[GH-ISSUE #7245] Allow HS256 JWTs #10769

New Issue

2026-04-13T07:06:45-05:00

GiteaMirror commented

2026-04-13 07:06:45 -05:00

Originally created by @rjungbeck on GitHub (Jan 10, 2026).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/7245

Is this suited for github?

Yes, this is suited for github

To Reproduce

Try to create HS256 signed JWTs by specifying
{ secret: "dsafjlkbsflkjsjblfblkfdnöfdnböfdnvbköfdnglödkng",
plugins: [
jwt({jwt: {alg: "HS256})
}

Current vs. Expected behavior

I was not able to convince betterauth to create HS256 signed JWT). It always creates an EdDSA signed JWT token. (I want a symmetric key signed jwt token that I can give to my Python backend). I tried everything differend Gemini, and Pycharms AI suggested (like clearing jwkw table, not providing the table, setting session/strategy=database, jwt/define/algirithm, jwt/signingAlgorithm, jwt/alg)

What version of Better Auth are you using?

1.4.10

System info

Windows 11

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

import { betterAuth } from "better-auth"
export const auth = betterAuth({
  emailAndPassword: {  
    enabled: true
  },
});

Additional context

No response

Originally created by @rjungbeck on GitHub (Jan 10, 2026). Original GitHub issue: https://github.com/better-auth/better-auth/issues/7245 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce Try to create HS256 signed JWTs by specifying { secret: "dsafjlkbsflkjsjblfblkfdnöfdnböfdnvbköfdnglödkng", plugins: [ jwt({jwt: {alg: "HS256}) } ### Current vs. Expected behavior I was not able to convince betterauth to create HS256 signed JWT). It always creates an EdDSA signed JWT token. (I want a symmetric key signed jwt token that I can give to my Python backend). I tried everything differend Gemini, and Pycharms AI suggested (like clearing jwkw table, not providing the table, setting session/strategy=database, jwt/define/algirithm, jwt/signingAlgorithm, jwt/alg) ### What version of Better Auth are you using? 1.4.10 ### System info ```bash Windows 11 ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth" export const auth = betterAuth({ emailAndPassword: { enabled: true }, }); ``` ### Additional context _No response_

GiteaMirror added the core label 2026-04-13 07:06:45 -05:00

GiteaMirror commented

2026-04-13 07:06:47 -05:00

@better-auth-agent[bot] commented on GitHub (Jan 10, 2026):

It seems you're encountering issues with getting Better Auth to create HS256 signed JWTs instead of EdDSA signed JWTs. While Better Auth does support HS256, the current implementation might have limitations. There are discussions about the support for HS256 in relation to OIDC.

You'll want to ensure that you are using the JWT plugin correctly in your configuration [1], and if you're following the correct protocol for generating your desired token type. However, based on the information, you might need to check for any specific flags or configurations that allow you to generate HS256 tokens instead of the default EdDSA signatures.

If you haven’t already, I recommend trying the following:

Confirm that you have set up the JWT plugin correctly in your auth configuration and specified HS256 as the algorithm.
Keep an eye on the latest updates or issues in the Better Auth GitHub repository, as this could provide insights into similar situations faced by other developers.

If you're still having issues, consider tagging Beka and Max (@bekacru and @ping__) on this topic so they can provide more specific guidance!

What other authentication challenges are you facing?

If you need more help, tag @better-auth-agent in a comment so I can respond.

