github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #3464] [CLOSED] feat(jwt): remote jwks, remote signing, and exportable signJwt function #30439

New Issue
Closed
opened 2026-04-17 21:32:02 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-17 21:32:02 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/3464
Author: @dvanmali
Created: 7/19/2025
Status: ❌ Closed

Base: main ← Head: jwt

📝 Commits (10+)

  • 966b697 feat: remote jwks, remote signing, and exportable signJwt function
  • 53e83c1 feat: create jwt types.ts
  • 20e0cc0 fix: use structure like #3555
  • db37233 Fix circular imports
  • 057d12f fix: circular dependency
  • 50ce230 Merge branch 'jwt' into jwt-export-fix
  • 11b1ac3 fix: Revert "fix: circular dependency" getJwtToken function move across files
  • 1287185 ci: help pass build step
  • c7cc48f fix: restore workflow
  • f48e416 fix: move to sign

📊 Changes

9 files changed (+811 additions, -543 deletions)

View changed files

📝 docs/content/docs/plugins/jwt.mdx (+67 -0)
📝 packages/better-auth/src/plugins/jwt/index.ts (+217 -323)
📝 packages/better-auth/src/plugins/jwt/jwt.test.ts (+239 -175)
📝 packages/better-auth/src/plugins/jwt/sign.ts (+121 -36)
➕ packages/better-auth/src/plugins/jwt/types.ts (+135 -0)
📝 packages/better-auth/src/plugins/jwt/utils.ts (+13 -0)
📝 packages/better-auth/src/plugins/oidc-provider/index.ts (+5 -5)
📝 packages/better-auth/src/plugins/oidc-provider/oidc.test.ts (+13 -4)
📝 packages/better-auth/src/types/helper.ts (+1 -0)

📄 Description

feat: remoteUrl option disables jwks endpoint and uses this endpoint in oAuth metadata

feat: remote sign payloads using Google KMS, AWS KMS, Azure Key Vault, etc.

feat usesOauthProvider adapts the plugin for use with OIDC and MCP

feat: signJwt (previously getJwtToken) now accepts payload as a parameter. Those who utilized exported getJwtToken should utilize signJwt and its payload parameter instead of through options. getJwtToken marked deprecated.

chore: combine shared createJwks functionality

Partial #3458

Breaking Changes

NONE

Summary by cubic

Added support for remote JWKS URLs, remote JWT signing (for KMS providers), and made the signJwt function exportable with payload input. This enables using external key management services and improves OIDC and OAuth provider compatibility.

  • New Features

    • Added jwks.remoteUrl to disable the local /jwks endpoint and use a remote JWKS in discovery.
    • Added jwt.sign for custom remote signing, supporting services like Google KMS, AWS KMS, and Azure Key Vault.
    • Added usesOauthProvider to adapt the plugin for OIDC and MCP use cases.
    • Exported signJwt to allow signing arbitrary payloads.

  • Bug Fixes

    • Updated signJwt to accept a payload parameter.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/3464 **Author:** [@dvanmali](https://github.com/dvanmali) **Created:** 7/19/2025 **Status:** ❌ Closed **Base:** `main` ← **Head:** `jwt` --- ### 📝 Commits (10+) - [`966b697`](https://github.com/better-auth/better-auth/commit/966b6971ea93dc7995991528a4c289a18b405834) feat: remote jwks, remote signing, and exportable signJwt function - [`53e83c1`](https://github.com/better-auth/better-auth/commit/53e83c17ca768ef61337e2752b9913fb148f0bd2) feat: create jwt types.ts - [`20e0cc0`](https://github.com/better-auth/better-auth/commit/20e0cc0101f247795c8902d1af46ac4270eafe2b) fix: use structure like #3555 - [`db37233`](https://github.com/better-auth/better-auth/commit/db37233d89c6b2c9abf1b38b23062f41173b0820) Fix circular imports - [`057d12f`](https://github.com/better-auth/better-auth/commit/057d12fee95891e9145bb75f3c3522bf6a46e4d2) fix: circular dependency - [`50ce230`](https://github.com/better-auth/better-auth/commit/50ce230ad486788268f3545ee2a4c46fc5d0f95d) Merge branch 'jwt' into jwt-export-fix - [`11b1ac3`](https://github.com/better-auth/better-auth/commit/11b1ac33bf0a516626067ab014f0d5bef145007e) fix: Revert "fix: circular dependency" `getJwtToken` function move across files - [`1287185`](https://github.com/better-auth/better-auth/commit/128718500f74146f7e5bffeb32c3ab977625722e) ci: help pass build step - [`c7cc48f`](https://github.com/better-auth/better-auth/commit/c7cc48fc115c635fa70064199fa6adb83ced504f) fix: restore workflow - [`f48e416`](https://github.com/better-auth/better-auth/commit/f48e41624d2ebe4dae1ae8c5b7c905b4e592fe30) fix: move to sign ### 📊 Changes **9 files changed** (+811 additions, -543 deletions) <details> <summary>View changed files</summary> 📝 `docs/content/docs/plugins/jwt.mdx` (+67 -0) 📝 `packages/better-auth/src/plugins/jwt/index.ts` (+217 -323) 📝 `packages/better-auth/src/plugins/jwt/jwt.test.ts` (+239 -175) 📝 `packages/better-auth/src/plugins/jwt/sign.ts` (+121 -36) ➕ `packages/better-auth/src/plugins/jwt/types.ts` (+135 -0) 📝 `packages/better-auth/src/plugins/jwt/utils.ts` (+13 -0) 📝 `packages/better-auth/src/plugins/oidc-provider/index.ts` (+5 -5) 📝 `packages/better-auth/src/plugins/oidc-provider/oidc.test.ts` (+13 -4) 📝 `packages/better-auth/src/types/helper.ts` (+1 -0) </details> ### 📄 Description **feat**: `remoteUrl` option disables jwks endpoint and uses this endpoint in oAuth metadata **feat**: remote sign payloads using Google KMS, AWS KMS, Azure Key Vault, etc. **feat** `usesOauthProvider` adapts the plugin for use with OIDC and MCP **feat**: `signJwt` (previously `getJwtToken`) now accepts payload as a parameter. Those who utilized exported `getJwtToken` should utilize `signJwt` and its payload parameter instead of through options. `getJwtToken` marked deprecated. **chore**: combine shared createJwks functionality __Partial #3458__ <!-- This is an auto-generated description by cubic. --> --- ## Breaking Changes NONE --- ## Summary by cubic Added support for remote JWKS URLs, remote JWT signing (for KMS providers), and made the signJwt function exportable with payload input. This enables using external key management services and improves OIDC and OAuth provider compatibility. - **New Features** - Added `jwks.remoteUrl` to disable the local `/jwks` endpoint and use a remote JWKS in discovery. - Added `jwt.sign` for custom remote signing, supporting services like Google KMS, AWS KMS, and Azure Key Vault. - Added `usesOauthProvider` to adapt the plugin for OIDC and MCP use cases. - Exported `signJwt` to allow signing arbitrary payloads. - **Bug Fixes** - Updated `signJwt` to accept a payload parameter. <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-17 21:32:02 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#30439
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?