github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #3751] Reddit RefreshAccessToken fails because Header Authorisation lacks "Basic" #27034

New Issue
Closed
opened 2026-04-17 17:50:01 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-04-17 17:50:01 -05:00
Owner
Copy Link

Originally created by @DieTL95 on GitHub (Aug 2, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/3751

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

Create a reddit app using Better Auth, then when the access token expires, attempting to refresh the access token using the callback in the auth file and this server action

await auth.api.refreshToken({ body: { providerId: "reddit", userId: session?.user.id, accountId: account.id, }, });

Current vs. Expected behavior

Instead of refreshing the access token instead you'd get this error

[Error [APIError]: Failed to refresh access token] {
status: 'BAD_REQUEST',
body: [Object],
headers: {},
statusCode: 400,
digest: '1586944799'
}

What version of Better Auth are you using?

1.3.4

Provide environment information

Windows 10

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

export const auth = betterAuth({
  database: prismaAdapter(prisma, {
    provider: "postgresql"
  }),
  socialProviders: {
    reddit: {
      clientId: process.env.REDDIT_CLIENT as string,
      clientSecret: process.env.REDDIT_SECRET as string,

      scope: redditScopes,
      refreshAccessToken: async (refreshToken) => {
            return  await refreshAccessToken({

            refreshToken,

          options: {
            clientId: process.env.REDDIT_CLIENT as string,
            clientSecret: process.env.REDDIT_SECRET as string,
          },
          authentication: "basic",
        
        });
      },
   
      duration: "permanent",
    
      },
    },
  },
});

Additional context

Managed to solve it creating a custom RefreshAccessToken function where I added "Basic" to the header since it was just encoding the provided Client and Secret and reddit requires it it to also have the "Basic" apparently.

if (authentication === "basic") { headers["authorization"] = Basic ${base64.encode(
${options.clientId}:${options.clientSecret}
)};

Originally created by @DieTL95 on GitHub (Aug 2, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/3751 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce Create a reddit app using Better Auth, then when the access token expires, attempting to refresh the access token using the callback in the auth file and this server action `await auth.api.refreshToken({ body: { providerId: "reddit", userId: session?.user.id, accountId: account.id, }, });` ### Current vs. Expected behavior Instead of refreshing the access token instead you'd get this error > [Error [APIError]: Failed to refresh access token] { status: 'BAD_REQUEST', body: [Object], headers: {}, statusCode: 400, digest: '1586944799' } ### What version of Better Auth are you using? 1.3.4 ### Provide environment information ```bash Windows 10 ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) ```typescript export const auth = betterAuth({ database: prismaAdapter(prisma, { provider: "postgresql" }), socialProviders: { reddit: { clientId: process.env.REDDIT_CLIENT as string, clientSecret: process.env.REDDIT_SECRET as string, scope: redditScopes, refreshAccessToken: async (refreshToken) => { return await refreshAccessToken({ refreshToken, options: { clientId: process.env.REDDIT_CLIENT as string, clientSecret: process.env.REDDIT_SECRET as string, }, authentication: "basic", }); }, duration: "permanent", }, }, }, }); ``` ### Additional context Managed to solve it creating a custom RefreshAccessToken function where I added "Basic" to the header since it was just encoding the provided Client and Secret and reddit requires it it to also have the "Basic" apparently. `if (authentication === "basic") { headers["authorization"] = `_**Basic**_ ${base64.encode( `${options.clientId}:${options.clientSecret}` )}`;`
GiteaMirror added the locked label 2026-04-17 17:50:02 -05:00
GiteaMirror commented 2026-04-17 17:50:04 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Aug 2, 2025):

Hi @DieTL95! I'm Dosu and I’m helping the better-auth team.

This is a confirmed bug in Better Auth v1.3.4: the default refreshAccessToken implementation does not prepend the required Basic prefix to the Authorization header when refreshing Reddit tokens, even if you specify authentication: "basic". Reddit expects the header to be in the format Authorization: Basic <base64(clientId:clientSecret)>, and omitting the Basic prefix causes a 400 error during token refresh. You can see this in the code for the refreshAccessToken utility, which only base64-encodes the credentials without the prefix (source).

The only current solution is to use a custom refreshAccessToken function that manually sets the Authorization header with the Basic prefix, as you did. This is a known gap for all social providers in Better Auth right now (source). There’s no config workaround—custom logic is required until this is fixed upstream.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

<!-- gh-comment-id:3146414351 --> @dosubot[bot] commented on GitHub (Aug 2, 2025): <!-- Greeting --> Hi @DieTL95! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the better-auth team. <!-- Answer --> This is a confirmed bug in Better Auth v1.3.4: the default refreshAccessToken implementation does not prepend the required `Basic` prefix to the Authorization header when refreshing Reddit tokens, even if you specify `authentication: "basic"`. Reddit expects the header to be in the format `Authorization: Basic <base64(clientId:clientSecret)>`, and omitting the `Basic` prefix causes a 400 error during token refresh. You can see this in the code for the refreshAccessToken utility, which only base64-encodes the credentials without the prefix ([source](https://github.com/better-auth/better-auth/blob/fbdf2b3a18ab3edfc9fcde5ee299acf3ad96048d/packages/better-auth/src/oauth2/refresh-access-token.ts)). The only current solution is to use a custom refreshAccessToken function that manually sets the Authorization header with the `Basic` prefix, as you did. This is a known gap for all social providers in Better Auth right now ([source](https://github.com/better-auth/better-auth/issues/485)). There’s no config workaround—custom logic is required until this is fixed upstream. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/01843eaa-8fe3-417b-8545-2524b0562d86?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/01843eaa-8fe3-417b-8545-2524b0562d86?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/01843eaa-8fe3-417b-8545-2524b0562d86?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/01843eaa-8fe3-417b-8545-2524b0562d86?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/01843eaa-8fe3-417b-8545-2524b0562d86?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/01843eaa-8fe3-417b-8545-2524b0562d86?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/01843eaa-8fe3-417b-8545-2524b0562d86?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/3751)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#27034
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?