github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #3571] [CLOSED] feat(jwt): remote jwks, remote signing, and exportable signJwt function #4889

New Issue
Closed
opened 2026-03-13 12:03:10 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 12:03:10 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/3571
Author: @dvanmali
Created: 7/23/2025
Status: ❌ Closed

Base: main ← Head: jwt

📝 Commits (10+)

  • 966b697 feat: remote jwks, remote signing, and exportable signJwt function
  • 53e83c1 feat: create jwt types.ts
  • 20e0cc0 fix: use structure like #3555
  • db37233 Fix circular imports
  • 057d12f fix: circular dependency
  • 50ce230 Merge branch 'jwt' into jwt-export-fix
  • 11b1ac3 fix: Revert "fix: circular dependency" getJwtToken function move across files
  • 1287185 ci: help pass build step
  • c7cc48f fix: restore workflow
  • f48e416 fix: move to sign

📊 Changes

9 files changed (+813 additions, -543 deletions)

View changed files

📝 docs/content/docs/plugins/jwt.mdx (+67 -0)
📝 packages/better-auth/src/plugins/jwt/index.ts (+217 -323)
📝 packages/better-auth/src/plugins/jwt/jwt.test.ts (+239 -175)
📝 packages/better-auth/src/plugins/jwt/sign.ts (+121 -36)
➕ packages/better-auth/src/plugins/jwt/types.ts (+135 -0)
📝 packages/better-auth/src/plugins/jwt/utils.ts (+15 -0)
📝 packages/better-auth/src/plugins/oidc-provider/index.ts (+5 -5)
📝 packages/better-auth/src/plugins/oidc-provider/oidc.test.ts (+13 -4)
📝 packages/better-auth/src/types/helper.ts (+1 -0)

📄 Description

feat: remoteUrl option disables jwks endpoint and uses this endpoint in oAuth metadata

feat: remote sign payloads using Google KMS, AWS KMS, Azure Key Vault, etc.

feat usesOauthProvider adapts the plugin for use with OIDC and MCP

feat: signJwt (previously getJwtToken) now accepts payload as a parameter. Those who utilized exported getJwtToken should utilize signJwt and its payload parameter instead of through options. getJwtToken marked deprecated.

chore: combine shared createJwks functionality

Duplicate #3464
Partial #3458

Breaking Changes

NONE

Summary by cubic

Added support for remote JWKS URLs, remote JWT signing (e.g. with Google/AWS/Azure KMS), and an exportable signJwt function that accepts a payload. The getJwtToken function is now deprecated in favor of signJwt, and the plugin adapts for OIDC and MCP use cases.

  • New Features
    • Added remoteUrl option to use external JWKS and disable the local /jwks endpoint.
    • Added support for remote JWT signing via a custom sign function.
    • Exported signJwt for direct payload signing; getJwtToken is now deprecated.
    • Added usesOauthProvider option to adapt plugin for OIDC/MCP providers.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/3571 **Author:** [@dvanmali](https://github.com/dvanmali) **Created:** 7/23/2025 **Status:** ❌ Closed **Base:** `main` ← **Head:** `jwt` --- ### 📝 Commits (10+) - [`966b697`](https://github.com/better-auth/better-auth/commit/966b6971ea93dc7995991528a4c289a18b405834) feat: remote jwks, remote signing, and exportable signJwt function - [`53e83c1`](https://github.com/better-auth/better-auth/commit/53e83c17ca768ef61337e2752b9913fb148f0bd2) feat: create jwt types.ts - [`20e0cc0`](https://github.com/better-auth/better-auth/commit/20e0cc0101f247795c8902d1af46ac4270eafe2b) fix: use structure like #3555 - [`db37233`](https://github.com/better-auth/better-auth/commit/db37233d89c6b2c9abf1b38b23062f41173b0820) Fix circular imports - [`057d12f`](https://github.com/better-auth/better-auth/commit/057d12fee95891e9145bb75f3c3522bf6a46e4d2) fix: circular dependency - [`50ce230`](https://github.com/better-auth/better-auth/commit/50ce230ad486788268f3545ee2a4c46fc5d0f95d) Merge branch 'jwt' into jwt-export-fix - [`11b1ac3`](https://github.com/better-auth/better-auth/commit/11b1ac33bf0a516626067ab014f0d5bef145007e) fix: Revert "fix: circular dependency" `getJwtToken` function move across files - [`1287185`](https://github.com/better-auth/better-auth/commit/128718500f74146f7e5bffeb32c3ab977625722e) ci: help pass build step - [`c7cc48f`](https://github.com/better-auth/better-auth/commit/c7cc48fc115c635fa70064199fa6adb83ced504f) fix: restore workflow - [`f48e416`](https://github.com/better-auth/better-auth/commit/f48e41624d2ebe4dae1ae8c5b7c905b4e592fe30) fix: move to sign ### 📊 Changes **9 files changed** (+813 additions, -543 deletions) <details> <summary>View changed files</summary> 📝 `docs/content/docs/plugins/jwt.mdx` (+67 -0) 📝 `packages/better-auth/src/plugins/jwt/index.ts` (+217 -323) 📝 `packages/better-auth/src/plugins/jwt/jwt.test.ts` (+239 -175) 📝 `packages/better-auth/src/plugins/jwt/sign.ts` (+121 -36) ➕ `packages/better-auth/src/plugins/jwt/types.ts` (+135 -0) 📝 `packages/better-auth/src/plugins/jwt/utils.ts` (+15 -0) 📝 `packages/better-auth/src/plugins/oidc-provider/index.ts` (+5 -5) 📝 `packages/better-auth/src/plugins/oidc-provider/oidc.test.ts` (+13 -4) 📝 `packages/better-auth/src/types/helper.ts` (+1 -0) </details> ### 📄 Description **feat**: `remoteUrl` option disables jwks endpoint and uses this endpoint in oAuth metadata **feat**: remote sign payloads using Google KMS, AWS KMS, Azure Key Vault, etc. **feat** `usesOauthProvider` adapts the plugin for use with OIDC and MCP **feat**: `signJwt` (previously `getJwtToken`) now accepts payload as a parameter. Those who utilized exported `getJwtToken` should utilize `signJwt` and its payload parameter instead of through options. `getJwtToken` marked deprecated. **chore**: combine shared createJwks functionality __Duplicate #3464__ __Partial #3458__ --- ## Breaking Changes NONE <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Added support for remote JWKS URLs, remote JWT signing (e.g. with Google/AWS/Azure KMS), and an exportable signJwt function that accepts a payload. The getJwtToken function is now deprecated in favor of signJwt, and the plugin adapts for OIDC and MCP use cases. - **New Features** - Added `remoteUrl` option to use external JWKS and disable the local `/jwks` endpoint. - Added support for remote JWT signing via a custom `sign` function. - Exported `signJwt` for direct payload signing; `getJwtToken` is now deprecated. - Added `usesOauthProvider` option to adapt plugin for OIDC/MCP providers. <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 12:03:10 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#4889
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?