
* update: moved from prompts to clack/prompts
* add: functionality to hide logs coming from `getConfig`
* remove: hide logs functionality
* chore: remove unneeded import
* add: install dependencies feature
* add: functionality to update/install better-auth
* fix: install/upgrade better-auth deps
* add: spinner during version checking
* fix: nextCookies plugin import path
* fix: oidc plugin contents
* update: emoji-ify
* fix: mysql code
* refactor: logging/prompt style
* update: mysql use 1 ENV
* fix: msql, revert back to old code
* fix: mysql connectionUri, again
* fix: missing sqlite env
* fix: added back the plugins multiselect
* update: outro text
* add: ENV generation for `BETTER_AUTH_URL` & `BETTER_AUTH_SECRET`
* update: intro & outro text, plus some ENV default values
* remove: name from cli options
* fix: made index.ts's getPackageInfo not crash the program entirely if ENOENT
* update: prompt to get auth config dir if not auto found
* fix: create auth config file
* add: log to state the new file that's being created
* update: outro text
* fix: unneeded diff display
* add: auth-client creator
* fix: auth-client plugins are now grouped
* fix: auth-client import path bugs
* fix: invalid client plugins
* fix: oneTap client plugin contents
* update: allow getConfig to throw errors instead of logging
* fix: auth config error logging
* WIP: auth client code gen
* chore: linter
* update: now supports auth client generation
* WIP: grouped imports
* remove: functionality to update existing auth code
* add: functionality to update tsconfig
* fix: tsconfig not saving new updated values
* fix: handle missing .env files in init process
* update: made `no env file found` error message use `outro` for better logging experience
* fix: removed `ms` at the end as the `formatMilliseconds` fn already handles that
* update: move ENV code after plugins initialization
* chore: update pnpm lockfile and remove deprecated package note
* chore: lint
---------
Co-authored-by: Bereket Engida <bekacru@gmail.com>
Joél SolanoandGitHub
Dylan VanmaliandGitHub
Jonathan SaminesandGitHub
Khiet Tam NguyenandGitHub
Anthony DePasquale
Paul NodetandGitHub
LovelessCodesandGitHub
AbdallahandGitHub
ThorbenandGitHub