Diagram • Discord • GitHub

@better-auth-agent[bot] commented on GitHub (Jan 10, 2026): It seems you're encountering issues with getting Better Auth to create HS256 signed JWTs instead of EdDSA signed JWTs. While Better Auth does support HS256, the current implementation might have limitations. There are discussions about the support for HS256 in relation to OIDC. You'll want to ensure that you are using the JWT plugin correctly in your configuration [[1]](https://github.com/better-auth/better-auth/pull/2912), and if you're following the correct protocol for generating your desired token type. However, based on the information, you might need to check for any specific flags or configurations that allow you to generate HS256 tokens instead of the default EdDSA signatures. If you haven’t already, I recommend trying the following: - Confirm that you have set up the JWT plugin correctly in your auth configuration and specified HS256 as the algorithm. - Keep an eye on the latest updates or issues in the Better Auth GitHub repository, as this could provide insights into similar situations faced by other developers. If you're still having issues, consider tagging Beka and Max (@bekacru and @ping__) on this topic so they can provide more specific guidance! What other authentication challenges are you facing? _If you need more help, tag @better-auth-agent in a comment so I can respond._  [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) • [Discord](https://discord.gg/fG2XXEuQX3) • [GitHub](https://github.com/Skyvern-AI/Skyvern) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/fG2XXEuQX3) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/Skyvern-AI/Skyvern)

GiteaMirror commented

2026-04-13 07:06:47 -05:00

@dosubot[bot] commented on GitHub (Jan 10, 2026):

Hi @rjungbeck! I'm Dosu and I’m helping the better-auth team.

Better Auth’s JWT plugin does not support HS256 (symmetric key) JWTs—it’s built for asymmetric algorithms like EdDSA, RS256, and ES256 only. That’s why trying to set alg: "HS256" in the JWT plugin config has no effect and always results in EdDSA-signed tokens. This is a known limitation and has been discussed as a feature request; maintainers suggest writing a custom plugin if you need full HS256 support in the JWT plugin context (source).

However, you can get HS256-signed JWTs for session data by enabling the session cookie cache strategy with strategy: "jwt". This will create a better-auth.session_data cookie containing a JWT signed with HS256 using your server secret. You do not need the JWT plugin or the JWKS table for this—just set the config as follows:

export const auth = betterAuth({
  emailAndPassword: { enabled: true },
  session: {
    cookieCache: {
      enabled: true,
      maxAge: 7 * 24 * 60 * 60, // 7 days
      strategy: "jwt", // enables HS256 JWTs for session_data
      refreshCache: true,
    },
  },
});

To verify this JWT in your Python backend, use your shared secret and any standard JWT library (like pyjwt). The JWT will be in the better-auth.session_data cookie.

You do not need the JWT plugin or JWKS for this setup—those are only for asymmetric JWTs (source). If you need HS256 for other types of tokens, you’d need to implement a custom plugin or sign those tokens yourself.

To reply, just mention @dosu.

