github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #6217] Error creating API Key from client #19080

New Issue
Closed
opened 2026-04-15 17:52:22 -05:00 by GiteaMirror · 3 comments
GiteaMirror commented 2026-04-15 17:52:22 -05:00
Owner
Copy Link

Originally created by @matteobad on GitHub (Nov 22, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/6217

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

Passing permissions option from the client triggers a 400. The documentation states that permissions is a valid client side option, but in the source code permissions is treated as a server-only option.

  1. Add the apiKey plugin
  2. Try to create an API Key from the client with code from docs
  3. 400 THE_PROPERTY_YOURE_TRYING_TO_SET_CAN_ONLY_BE_SET_FROM_THE_SERVER_AUTH_INSTANCE_ONLY

Current vs. Expected behavior

If permissions can be set from the client-side we should fix the current implementation
If permissions cannot be set from the client-side we should update the documentation

What version of Better Auth are you using?

1.4.1

System info

{
  "system": {
    "platform": "darwin",
    "arch": "arm64",
    "version": "Darwin Kernel Version 25.1.0: Mon Oct 20 19:32:41 PDT 2025; root:xnu-12377.41.6~2/RELEASE_ARM64_T6000",
    "release": "25.1.0",
    "cpuCount": 8,
    "cpuModel": "Apple M1 Pro",
    "totalMemory": "16.00 GB",
    "freeMemory": "0.72 GB"
  },
  "node": {
    "version": "v22.20.0",
    "env": "development"
  },
  "packageManager": {
    "name": "npm",
    "version": "10.9.3"
  },
  "frameworks": [
    {
      "name": "next",
      "version": "16.0.3"
    },
    {
      "name": "react",
      "version": "19.2.0"
    },
    {
      "name": "hono",
      "version": "^4.10.6"
    }
  ],
  "databases": [
    {
      "name": "pg",
      "version": "^8.16.0"
    },
    {
      "name": "drizzle",
      "version": "^0.44.7"
    },
    {
      "name": "@neondatabase/serverless",
      "version": "^1.0.2"
    }
  ],
  "betterAuth": {
    "version": "^1.4.1",
    "config": null
  }
}

Which area(s) are affected? (Select all that apply)

Client, Documentation

Auth config (if applicable)

import { betterAuth } from "better-auth"
export const auth = betterAuth({
  emailAndPassword: {  
    enabled: true
  },
});

Additional context

I'm willing to contribute with a PR

Originally created by @matteobad on GitHub (Nov 22, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/6217 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce Passing `permissions` option from the client triggers a 400. The documentation states that `permissions` is a valid client side option, but in the source code `permissions` is treated as a server-only option. 1. Add the `apiKey` plugin 2. Try to create an API Key from the client with code from [docs](https://www.better-auth.com/docs/plugins/api-key#create-an-api-key) 3. 400 THE_PROPERTY_YOURE_TRYING_TO_SET_CAN_ONLY_BE_SET_FROM_THE_SERVER_AUTH_INSTANCE_ONLY ### Current vs. Expected behavior If `permissions` can be set from the client-side we should fix the current implementation If `permissions` cannot be set from the client-side we should update the documentation ### What version of Better Auth are you using? 1.4.1 ### System info ```bash { "system": { "platform": "darwin", "arch": "arm64", "version": "Darwin Kernel Version 25.1.0: Mon Oct 20 19:32:41 PDT 2025; root:xnu-12377.41.6~2/RELEASE_ARM64_T6000", "release": "25.1.0", "cpuCount": 8, "cpuModel": "Apple M1 Pro", "totalMemory": "16.00 GB", "freeMemory": "0.72 GB" }, "node": { "version": "v22.20.0", "env": "development" }, "packageManager": { "name": "npm", "version": "10.9.3" }, "frameworks": [ { "name": "next", "version": "16.0.3" }, { "name": "react", "version": "19.2.0" }, { "name": "hono", "version": "^4.10.6" } ], "databases": [ { "name": "pg", "version": "^8.16.0" }, { "name": "drizzle", "version": "^0.44.7" }, { "name": "@neondatabase/serverless", "version": "^1.0.2" } ], "betterAuth": { "version": "^1.4.1", "config": null } } ``` ### Which area(s) are affected? (Select all that apply) Client, Documentation ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth" export const auth = betterAuth({ emailAndPassword: { enabled: true }, }); ``` ### Additional context I'm willing to contribute with a PR
GiteaMirror added the lockedbug labels 2026-04-15 17:52:22 -05:00
GiteaMirror commented 2026-04-15 17:52:23 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Nov 22, 2025):

Hi there! Thanks for reporting this. It looks like when trying to create an API key from the client, supplying the permissions option triggers a 400 error because this property is intended to be set only from the server instance. Currently, the implementation explicitly disallows client-side setting of permissions. This means the documentation and the behavior are out of sync—either we update the docs to clarify that permissions must be set on the server, or we adjust the implementation to allow client-side configuration as documented.

As a next step, please verify if you want the client to be able to set permissions. If so, a fix in the source code to allow that would be welcome; otherwise, updating the documentation may be more appropriate. Also, please check that the API key plugin in your project is correctly registered on the server instance and that client requests do not inadvertently include server-only fields.

Tag @better-auth-agent if you would like an answer from the Agent. Do you have any additional context or use case details that might help clarify the intended workflow further?

