github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-24 08:01:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #2610] Support getAccessToken for genericOAuth #17906

New Issue
Closed
opened 2026-04-15 16:15:42 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-15 16:15:42 -05:00
Owner
Copy Link

Originally created by @Celsiusss on GitHub (May 10, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/2610

Is this suited for github?

  • Yes, this is suited for github

Is your feature request related to a problem? Please describe.

Consider an auth.ts using genericOAuth plugin:

export const auth = betterAuth({
  plugins: [
    genericOAuth({
      config: [
        {
          providerId: "keycloak",
          ...
        },
      ],
    }),
  ],
  ...
});

Then try to get the access token with:

await auth.api.getAccessToken({
  body: {
    providerId: "keycloak",
  },
  headers: Astro.request.headers,
});

Gives error:

[ERROR] Provider keycloak is not supported.

Describe the solution you'd like

I would love for auth.api.getAccessToken to work with the genericOAuth plugin.

Describe alternatives you've considered

Based on existing source code, I made this function that can be used instead:

import { refreshAccessToken } from "better-auth/oauth2";

export const getAccessToken = async (userId: string) => {
  const ctx = await auth.$context;
  const [account] = await ctx.internalAdapter.findAccountByUserId(userId);
  if (
    account.refreshToken &&
    account.accessTokenExpiresAt &&
    account.accessTokenExpiresAt.getTime() - Date.now() < 5_000
  ) {
    try {
      const res = await refreshAccessToken({
        refreshToken: account.refreshToken,
        tokenEndpoint: OIDC_TOKEN_URL,
        options: {
          clientId: OIDC_CLIENT,
          clientSecret: OIDC_SECRET,
        },
      });
      await ctx.internalAdapter.updateAccount(account.id, {
        accessToken: res.accessToken,
        accessTokenExpiresAt: res.accessTokenExpiresAt,
        refreshToken: res.refreshToken,
        refreshTokenExpiresAt: res.refreshTokenExpiresAt,
      });
      console.log("Refreshed access token.");
      return res.accessToken;
    } catch (e: any) {
      console.error("Failed to refres access token:", e);
      return null;
    }
  }
  return account.accessToken;
};

Additional context

Using Astro integration.

"astro": "^5.7.12",
"better-auth": "1.2.8-beta.7"
Originally created by @Celsiusss on GitHub (May 10, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/2610 ### Is this suited for github? - [x] Yes, this is suited for github ### Is your feature request related to a problem? Please describe. Consider an `auth.ts` using `genericOAuth` plugin: ```ts export const auth = betterAuth({ plugins: [ genericOAuth({ config: [ { providerId: "keycloak", ... }, ], }), ], ... }); ``` Then try to get the access token with: ```ts await auth.api.getAccessToken({ body: { providerId: "keycloak", }, headers: Astro.request.headers, }); ``` Gives error: ``` [ERROR] Provider keycloak is not supported. ``` ### Describe the solution you'd like I would love for `auth.api.getAccessToken` to work with the `genericOAuth` plugin. ### Describe alternatives you've considered Based on existing source code, I made this function that can be used instead: ```ts import { refreshAccessToken } from "better-auth/oauth2"; export const getAccessToken = async (userId: string) => { const ctx = await auth.$context; const [account] = await ctx.internalAdapter.findAccountByUserId(userId); if ( account.refreshToken && account.accessTokenExpiresAt && account.accessTokenExpiresAt.getTime() - Date.now() < 5_000 ) { try { const res = await refreshAccessToken({ refreshToken: account.refreshToken, tokenEndpoint: OIDC_TOKEN_URL, options: { clientId: OIDC_CLIENT, clientSecret: OIDC_SECRET, }, }); await ctx.internalAdapter.updateAccount(account.id, { accessToken: res.accessToken, accessTokenExpiresAt: res.accessTokenExpiresAt, refreshToken: res.refreshToken, refreshTokenExpiresAt: res.refreshTokenExpiresAt, }); console.log("Refreshed access token."); return res.accessToken; } catch (e: any) { console.error("Failed to refres access token:", e); return null; } } return account.accessToken; }; ``` ### Additional context Using Astro integration. ``` "astro": "^5.7.12", "better-auth": "1.2.8-beta.7" ```
GiteaMirror added the locked label 2026-04-15 16:15:42 -05:00
GiteaMirror commented 2026-04-15 16:15:44 -05:00
Author
Owner
Copy Link

@just-be-dev commented on GitHub (May 15, 2025):

I ran into this as well. On the app I'm working with there's only a genericOAuth plugin and the function doesn't show up in intellisense at all. I was confused about that because I had stumbled across this page in the docs talking about it and it took me a minute to realize that was a different code path.

<!-- gh-comment-id:2882174074 --> @just-be-dev commented on GitHub (May 15, 2025): I ran into this as well. On the app I'm working with there's _only_ a genericOAuth plugin and the function doesn't show up in intellisense at all. I was confused about that because I had stumbled across [this page](https://www.better-auth.com/docs/concepts/oauth#get-access-token) in the docs talking about it and it took me a minute to realize that was a different code path.
GiteaMirror commented 2026-04-15 16:15:45 -05:00
Author
Owner
Copy Link

@amal-chandran commented on GitHub (May 20, 2025):

Im also having a blocker due to the same, i also created a custom implementaion to get the fresh token.

<!-- gh-comment-id:2893482165 --> @amal-chandran commented on GitHub (May 20, 2025): Im also having a blocker due to the same, i also created a custom implementaion to get the fresh token.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#17906
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?