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

@dosubot[bot] commented on GitHub (Jan 10, 2026):  Hi @rjungbeck! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the better-auth team.  Better Auth’s JWT plugin does not support HS256 (symmetric key) JWTs—it’s built for asymmetric algorithms like EdDSA, RS256, and ES256 only. That’s why trying to set `alg: "HS256"` in the JWT plugin config has no effect and always results in EdDSA-signed tokens. This is a known limitation and has been discussed as a feature request; maintainers suggest writing a custom plugin if you need full HS256 support in the JWT plugin context ([source](https://github.com/better-auth/better-auth/issues/390)). However, you can get HS256-signed JWTs for session data by enabling the session cookie cache strategy with `strategy: "jwt"`. This will create a `better-auth.session_data` cookie containing a JWT signed with HS256 using your server secret. You do not need the JWT plugin or the JWKS table for this—just set the config as follows: ```typescript export const auth = betterAuth({ emailAndPassword: { enabled: true }, session: { cookieCache: { enabled: true, maxAge: 7 * 24 * 60 * 60, // 7 days strategy: "jwt", // enables HS256 JWTs for session_data refreshCache: true, }, }, }); ``` To verify this JWT in your Python backend, use your shared secret and any standard JWT library (like `pyjwt`). The JWT will be in the `better-auth.session_data` cookie. You do not need the JWT plugin or JWKS for this setup—those are only for asymmetric JWTs ([source](https://github.com/better-auth/better-auth/discussions/6153)). If you need HS256 for other types of tokens, you’d need to implement a custom plugin or sign those tokens yourself.  *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/90b9f6ab-734e-4b30-a85c-a2169b4b0dd3?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/90b9f6ab-734e-4b30-a85c-a2169b4b0dd3?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/90b9f6ab-734e-4b30-a85c-a2169b4b0dd3?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/90b9f6ab-734e-4b30-a85c-a2169b4b0dd3?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/90b9f6ab-734e-4b30-a85c-a2169b4b0dd3?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/90b9f6ab-734e-4b30-a85c-a2169b4b0dd3?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/90b9f6ab-734e-4b30-a85c-a2169b4b0dd3?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github) [![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=Better%20Auth%E2%80%99s%20JWT%20plugin%20does%20not%20support%20HS256%20%28symmetric%20key%29%20JWTs%E2%80%94it%E2%80%99s%20built%20for%20asymmetric%20algorithms%20like%20EdDSA%2C%20RS256%2C%20and%20ES256%20only.%20That%E2%80%99s%20why%20trying%20to%20set%20%60alg%3A%20%22HS256%22%60%20in%20the%20JWT%20plugin%20config%20has%20no%20effect%20and%20always%20results%20in%20EdDSA-signed%20tokens.%20This%20is%20a%20known%20limitation%20and%20has%20been%20discussed%20as%20a%20feature%20request%3B%20maintainers%20suggest%20writing%20a%20custom%20plugin%20if%20you%20need%20full%20HS256%20support%20in%20the%20JWT%20plugin%20context%C2%A0%28%5Bsource%5D%28https%3A//github.com/better-auth/better-auth/issues/390%29%29.%0A%0AHowever%2C%20you%20can%20get%20HS256-signed%20JWTs%20for%20session%20data%20by%20enabling%20the%20session%20cookie%20cache%20strategy%20with%20%60strategy%3A%20%22jwt%22%60.%20This%20will%20create%20a%20%60better-auth.session_data%60%20cookie%20containing%20a%20JWT%20signed%20with%20HS256%20using%20your%20server%20secret.%20You%20do%20not%20need%20the%20JWT%20plugin%20or%20the%20JWKS%20table%20for%20this%E2%80%94just%20set%20the%20config%20as%20follows%3A%0A%0A%60%60%60typescript%0Aexport%20const%20auth%20%3D%20betterAuth%28%7B%0A%20%20emailAndPassword%3A%20%7B%20enabled%3A%20true%20%7D%2C%0A%20%20session%3A%20%7B%0A%20%20%20%20cookieCache%3A%20%7B%0A%20%20%20%20%20%20enabled%3A%20true%2C%0A%20%20%20%20%20%20maxAge%3A%207%20%2A%2024%20%2A%2060%20%2A%2060%2C%20//%207%20days%0A%20%20%20%20%20%20strategy%3A%20%22jwt%22%2C%20//%20enables%20HS256%20JWTs%20for%20session_data%0A%20%20%20%20%20%20refreshCache%3A%20true%2C%0A%20%20%20%20%7D%2C%0A%20%20%7D%2C%0A%7D%29%3B%0A%60%60%60%0A%0ATo%20verify%20this%20JWT%20in%20your%20Python%20backend%2C%20use%20your%20shared%20secret%20and%20any%20standard%20JWT%20library%20%28like%20%60pyjwt%60%29.%20The%20JWT%20will%20be%20in%20the%20%60better-auth.session_data%60%20cookie.%0A%0AYou%20do%20not%20need%20the%20JWT%20plugin%20or%20JWKS%20for%20this%20setup%E2%80%94those%20are%20only%20for%20asymmetric%20JWTs%C2%A0%28%5Bsource%5D%28https%3A//github.com/better-auth/better-auth/discussions/6153%29%29.%20If%20you%20need%20HS256%20for%20other%20types%20of%20tokens%2C%20you%E2%80%99d%20need%20to%20implement%20a%20custom%20plugin%20or%20sign%20those%20tokens%20yourself.) [![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot) [![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/7245)

GiteaMirror commented

2026-04-13 07:06:48 -05:00

@rjungbeck commented on GitHub (Jan 11, 2026):

@dosu: I need to overwrite definePayload to include additional fields into the token. That is why I used the jwt plugin. I see only complexity (and more resource usage) when I need a public kery signatures for short lived session tokens, that I need to verify on different systems whith each web request. So I would have to cache the verified session tokens on the other systems.