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3567040421 --> @better-auth-agent[bot] commented on GitHub (Nov 22, 2025): Hi there! Thanks for reporting this. It looks like when trying to create an API key from the client, supplying the permissions option triggers a 400 error because this property is intended to be set only from the server instance. Currently, the implementation explicitly disallows client-side setting of permissions. This means the documentation and the behavior are out of sync—either we update the docs to clarify that permissions must be set on the server, or we adjust the implementation to allow client-side configuration as documented. As a next step, please verify if you want the client to be able to set permissions. If so, a fix in the source code to allow that would be welcome; otherwise, updating the documentation may be more appropriate. Also, please check that the API key plugin in your project is correctly registered on the server instance and that client requests do not inadvertently include server-only fields. Tag @better-auth-agent if you would like an answer from the Agent. Do you have any additional context or use case details that might help clarify the intended workflow further? <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)
GiteaMirror commented 2026-04-15 17:52:24 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Nov 22, 2025):

Hi @matteobad! I'm Dosu and I’m helping the better-auth team.

The 400 error happens because the permissions property is intentionally server-only for API Key creation in Better Auth. The implementation blocks setting permissions from the client side for security reasons—only server-side code can set privileged properties like this. The documentation currently suggests otherwise, which is misleading and should be updated to clarify that permissions cannot be set from the client side and must be set server-side instead (code reference).

If you need to create API Keys with custom permissions, use the server-side auth.api.createApiKey method and pass the permissions object there. Client-side API Key creation should not include the permissions property.

If you want to contribute a PR, the best path is to update the API Key plugin documentation to clearly state that permissions is server-only and cannot be set from the client. This will help prevent confusion and errors for other users.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

<!-- gh-comment-id:3567043162 --> @dosubot[bot] commented on GitHub (Nov 22, 2025): <!-- Greeting --> Hi @matteobad! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the better-auth team. <!-- Answer --> The 400 error happens because the `permissions` property is intentionally server-only for API Key creation in Better Auth. The implementation blocks setting `permissions` from the client side for security reasons—only server-side code can set privileged properties like this. The documentation currently suggests otherwise, which is misleading and should be updated to clarify that `permissions` cannot be set from the client side and must be set server-side instead ([code reference](https://github.com/better-auth/better-auth/blob/54852e30e0bbcb9f7a0e8dfc284447915adb706f/packages/better-auth/src/plugins/api-key/routes/create-api-key.ts#L112-L413)). If you need to create API Keys with custom permissions, use the server-side `auth.api.createApiKey` method and pass the `permissions` object there. Client-side API Key creation should not include the `permissions` property. If you want to contribute a PR, the best path is to update the API Key plugin documentation to clearly state that `permissions` is server-only and cannot be set from the client. This will help prevent confusion and errors for other users. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/40ff3413-f5b8-4815-9508-e78e751c752d?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/40ff3413-f5b8-4815-9508-e78e751c752d?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/40ff3413-f5b8-4815-9508-e78e751c752d?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/40ff3413-f5b8-4815-9508-e78e751c752d?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/40ff3413-f5b8-4815-9508-e78e751c752d?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/40ff3413-f5b8-4815-9508-e78e751c752d?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/40ff3413-f5b8-4815-9508-e78e751c752d?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=The%20400%20error%20happens%20because%20the%20%60permissions%60%20property%20is%20intentionally%20server-only%20for%20API%20Key%20creation%20in%20Better%20Auth.%20The%20implementation%20blocks%20setting%20%60permissions%60%20from%20the%20client%20side%20for%20security%20reasons%E2%80%94only%20server-side%20code%20can%20set%20privileged%20properties%20like%20this.%20The%20documentation%20currently%20suggests%20otherwise%2C%20which%20is%20misleading%20and%20should%20be%20updated%20to%20clarify%20that%20%60permissions%60%20cannot%20be%20set%20from%20the%20client%20side%20and%20must%20be%20set%20server-side%20instead%20%28%5Bcode%20reference%5D%28https%3A//github.com/better-auth/better-auth/blob/54852e30e0bbcb9f7a0e8dfc284447915adb706f/packages/better-auth/src/plugins/api-key/routes/create-api-key.ts%23L112-L413%29%29.%0A%0AIf%20you%20need%20to%20create%20API%20Keys%20with%20custom%20permissions%2C%20use%20the%20server-side%20%60auth.api.createApiKey%60%20method%20and%20pass%20the%20%60permissions%60%20object%20there.%20Client-side%20API%20Key%20creation%20should%20not%20include%20the%20%60permissions%60%20property.%0A%0AIf%20you%20want%20to%20contribute%20a%20PR%2C%20the%20best%20path%20is%20to%20update%20the%20API%20Key%20plugin%20documentation%20to%20clearly%20state%20that%20%60permissions%60%20is%20server-only%20and%20cannot%20be%20set%20from%20the%20client.%20This%20will%20help%20prevent%20confusion%20and%20errors%20for%20other%20users.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/6217)
GiteaMirror commented 2026-04-15 17:52:25 -05:00
Author
Owner
Copy Link

@matteobadini commented on GitHub (Nov 22, 2025):

Thank you for the clarification @dosu. I will create a PR to update the docs

<!-- gh-comment-id:3567044985 --> @matteobadini commented on GitHub (Nov 22, 2025): Thank you for the clarification @dosu. I will create a PR to update the docs
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#19080
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?