github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

OAuth utilities separate from accounts #2868

New Issue
Open
opened 2026-03-13 10:24:42 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 10:24:42 -05:00
Owner
Copy Link

Originally created by @isaacwasserman on GitHub (Feb 13, 2026).

Is this suited for github?

  • Yes, this is suited for github

Is your feature request related to a problem? Please describe.

Better Auth has made integrating with different authentication providers through OAuth and OIDC so easy, but it remains difficult to maintain 3rd party OAuth tokens for non-authentication-related scopes.

For example, I want my app to integrate with users' Jira accounts via OAuth to allow management of issues. I don't necessarily need them to be able to sign-in to my app with this service. While additional scopes can be requested using Better Auth, there doesn't seem to be any easy way to request these tokens, auto refresh, etc. for non-user-authentication purposes (like arbitrary API interaction).

Describe the solution you'd like

I wish there was a Better Auth plugin that allowed me to provide a typical issuer, client_id, and client_secret for an arbitrary OAuth provider and request tokens using an interface like:

/* start frontend */
// 1. Direct user to oauth flow from frontend
const { data: { success } } = authClient.oAuth.acquireAccessToken({
  providerId,
  scopes,
  association: {
    userId // or organizationId
  }
})
/* end frontend */

/* start backend */
// 2. After callback, Better Auth saves access and refresh tokens to proper db record based on association parameters (e.g. saves it to users.oauthTokens[providerId][scopes])

// 3. Backend service requests token. Automatically refreshing it if expired.
const { data: { accessToken } } = auth.oAuth.retrieveAccessToken({
  providerId,
  scopes,
  association: {
    userId // or organizationId
  }
})

// 4. Backend service uses access token to query/mutate resources via 3rd party API
/* end backend */

Describe alternatives you've considered

There's always the option of doing this manually for each provider or trying to develop my own standard interface, but it's a pain, and Better Auth already does most of this so well. The process is mostly the same for each provider, but there are caveats that make a home-grown solution more brittle.

Additional context

No response

Originally created by @isaacwasserman on GitHub (Feb 13, 2026). ### Is this suited for github? - [x] Yes, this is suited for github ### Is your feature request related to a problem? Please describe. Better Auth has made integrating with different authentication providers through OAuth and OIDC so easy, but it remains difficult to maintain 3rd party OAuth tokens for non-authentication-related scopes. For example, I want my app to integrate with users' Jira accounts via OAuth to allow management of issues. I don't necessarily need them to be able to sign-in to my app with this service. While additional scopes can be requested using Better Auth, there doesn't seem to be any easy way to request these tokens, auto refresh, etc. for non-user-authentication purposes (like arbitrary API interaction). ### Describe the solution you'd like I wish there was a Better Auth plugin that allowed me to provide a typical issuer, client_id, and client_secret for an arbitrary OAuth provider and request tokens using an interface like: ```typescript /* start frontend */ // 1. Direct user to oauth flow from frontend const { data: { success } } = authClient.oAuth.acquireAccessToken({ providerId, scopes, association: { userId // or organizationId } }) /* end frontend */ /* start backend */ // 2. After callback, Better Auth saves access and refresh tokens to proper db record based on association parameters (e.g. saves it to users.oauthTokens[providerId][scopes]) // 3. Backend service requests token. Automatically refreshing it if expired. const { data: { accessToken } } = auth.oAuth.retrieveAccessToken({ providerId, scopes, association: { userId // or organizationId } }) // 4. Backend service uses access token to query/mutate resources via 3rd party API /* end backend */ ``` ### Describe alternatives you've considered There's always the option of doing this manually for each provider or trying to develop my own standard interface, but it's a pain, and Better Auth already does most of this so well. The process is mostly the same for each provider, but there are caveats that make a home-grown solution more brittle. ### Additional context _No response_
GiteaMirror added the enhancement label 2026-03-13 10:24:42 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#2868
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?