@rjungbeck commented on GitHub (Jan 11, 2026): @dosu: I need to overwrite definePayload to include additional fields into the token. That is why I used the jwt plugin. I see only complexity (and more resource usage) when I need a public kery signatures for short lived session tokens, that I need to verify on different systems whith each web request. So I would have to cache the verified session tokens on the other systems.

GiteaMirror commented

2026-04-13 07:06:50 -05:00

@dosubot[bot] commented on GitHub (Jan 11, 2026):

There isn’t currently a way to customize the payload of HS256 session JWTs (created via session.cookieCache.strategy: "jwt") in Better Auth—there’s no definePayload or similar hook for these tokens. The session JWT just serializes the session/account data as-is, so any extra fields you want must be added to the session object itself (which also means they’ll be persisted in the session store, not just in the JWT) reference.

The definePayload option in the jwt plugin only works for asymmetric JWTs (EdDSA, RS256, ES256), not for the HS256 session JWTs reference. If you need more control over the HS256 session JWT payload, you’d have to fork or extend the session cookie logic.

If you just want to add transient fields, you could use session lifecycle hooks to inject them into the session object before it’s encoded, but this isn’t as flexible as definePayload and will affect the stored session data as well.

To reply, just mention @dosu.

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

@dosubot[bot] commented on GitHub (Jan 11, 2026):  There isn’t currently a way to customize the payload of HS256 session JWTs (created via session.cookieCache.strategy: "jwt") in Better Auth—there’s no definePayload or similar hook for these tokens. The session JWT just serializes the session/account data as-is, so any extra fields you want must be added to the session object itself (which also means they’ll be persisted in the session store, not just in the JWT) [reference](https://github.com/better-auth/better-auth/blob/f0a6f9448566ffa7f40f51bc881f72448f28836f/packages/better-auth/src/cookies/session-store.ts#L27-L307). The definePayload option in the jwt plugin only works for asymmetric JWTs (EdDSA, RS256, ES256), not for the HS256 session JWTs [reference](https://github.com/better-auth/better-auth/pull/2755). If you need more control over the HS256 session JWT payload, you’d have to fork or extend the session cookie logic. If you just want to add transient fields, you could use session lifecycle hooks to inject them into the session object before it’s encoded, but this isn’t as flexible as definePayload and will affect the stored session data as well.  *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/71da5021-c458-4796-b6cc-83565837daf0?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/71da5021-c458-4796-b6cc-83565837daf0?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/71da5021-c458-4796-b6cc-83565837daf0?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/71da5021-c458-4796-b6cc-83565837daf0?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/71da5021-c458-4796-b6cc-83565837daf0?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/71da5021-c458-4796-b6cc-83565837daf0?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/71da5021-c458-4796-b6cc-83565837daf0?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github) [![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=There%20isn%E2%80%99t%20currently%20a%20way%20to%20customize%20the%20payload%20of%20HS256%20session%20JWTs%20%28created%20via%20session.cookieCache.strategy%3A%20%22jwt%22%29%20in%20Better%20Auth%E2%80%94there%E2%80%99s%20no%20definePayload%20or%20similar%20hook%20for%20these%20tokens.%20The%20session%20JWT%20just%20serializes%20the%20session/account%20data%20as-is%2C%20so%20any%20extra%20fields%20you%20want%20must%20be%20added%20to%20the%20session%20object%20itself%20%28which%20also%20means%20they%E2%80%99ll%20be%20persisted%20in%20the%20session%20store%2C%20not%20just%20in%20the%20JWT%29%C2%A0%5Breference%5D%28https%3A//github.com/better-auth/better-auth/blob/f0a6f9448566ffa7f40f51bc881f72448f28836f/packages/better-auth/src/cookies/session-store.ts%23L27-L307%29.%0A%0AThe%20definePayload%20option%20in%20the%20jwt%20plugin%20only%20works%20for%20asymmetric%20JWTs%20%28EdDSA%2C%20RS256%2C%20ES256%29%2C%20not%20for%20the%20HS256%20session%20JWTs%C2%A0%5Breference%5D%28https%3A//github.com/better-auth/better-auth/pull/2755%29.%20If%20you%20need%20more%20control%20over%20the%20HS256%20session%20JWT%20payload%2C%20you%E2%80%99d%20have%20to%20fork%20or%20extend%20the%20session%20cookie%20logic.%0A%0AIf%20you%20just%20want%20to%20add%20transient%20fields%2C%20you%20could%20use%20session%20lifecycle%20hooks%20to%20inject%20them%20into%20the%20session%20object%20before%20it%E2%80%99s%20encoded%2C%20but%20this%20isn%E2%80%99t%20as%20flexible%20as%20definePayload%20and%20will%20affect%20the%20stored%20session%20data%20as%20well.) [![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot) [![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/7245)

