github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 22:32:01 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #6348] Documentation gap: Device Authorization plugin should mention using bearer plugin #10490

New Issue
Closed
opened 2026-04-13 06:40:17 -05:00 by GiteaMirror · 9 comments
GiteaMirror commented 2026-04-13 06:40:17 -05:00
Owner
Copy Link

Originally created by @bcheung on GitHub (Nov 27, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/6348

Originally assigned to: @bytaesu on GitHub.

Device Authorization plugin should mention to use the bearer plugin for authed requests but doesn't.
The device auth docs show:

  fetchOptions: {
    headers: {
      Authorization: `Bearer ${data.access_token}`,
    },
  },
});

But this doesn't work without the bearer() plugin and isn't mentioned anywhere in the device auth docs.

Suggested fix: Add a note to the device auth docs like:

"To use the access token for authenticated API calls (like getSession), add the bearer() plugin to your server config."

Originally created by @bcheung on GitHub (Nov 27, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/6348 Originally assigned to: @bytaesu on GitHub. Device Authorization plugin should mention to use the bearer plugin for authed requests but doesn't. The [device auth docs](https://www.better-auth.com/docs/plugins/device-authorization) show: ```const { data: session } = await authClient.getSession({ fetchOptions: { headers: { Authorization: `Bearer ${data.access_token}`, }, }, }); ``` But this doesn't work without the `bearer()` plugin and isn't mentioned anywhere in the device auth docs. Suggested fix: Add a note to the device auth docs like: > "To use the access token for authenticated API calls (like `getSession`), add the `bearer()` plugin to your server config."
GiteaMirror added the locked label 2026-04-13 06:40:17 -05:00
GiteaMirror commented 2026-04-13 06:40:19 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Nov 27, 2025):

Thanks for the feedback on the Device Authorization documentation! It looks like the current example shows using the access token in the Authorization header with getSession without mentioning that the bearer() plugin must also be added in your server configuration. To address this, we suggest updating the documentation with a clear note like:

"To use the access token for authenticated API calls (such as getSession), please ensure that you add the bearer() plugin to your Better Auth server configuration."

This will help clarify that the bearer() plugin is required in order for the Authorization header to work as intended, ensuring a smoother developer experience. Have you encountered any specific issues when using the current setup, or is there any additional detail you think would help developers in this context? Tag @better-auth-agent if you would like an answer from the Agent.

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3584578927 --> @better-auth-agent[bot] commented on GitHub (Nov 27, 2025): Thanks for the feedback on the Device Authorization documentation! It looks like the current example shows using the access token in the Authorization header with getSession without mentioning that the bearer() plugin must also be added in your server configuration. To address this, we suggest updating the documentation with a clear note like: "To use the access token for authenticated API calls (such as getSession), please ensure that you add the bearer() plugin to your Better Auth server configuration." This will help clarify that the bearer() plugin is required in order for the Authorization header to work as intended, ensuring a smoother developer experience. Have you encountered any specific issues when using the current setup, or is there any additional detail you think would help developers in this context? Tag @better-auth-agent if you would like an answer from the Agent. <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)
GiteaMirror commented 2026-04-13 06:40:20 -05:00
Author
Owner
Copy Link

@GautamBytes commented on GitHub (Nov 27, 2025):

working on it, expect a pr soon!

<!-- gh-comment-id:3584763591 --> @GautamBytes commented on GitHub (Nov 27, 2025): working on it, expect a pr soon!
GiteaMirror commented 2026-04-13 06:40:21 -05:00
Author
Owner
Copy Link

@nightire commented on GitHub (Jan 3, 2026):

@better-auth-agent

I believe that even using the bearer plugin likely won't solve this issue. The bearer plugin simply places the signed cookie value in the header to return it to the client, meaning you still have to pass that signed cookie value in subsequent requests.

The problem with the Device Authorization plugin is that the access token it ultimately returns is the raw session token. Therefore, even if you pass the bearer token through the header, it cannot pass verification. I have already tried this approach.

<!-- gh-comment-id:3707394504 --> @nightire commented on GitHub (Jan 3, 2026): @better-auth-agent I believe that even using the bearer plugin likely won't solve this issue. The bearer plugin simply places the signed cookie value in the header to return it to the client, meaning you still have to pass that signed cookie value in subsequent requests. The problem with the Device Authorization plugin is that the access token it ultimately returns is the raw session token. Therefore, even if you pass the bearer token through the header, it cannot pass verification. I have already tried this approach.
GiteaMirror commented 2026-04-13 06:40:22 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Jan 3, 2026):

It seems like you're encountering a complex issue with the Device Authorization plugin and its interaction with the bearer plugin. It sounds like the access token returned is not properly functioning as expected. There has indeed been a bug regarding session handling in the Device Authorization plugin that was resolved in past updates, which may be relevant to your situation [2].

Furthermore, there is currently an open issue suggesting that the documentation should clearly state the need for the bearer plugin when making authorized requests [3]. This suggests that additional clarifications in the documentation may help avoid these kinds of issues going forward.

