github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #4074] [MERGED] feat: remote sign a jwt payload #5169

New Issue
Closed
opened 2026-03-13 12:12:49 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 12:12:49 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/4074
Author: @dvanmali
Created: 8/18/2025
Status: ✅ Merged
Merged: 8/20/2025
Merged by: @himself65

Base: canary ← Head: jwt-sign

📝 Commits (8)

  • 62b00e3 feat: remote sign a jwt payload
  • 101fe6c style: cubic dev style fix
  • a441b53 docs: add kms links
  • 4c4bf78 fix: use toThrowError test check
  • 05ed825 fix: mimic jose for util
  • 9e07d02 feat: move seconds parsing into time util
  • b823614 Update docs/content/docs/plugins/jwt.mdx
  • 8d1d2e3 Merge branch 'canary' into jwt-sign

📊 Changes

7 files changed (+249 additions, -13 deletions)

View changed files

📝 docs/content/docs/plugins/jwt.mdx (+68 -0)
📝 packages/better-auth/src/plugins/jwt/index.ts (+20 -0)
📝 packages/better-auth/src/plugins/jwt/jwt.test.ts (+21 -3)
📝 packages/better-auth/src/plugins/jwt/sign.ts (+47 -10)
📝 packages/better-auth/src/plugins/jwt/utils.ts (+23 -0)
📝 packages/better-auth/src/types/helper.ts (+1 -0)
📝 packages/better-auth/src/utils/time.ts (+69 -0)

📄 Description

Remote sign payloads using a server-side privateKey environment variable or remote signing service like Google KMS, AWS KMS, Azure Key Vault, etc.

Partial https://github.com/better-auth/better-auth/pull/3572

Summary by cubic

Adds remote JWT signing via a new jwt.sign option, enabling KMS/HSM-backed signatures and external key custody. Also standardizes claim handling for exp/iat/iss/aud and updates docs with local and remote examples.

  • New Features

    • jwt.sign(payload): custom signer that returns the full JWT. Requires jwks.remoteUrl and you set headers (alg, kid, typ) yourself. Other jwt.* options are ignored when this is used.
    • Built-in signer now derives iss/aud from options or baseURL, computes exp via toExpJwt, and respects provided iat/nbf/sub/jti.
    • Validation: throws if jwt.sign is set without jwks.remoteUrl. Docs updated with localized and remote signing examples.

  • Migration

    • If using jwt.sign, set jwks.remoteUrl and jwks.keyPairConfig.alg, and define JWT headers inside your function.
    • If you relied on fixed exp/iat values, note they are now computed at runtime unless explicitly provided.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/4074 **Author:** [@dvanmali](https://github.com/dvanmali) **Created:** 8/18/2025 **Status:** ✅ Merged **Merged:** 8/20/2025 **Merged by:** [@himself65](https://github.com/himself65) **Base:** `canary` ← **Head:** `jwt-sign` --- ### 📝 Commits (8) - [`62b00e3`](https://github.com/better-auth/better-auth/commit/62b00e36db432d3655b06c9fbdd1e39fdb21335c) feat: remote sign a jwt payload - [`101fe6c`](https://github.com/better-auth/better-auth/commit/101fe6c89cc96e55d8444d7638c30a417c31215f) style: cubic dev style fix - [`a441b53`](https://github.com/better-auth/better-auth/commit/a441b53cf5768a3a9ee517e0196cacfb42089040) docs: add kms links - [`4c4bf78`](https://github.com/better-auth/better-auth/commit/4c4bf789939dc8274e0a777cde3e2bab8d70fdf7) fix: use toThrowError test check - [`05ed825`](https://github.com/better-auth/better-auth/commit/05ed825a4ec80fd0caab9df7b67a0ebe36c75c73) fix: mimic jose for util - [`9e07d02`](https://github.com/better-auth/better-auth/commit/9e07d0227bb46ddb2359814189a920c6054df9b3) feat: move seconds parsing into time util - [`b823614`](https://github.com/better-auth/better-auth/commit/b823614dcd5c175550df6c53db5a6f3e66ff6dc5) Update docs/content/docs/plugins/jwt.mdx - [`8d1d2e3`](https://github.com/better-auth/better-auth/commit/8d1d2e33eef70dccfc94cc3ed4033c039ea922c7) Merge branch 'canary' into jwt-sign ### 📊 Changes **7 files changed** (+249 additions, -13 deletions) <details> <summary>View changed files</summary> 📝 `docs/content/docs/plugins/jwt.mdx` (+68 -0) 📝 `packages/better-auth/src/plugins/jwt/index.ts` (+20 -0) 📝 `packages/better-auth/src/plugins/jwt/jwt.test.ts` (+21 -3) 📝 `packages/better-auth/src/plugins/jwt/sign.ts` (+47 -10) 📝 `packages/better-auth/src/plugins/jwt/utils.ts` (+23 -0) 📝 `packages/better-auth/src/types/helper.ts` (+1 -0) 📝 `packages/better-auth/src/utils/time.ts` (+69 -0) </details> ### 📄 Description Remote sign payloads using a server-side privateKey environment variable or remote signing service like Google KMS, AWS KMS, Azure Key Vault, etc. Partial https://github.com/better-auth/better-auth/pull/3572 <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Adds remote JWT signing via a new jwt.sign option, enabling KMS/HSM-backed signatures and external key custody. Also standardizes claim handling for exp/iat/iss/aud and updates docs with local and remote examples. - New Features - jwt.sign(payload): custom signer that returns the full JWT. Requires jwks.remoteUrl and you set headers (alg, kid, typ) yourself. Other jwt.* options are ignored when this is used. - Built-in signer now derives iss/aud from options or baseURL, computes exp via toExpJwt, and respects provided iat/nbf/sub/jti. - Validation: throws if jwt.sign is set without jwks.remoteUrl. Docs updated with localized and remote signing examples. - Migration - If using jwt.sign, set jwks.remoteUrl and jwks.keyPairConfig.alg, and define JWT headers inside your function. - If you relied on fixed exp/iat values, note they are now computed at runtime unless explicitly provided. <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 12:12:49 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#5169
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?