Sign in to join this conversation.

Branches Tags

changeset-release/main

main

dependabot/npm_and_yarn/vitest-4.1.0

starsling/drizzle-kit-push-util

2026-08-18/refactor/simplify-cloudflare-fixture

2026-08-18/test/cloudflare-cold-start-concurrency

docs/1-7-release

2026-08-17/test/cloudflare-runtime-ci

dependabot/github_actions/github-actions-42c4bc6a62

2026-08-14/fix/standardize-plugin-types

2026-08-13/fix/dpop-public-url

2026-08-13/fix/acr-values-voluntary

starsling/CHG-forget-processed-cleanup-rows-b8077b74ef9a-4971f8e41755

refactor/device-authorization-oauth-boundary

2026-08-11/fix/api-key-rate-limit-window

feat/oauth-provider-custom-subject

pr-9793-merge

2026-07-31/chore/bump-better-call

2026-07-30/chore/upgrade-better-call

2026-07-30/fix/nextjs-rsc-session-refresh

feat/1-7-migration-validation

2026-07-29/refactor/centralize-placeholder-email-generation

refactor/oauth-client-application-type

2026-07-28/fix/anonymous-oauth-proxy-linking

feat/agent-feedback-endpoint

fix/oauth-provider-session-deletion

feat/scim-demo-workflow

feat/scim-active-user-link

feat/sso-provider-user-resolution

feat/identity-provider-accounts

feat/oauth-provider-remove-silence-warnings

changeset-release/release/vercel-announcement

release/vercel-announcement

2026-06-29/docs/optimize-og-images

feat/yandex-social-provider

feat/ssrf-fetch-boundary

codex/pr-10225-next-comments

fix/phone-number-disable-input

perf/router-build-once

fix/oauth-user-provisioning-fields

codex/ignore-compose-override-spellcheck

2026-06-19/fix/stripe-org-reference-scope

feat/webhooks

feat/baseurl-canonical-serving-split

feat/magic-link-expires-in

fix/esbuild-security-bump

chore/sync-main-to-next-20260615

chore/revert-10053

codex/fix-expo-sdk56-dynamic-import

refactor/oauth-provider-client-authentication-module

fix/oauth-no-store-headers

claude/slack-update-stripe-docs-consistency-8Sc0w

local/fix-invite-accept-idempotency

docs/beta-mdx-component-fallback

fix/dependabot-hono-shell-quote

codex/stateless-account-cookie-resolution

fix/admin-create-user-role-escalation

feat/oauth-provider-oidc-acr

refactor/sign-in-challenges

refactor/optional-kysely-dependency

2026-06-06/chore/kysely-changeset

copilot/fix-code-review-comment

starsling/prisma-migration-reset

2026-06-02/fix/next-cookies-defer-rsc

feat/oauth-contribution-protocol

ping-maxwell/c-ping-maxwell/fix-kysely-adapter-core-utils-string-resolution-68c5

temp/server-only-test

2026-05-31/refactor/kysely-joins-json-helpers

2026-04-29/feat/google-include-granted-scopes

2026-04-29/fix/oauth-account-scope-semantics

fix/oauth-callback-path-declarative

2026-05-31/fix/sqlite-dialect-affected-rows

fix/next-cookie-separator