For troubleshooting, I recommend confirming your implementation against the updated examples provided in the documentation or experimenting with the bearer plugin to verify whether your access token can successfully pass authentication. If problems persist, it may be useful to open a new GitHub issue or tag @bekacru or @ping__ for direct assistance from the Better Auth team.

What specific approach have you tried thus far to troubleshoot the token verification issue?

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3707399601 --> @better-auth-agent[bot] commented on GitHub (Jan 3, 2026): It seems like you're encountering a complex issue with the Device Authorization plugin and its interaction with the bearer plugin. It sounds like the access token returned is not properly functioning as expected. There has indeed been a bug regarding session handling in the Device Authorization plugin that was resolved in past updates, which may be relevant to your situation [[2]](https://github.com/better-auth/better-auth/pull/4695). Furthermore, there is currently an open issue suggesting that the documentation should clearly state the need for the bearer plugin when making authorized requests [[3]](https://github.com/better-auth/better-auth/pull/6351). This suggests that additional clarifications in the documentation may help avoid these kinds of issues going forward. For troubleshooting, I recommend confirming your implementation against the updated examples provided in the documentation or experimenting with the bearer plugin to verify whether your access token can successfully pass authentication. If problems persist, it may be useful to open a new GitHub issue or tag @bekacru or @ping__ for direct assistance from the Better Auth team. What specific approach have you tried thus far to troubleshoot the token verification issue? <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) • [Discord](https://discord.gg/fG2XXEuQX3) • [GitHub](https://github.com/Skyvern-AI/Skyvern) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/fG2XXEuQX3) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/Skyvern-AI/Skyvern)
GiteaMirror commented 2026-04-13 06:40:23 -05:00
Author
Owner
Copy Link

@nightire commented on GitHub (Jan 3, 2026):

@better-auth-agent This is what we got from the Device Authorization Plugin currently:

 {
  access_token: 'MFqMsTa6UMgRnDcYyesC4IYeACYvdTWm',	// <- this is a raw session token, not signed cookie value
  token_type: 'Bearer',
  expires_in: 604799,
  scope: ''
}

With this access_token (and bearer plugin enabled of course), if we send a request through bearer token, we can't pass the authentication:

curl --location --request GET 'http://localhost:5001/v1/auth/get-session' \
--header 'Authorization: Bearer MFqMsTa6UMgRnDcYyesC4IYeACYvdTWm'
null
<!-- gh-comment-id:3707402973 --> @nightire commented on GitHub (Jan 3, 2026): @better-auth-agent This is what we got from the Device Authorization Plugin currently: ``` { access_token: 'MFqMsTa6UMgRnDcYyesC4IYeACYvdTWm', // <- this is a raw session token, not signed cookie value token_type: 'Bearer', expires_in: 604799, scope: '' } ``` With this `access_token` (and bearer plugin enabled of course), if we send a request through `bearer token`, we can't pass the authentication: ``` curl --location --request GET 'http://localhost:5001/v1/auth/get-session' \ --header 'Authorization: Bearer MFqMsTa6UMgRnDcYyesC4IYeACYvdTWm' null ```
GiteaMirror commented 2026-04-13 06:40:23 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Jan 3, 2026):

It looks like you're running into an issue where the Bearer token isn't being processed correctly when making requests with the Device Authorization plugin. Based on the current documentation, it's crucial to ensure that the bearer() plugin is enabled in your server configuration to handle the Authorization: Bearer ${data.access_token} header properly.

A suggested addition to the documentation is to clarify this requirement. The note states:

"To use the access token for authenticated API calls (like getSession), add the bearer() plugin to your server config" [2].

Since you’re getting a null response when trying to use the token, double-check that the bearer() plugin is indeed included in your configuration. Also, ensure that the access token has not expired and that you're using the correct endpoint.

Would you like to share any specific code snippets or configurations you're using? That way, I can help troubleshoot further!

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3707403102 --> @better-auth-agent[bot] commented on GitHub (Jan 3, 2026): It looks like you're running into an issue where the `Bearer` token isn't being processed correctly when making requests with the Device Authorization plugin. Based on the current documentation, it's crucial to ensure that the `bearer()` plugin is enabled in your server configuration to handle the `Authorization: Bearer ${data.access_token}` header properly. A suggested addition to the documentation is to clarify this requirement. The note states: > "To use the access token for authenticated API calls (like `getSession`), add the `bearer()` plugin to your server config" [[2]](https://github.com/better-auth/better-auth/pull/6351). Since you’re getting a `null` response when trying to use the token, double-check that the `bearer()` plugin is indeed included in your configuration. Also, ensure that the access token has not expired and that you're using the correct endpoint. Would you like to share any specific code snippets or configurations you're using? That way, I can help troubleshoot further! <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) • [Discord](https://discord.gg/fG2XXEuQX3) • [GitHub](https://github.com/Skyvern-AI/Skyvern) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/fG2XXEuQX3) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/Skyvern-AI/Skyvern)
GiteaMirror commented 2026-04-13 06:40:24 -05:00
Author
Owner
Copy Link

@nightire commented on GitHub (Jan 3, 2026):

@better-auth-agent You're not helping here, the issue is not about bearer plugin but the token returned from device authorization plugin is not properly signed.

