github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-08-24 14:34:26 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #8350] Support server-side accountInfo calls without session headers (follow getAccessToken pattern) #19696

New Issue
Open
opened 2026-04-15 18:59:29 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-04-15 18:59:29 -05:00
Owner
Copy Link
Copy Source

Originally created by @NathanColosimo on GitHub (Mar 3, 2026).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/8350

Is this suited for github?

  • Yes, this is suited for github

Is your feature request related to a problem? Please describe.

I want to get accountInfo server side so my AI tools + background jobs / agents can use it but currently have no way of doing so.

Describe the solution you'd like

getAccessToken already supports server-side calls without a session by accepting an optional userId body parameter and only enforcing the session when an HTTP request is present

from docs:

await auth.api.getAccessToken({
  body: {
    providerId: "google", // or any other provider id
    accountId: "accountId", // optional, if you want to get the access token for a specific account
    userId: "userId", // optional, if you don't provide headers with authenticated token
  },
  headers: await headers() // headers containing the user's session token
});

However, accountInfo uses sessionMiddleware which hard-blocks all calls without a valid session. This means server-side code cannot call accountInfo without reconstructing session headers:

// This fails — no way to pass userId, sessionMiddleware rejects it
await auth.api.accountInfo({
  query: { accountId: "..." },
  // no headers available in this context
});

Solution: make accountInfo follow same pattern as getAccessToken. Will still be fully backwards-compat.

I can open a PR for this today.

Describe alternatives you've considered

  • Passing fake headers: Requires constructing a session token just to satisfy middleware
  • Custom endpoint wrapper: What we currently do: a separate function that manually calls getAccessToken (which does support server-side) and then directly calls the provider's userinfo API.

Additional context

No response

Originally created by @NathanColosimo on GitHub (Mar 3, 2026). Original GitHub issue: https://github.com/better-auth/better-auth/issues/8350 ### Is this suited for github? - [x] Yes, this is suited for github ### Is your feature request related to a problem? Please describe. I want to get accountInfo server side so my AI tools + background jobs / agents can use it but currently have no way of doing so. ### Describe the solution you'd like getAccessToken already supports server-side calls without a session by accepting an optional userId body parameter and only enforcing the session when an HTTP request is present from docs: ``` await auth.api.getAccessToken({ body: { providerId: "google", // or any other provider id accountId: "accountId", // optional, if you want to get the access token for a specific account userId: "userId", // optional, if you don't provide headers with authenticated token }, headers: await headers() // headers containing the user's session token }); ``` However, accountInfo uses sessionMiddleware which hard-blocks all calls without a valid session. This means server-side code cannot call accountInfo without reconstructing session headers: ``` // This fails — no way to pass userId, sessionMiddleware rejects it await auth.api.accountInfo({ query: { accountId: "..." }, // no headers available in this context }); ``` Solution: make accountInfo follow same pattern as getAccessToken. Will still be fully backwards-compat. I can open a PR for this today. ### Describe alternatives you've considered - Passing fake headers: Requires constructing a session token just to satisfy middleware - Custom endpoint wrapper: What we currently do: a separate function that manually calls getAccessToken (which does support server-side) and then directly calls the provider's userinfo API. ### Additional context _No response_
GiteaMirror added the coreoauth labels 2026-04-15 18:59:29 -05:00
GiteaMirror commented 2026-04-15 18:59:30 -05:00
Author
Owner
Copy Link
Copy Source

@NathanColosimo commented on GitHub (Apr 1, 2026):

@himself65 Any chance you could take a look at this? Small feature that I think makes sense? The PR is open still

<!-- gh-comment-id:4166813544 --> @NathanColosimo commented on GitHub (Apr 1, 2026): @himself65 Any chance you could take a look at this? Small feature that I think makes sense? The PR is open still
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No labels core oauth
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#19696