2026-05-29/fix/last-login-method-cookie-prefix

ping-maxwell/c-ping-maxwell/fix-error-link-apostrophe-f89a

client-assertions-main

2026-05-15/ci/fix-sqlite-abi-mismatch

2026-05-15/fix/organization-team-add-cascade

2026-05-15/fix/parse-set-cookie-value-validation

2026-05-13/feat/captcha-wildcard-endpoints

fix/i18n-before-hook-translation

fix/disable-migration-generate

2026-05-10/fix/cookie-drain-order

2026-05-10/feat/hooks-finally

2026-05-09/fix/cookie-drain-order

2026-05-09/feat/hooks-finally

2026-05-08/feat/register-before-send

fix/stripe/subscription-data-merge

2026-05-01/chore/pnpm-v11-harden

chore/pnpm-v11

2026-04-27/fix/nextcookies-idempotent-writes

2026-04-26/fix/harden-proxy-host-validation

2026-04-26/refactor/stripe-callback-signature-cleanup

2026-04-26/fix/stripe-subscription-callback-timing

2026-04-11/fix/sveltekit-app-modules

feat/open-api-zod-contract

feat/oauth-idp-initiated-bounce

2026-04-21/fix/oauth-rfc-input-validation

fix/two-factor-identity-guard

fix/resource

feat/emailpassword-authorize

feat/oauth-provider-at-hash-v2

fix/release-grep-fallback

claude/address-review-comments-JhFLr

feat/async-auth

fix/two-factor-totp-verified-enrollment

feat/plugin-ui

codex/blog-1-6-release-post

2026-04-06/fix/type-any-guards

2026-04-05/chore/downgrade-better-call

2026-04-04/ci/skip-vercel-fork-prs

2026-03-28/ci/add-autofix-ci

chore/release-preview-script

himself65/2026/02/19/role

2026-03-20/docs/improve-website

2026-03-20/fix/anonymous-onlinkaccount-expo

2026-02-17/fix/anonymous-link-state

fix/8607-saml-inresponseto

fix/8549-scim-patch-noop

v1.4.x

refactor/migration-snapshot-tests

worktree-magic-link-additional-data

chore/migrate-build-to-rollup

worktree-fix-dynamic-baseurl-8447

2026-03-06/chore/public-api-check

fix/close-8156-regression-test

fix/secondary-storage-json-error-handling

himself65/verification-namespace

cursor/issue-8307-validation-79a3

himself65/2026/01/30/error-mdx

v1.4.x-staging

fix/email-otp-user

fix/restrict-full-organization-access-roles

himself65/2026/02/12/count

himself65/2026/02/04/define-plugin

2026-02-04/feat/add-pluralize

cursor/better-auth-js-integration-ec21

cursor/expo-state-mismatch-394c

2026-02-01/fix/org-update-role-sync-members

cursor/issue-7607-investigation-e146

cursor/email-generation-helper-0ff6

himself65/2026/01/21/avoid-spread-operator

himself65/2026/01/14/cli

claude/slack-add-docs-pr-NMvgO

claude/slack-add-advanced-useplural-WHKYL

feat/hooks-pos

feat/2fa-phone

feat/2fa

fix/rotation

fix/username-check

v1.3.x

refactor/organization

feat/multiple-client-ids-social-providers

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/better-auth#10769