Manually setting the cookie header with a raw session token will not work—Better Auth expects a signed and URL-encoded cookie value, not just the raw token.

<!-- gh-comment-id:3707406787 --> @nightire commented on GitHub (Jan 3, 2026): @better-auth-agent You're not helping here, the issue is not about bearer plugin but the token returned from device authorization plugin is not properly signed. > Manually setting the cookie header with a raw session token will not work—Better Auth expects a signed and URL-encoded cookie value, not just the raw token.
GiteaMirror commented 2026-04-13 06:40:24 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Jan 3, 2026):

It sounds like you're facing issues with the token returned from the Device Authorization plugin. From what you've mentioned, it's crucial to ensure that the token is properly signed and URL-encoded when being used, especially for setting cookies in Better Auth.

If you're manually setting the cookie header with a raw session token, that won't work as Better Auth requires a specially formatted cookie value. Instead, ensure you follow the correct implementation for session handling, as the session logic needs to be properly set up for it to work in a cookieless environment [4].

Given that there's also a documentation gap regarding the need for the bearer plugin, which is essential for using the access token in authenticated API calls like getSession, it's recommended to add the bearer() plugin to your server config if you haven't already [1], [3].

If you're still encountering problems, it might be helpful to tag @bekacru or @ping__ for further assistance.

Would you like to explore more on session management or the bearer plugin implementation?

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3707406888 --> @better-auth-agent[bot] commented on GitHub (Jan 3, 2026): It sounds like you're facing issues with the token returned from the Device Authorization plugin. From what you've mentioned, it's crucial to ensure that the token is properly signed and URL-encoded when being used, especially for setting cookies in Better Auth. If you're manually setting the cookie header with a raw session token, that won't work as Better Auth requires a specially formatted cookie value. Instead, ensure you follow the correct implementation for session handling, as the session logic needs to be properly set up for it to work in a cookieless environment [[4]](https://github.com/better-auth/better-auth/pull/4695). Given that there's also a documentation gap regarding the need for the bearer plugin, which is essential for using the access token in authenticated API calls like `getSession`, it's recommended to add the `bearer()` plugin to your server config if you haven't already [[1]](https://github.com/better-auth/better-auth/issues/6348), [[3]](https://github.com/better-auth/better-auth/pull/6351). If you're still encountering problems, it might be helpful to tag @bekacru or @ping__ for further assistance. Would you like to explore more on session management or the bearer plugin implementation? <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) • [Discord](https://discord.gg/fG2XXEuQX3) • [GitHub](https://github.com/Skyvern-AI/Skyvern) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/fG2XXEuQX3) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/Skyvern-AI/Skyvern)
GiteaMirror commented 2026-04-13 06:40:25 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Jan 3, 2026):

It appears that there's a concern about the Device Authorization plugin regarding how the token is signed and the expected cookie value. To clarify, Better Auth expects a signed and URL-encoded cookie value rather than just a raw token, which is important for it to work correctly in a cookieless environment.

For the issue you raised regarding the Device Authorization plugin, it's crucial to ensure that the session handling logic is correctly configured, especially if you're working in a scenario without cookies. If the session is not being established properly, investigate how you're implementing session management in conjunction with the plugin.

Also, regarding the mention of the bearer plugin, there is a known issue that suggests adding a note to the documentation about requiring the bearer plugin to process the bearer token correctly for authenticated requests like getSession [1]. This could lead to confusion if not properly addressed in documentation.

If you need further assistance or face additional issues, feel free to tag @bekacru or @ping__ for detailed help from the Better Auth team. What part of the session handling or token management would you like to explore further?

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3707407504 --> @better-auth-agent[bot] commented on GitHub (Jan 3, 2026): It appears that there's a concern about the Device Authorization plugin regarding how the token is signed and the expected cookie value. To clarify, Better Auth expects a signed and URL-encoded cookie value rather than just a raw token, which is important for it to work correctly in a cookieless environment. For the issue you raised regarding the Device Authorization plugin, it's crucial to ensure that the session handling logic is correctly configured, especially if you're working in a scenario without cookies. If the session is not being established properly, investigate how you're implementing session management in conjunction with the plugin. Also, regarding the mention of the bearer plugin, there is a known issue that suggests adding a note to the documentation about requiring the bearer plugin to process the bearer token correctly for authenticated requests like `getSession` [[1]](https://github.com/better-auth/better-auth/issues/6348). This could lead to confusion if not properly addressed in documentation. If you need further assistance or face additional issues, feel free to tag @bekacru or @ping__ for detailed help from the Better Auth team. What part of the session handling or token management would you like to explore further? <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) • [Discord](https://discord.gg/fG2XXEuQX3) • [GitHub](https://github.com/Skyvern-AI/Skyvern) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/fG2XXEuQX3) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/Skyvern-AI/Skyvern)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#10490
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?