github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

Support server-side accountInfo calls without session headers (follow getAccessToken pattern) #2978

New Issue
Open
opened 2026-03-13 10:31:51 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 10:31:51 -05:00
Owner
Copy Link

Originally created by @NathanColosimo on GitHub (Mar 3, 2026).

Is this suited for github?

  • Yes, this is suited for github

Is your feature request related to a problem? Please describe.

I want to get accountInfo server side so my AI tools + background jobs / agents can use it but have no way of doing so.

Describe the solution you'd like

getAccessToken already supports server-side calls without a session by accepting an optional userId body parameter and only enforcing the session when an HTTP request is present

from docs:

  body: {
    providerId: "google", // or any other provider id
    accountId: "accountId", // optional, if you want to get the access token for a specific account
    userId: "userId", // optional, if you don't provide headers with authenticated token
  },
  headers: await headers() // headers containing the user's session token
});```

However, accountInfo uses sessionMiddleware which hard-blocks all calls without a valid session. This means server-side code cannot call accountInfo without reconstructing session headers:

```// This fails — no way to pass userId, sessionMiddleware rejects it
await auth.api.accountInfo({
  query: { accountId: "..." },
  // no headers available in this context
});```


Solution: make accountInfo follow same pattern as getAccessToken. Will still be fully backwards-compat.

I can open a PR for this today.

### Describe alternatives you've considered

- Passing fake headers: Requires constructing a session token just to satisfy middleware
- Custom endpoint wrapper: What we currently do: a separate function that manually calls getAccessToken (which does support server-side) and then directly calls the provider's userinfo API. 

### Additional context

_No response_
Originally created by @NathanColosimo on GitHub (Mar 3, 2026). ### Is this suited for github? - [x] Yes, this is suited for github ### Is your feature request related to a problem? Please describe. I want to get accountInfo server side so my AI tools + background jobs / agents can use it but have no way of doing so. ### Describe the solution you'd like getAccessToken already supports server-side calls without a session by accepting an optional userId body parameter and only enforcing the session when an HTTP request is present from docs: ```await auth.api.getAccessToken({ body: { providerId: "google", // or any other provider id accountId: "accountId", // optional, if you want to get the access token for a specific account userId: "userId", // optional, if you don't provide headers with authenticated token }, headers: await headers() // headers containing the user's session token });``` However, accountInfo uses sessionMiddleware which hard-blocks all calls without a valid session. This means server-side code cannot call accountInfo without reconstructing session headers: ```// This fails — no way to pass userId, sessionMiddleware rejects it await auth.api.accountInfo({ query: { accountId: "..." }, // no headers available in this context });``` Solution: make accountInfo follow same pattern as getAccessToken. Will still be fully backwards-compat. I can open a PR for this today. ### Describe alternatives you've considered - Passing fake headers: Requires constructing a session token just to satisfy middleware - Custom endpoint wrapper: What we currently do: a separate function that manually calls getAccessToken (which does support server-side) and then directly calls the provider's userinfo API. ### Additional context _No response_
GiteaMirror added the enhancement label 2026-03-13 10:31:51 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#2978
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?