github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-24 08:01:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #6737] Support OIDC Prompt Create (prompt=create) for OP-initiated registration #19238

New Issue
Closed
opened 2026-04-15 18:05:23 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 18:05:23 -05:00
Owner
Copy Link

Originally created by @gustavovalverde on GitHub (Dec 13, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/6737

Is this suited for github?

  • Yes, this is suited for github

Is your feature request related to a problem? Please describe.

We'd like Better Auth OIDC Provider to support the OpenID extension Initiating User Registration via OpenID Connect 1.0 (Prompt Create 1.0) so a relying party can initiate an OP-driven signup/onboarding flow using the standard prompt=create parameter.

Today, Better Auth OIDC Provider doesn't implement prompt=create as a supported prompt value and doesn't advertise prompt_values_supported, so:

  • RPs can't discover/feature-detect Prompt Create support via /.well-known/openid-configuration.
  • Sending prompt=create behaves like an unknown prompt value (ignored by the OP logic), meaning there's no spec-defined behavior or error semantics.

Describe the solution you'd like

Implement OpenID Connect Prompt Create 1.0 support in the oidcProvider plugin, including:

  1. Support the create prompt value
  • Treat prompt=create as "start from the account creation UX" (per spec).
  • Keep current behavior where the OP can still ultimately authenticate an existing identity (spec leaves this out-of-scope), but the default UX should be “create account”.
  1. Advertise support via discovery
  • Add prompt_values_supported to /.well-known/openid-configuration.
  • When Prompt Create is enabled/supported, include "create" and all other supported prompt values (e.g. "none", "login", "consent", "select_account").
  1. Prompt validation / error semantics
  • The spec says the OP SHOULD return HTTP 400 invalid_request when receiving a prompt value it doesn't support (i.e., not declared in prompt_values_supported) and recommends an error_description naming the invalid value.
  • Consider implementing this in a backward-compatible way (e.g. behind an option like strictPromptValidation), because some deployments may currently pass custom prompt values through as a UI hint.
  1. Config surface for "create UX"
  • Provide a way to route unauthenticated users to a registration-first experience when prompt=create is present (e.g. registerPage, or a callback to choose between loginPage / registerPage).
  • Alternatively, document a guaranteed behavior that prompt=create will be forwarded to the configured loginPage and that Better Auth will not ignore it internally, so implementers can reliably branch UI based on it.

Describe alternatives you've considered

  • App-specific parameter: pass a non-standard parameter (e.g. screen_hint=signup) to the authorization request and handle it only in the login UI. This works for a single RP/OP pair but isn't interoperable or discoverable for generic OIDC clients.
  • Treat prompt=create as a “hint” only: keep current behavior (it's preserved on the redirect to loginPage), but this still isn't spec-compliant because it isn't advertised in discovery and the OP doesn't recognize/validate supported prompt values.
  • Use an external IdP that already supports Prompt Create and make Better Auth a downstream RP, but we'd like Better Auth's built-in OIDC Provider to cover this onboarding scenario.

Additional context

Spec reference

  • OpenID Connect Prompt Create 1.0: https://openid.net/specs/openid-connect-prompt-create-1_0.html
    • Key requirements include: prompt=create initiates account creation UX; if OP supports it, it MUST publish prompt_values_supported including create; unsupported prompt values SHOULD yield HTTP 400 invalid_request.
Originally created by @gustavovalverde on GitHub (Dec 13, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/6737 ### Is this suited for github? - [x] Yes, this is suited for github ### Is your feature request related to a problem? Please describe. We'd like Better Auth **OIDC Provider** to support the OpenID extension [Initiating User Registration via OpenID Connect 1.0](https://openid.net/specs/openid-connect-prompt-create-1_0.html) (Prompt Create 1.0) so a relying party can initiate an OP-driven signup/onboarding flow using the standard `prompt=create` parameter. Today, Better Auth OIDC Provider doesn't implement `prompt=create` as a supported prompt value and doesn't advertise `prompt_values_supported`, so: - RPs can't discover/feature-detect Prompt Create support via `/.well-known/openid-configuration`. - Sending `prompt=create` behaves like an unknown prompt value (ignored by the OP logic), meaning there's no spec-defined behavior or error semantics. ### Describe the solution you'd like Implement **OpenID Connect Prompt Create 1.0** support in the `oidcProvider` plugin, including: 1) **Support the `create` prompt value** - Treat `prompt=create` as "start from the account creation UX" (per spec). - Keep current behavior where the OP can still ultimately authenticate an existing identity (spec leaves this out-of-scope), but the default UX should be “create account”. 2) **Advertise support via discovery** - Add `prompt_values_supported` to `/.well-known/openid-configuration`. - When Prompt Create is enabled/supported, include `"create"` *and* all other supported prompt values (e.g. `"none"`, `"login"`, `"consent"`, `"select_account"`). 3) **Prompt validation / error semantics** - The spec says the OP **SHOULD** return HTTP 400 `invalid_request` when receiving a `prompt` value it doesn't support (i.e., not declared in `prompt_values_supported`) and recommends an `error_description` naming the invalid value. - Consider implementing this in a backward-compatible way (e.g. behind an option like `strictPromptValidation`), because some deployments may currently pass custom prompt values through as a UI hint. 4) **Config surface for "create UX"** - Provide a way to route unauthenticated users to a registration-first experience when `prompt=create` is present (e.g. `registerPage`, or a callback to choose between `loginPage` / `registerPage`). - Alternatively, document a guaranteed behavior that `prompt=create` will be forwarded to the configured `loginPage` and that Better Auth will not ignore it internally, so implementers can reliably branch UI based on it. ### Describe alternatives you've considered - **App-specific parameter**: pass a non-standard parameter (e.g. `screen_hint=signup`) to the authorization request and handle it only in the login UI. This works for a single RP/OP pair but isn't interoperable or discoverable for generic OIDC clients. - **Treat `prompt=create` as a “hint” only**: keep current behavior (it's preserved on the redirect to `loginPage`), but this still isn't spec-compliant because it isn't advertised in discovery and the OP doesn't recognize/validate supported prompt values. - **Use an external IdP** that already supports Prompt Create and make Better Auth a downstream RP, but we'd like Better Auth's built-in OIDC Provider to cover this onboarding scenario. ### Additional context **Spec reference** - OpenID Connect Prompt Create 1.0: https://openid.net/specs/openid-connect-prompt-create-1_0.html - Key requirements include: `prompt=create` initiates account creation UX; if OP supports it, it **MUST** publish `prompt_values_supported` including `create`; unsupported prompt values **SHOULD** yield HTTP 400 `invalid_request`.
GiteaMirror added the lockedenhancement labels 2026-04-15 18:05:23 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label enhancement locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#19238
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?