github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 22:32:01 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #1946] getOAuth2Tokens should also return aud, iss, & sub` #8977

New Issue
Closed
opened 2026-04-13 04:13:36 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-13 04:13:36 -05:00
Owner
Copy Link

Originally created by @ericclemmons on GitHub (Mar 22, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/1946

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

  1. Setup project based on https://www.better-auth.com/docs/plugins/generic-oauth#advanced-usage
  2. console.info({ tokens })
  3. Notice the output excludes aud, iss, and sub

093f9de0e1/packages/better-auth/src/oauth2/utils.ts (L13-L28)

Current vs. Expected behavior

When using userInfoUrl or getUserInfo, some APIs require more than just accessToken to get the user profile.

For example, https://docs.bsky.app/docs/api/app-bsky-actor-get-profile's host is determined by the returned aud and the account DID must be passed from sub.

What version of Better Auth are you using?

1.2.4

Provide environment information

- OS: macOS
- Browser: Chrome
- Framework: Astro

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

export const auth = betterAuth({
  account: {
    accountLinking: {
      allowDifferentEmails: true,
      enabled: true,
      trustedProviders: [
        "email-password",
        "apple",
        "github",
        "google",
        "twitter",
      ],
    },
  },
  baseURL: import.meta.env.PUBLIC_URL,
  database: drizzleAdapter(db, { provider: "pg" }),
  emailAndPassword: {
    enabled: true,
  },
  plugins: [
    genericOAuth({
      config: [
        {
          providerId: "bluesky",
          clientId: `${import.meta.env.PUBLIC_URL}/auth/client-metadata.json`,
          clientSecret: "NONE",
          scopes: ["atproto", "transition:generic", "transition:chat.bsky"],
          responseType: "code",
          authorizationUrl: "https://bsky.social/oauth/authorize",
          tokenUrl: `${import.meta.env.PUBLIC_URL}/api/bluesky/token`,
          getUserInfo(tokens) {
            console.info({ tokens });

            return {};
          },

Additional context

I'm able to bastardize the token by setting id_token: sub, but this only works with getUserInfo as calling the tokenUrl fails with an invalid JWT.

Originally created by @ericclemmons on GitHub (Mar 22, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/1946 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce 1. Setup project based on https://www.better-auth.com/docs/plugins/generic-oauth#advanced-usage 2. `console.info({ tokens })` 3. Notice the output excludes `aud`, `iss`, and `sub` https://github.com/better-auth/better-auth/blob/093f9de0e1191960e7b4e7c49c6878e54597022c/packages/better-auth/src/oauth2/utils.ts#L13-L28 ### Current vs. Expected behavior When using `userInfoUrl` or `getUserInfo`, some APIs require more than just `accessToken` to get the user profile. For example, https://docs.bsky.app/docs/api/app-bsky-actor-get-profile's host is determined by the returned `aud` and the account DID must be passed from `sub`. ### What version of Better Auth are you using? 1.2.4 ### Provide environment information ```bash - OS: macOS - Browser: Chrome - Framework: Astro ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) ```typescript export const auth = betterAuth({ account: { accountLinking: { allowDifferentEmails: true, enabled: true, trustedProviders: [ "email-password", "apple", "github", "google", "twitter", ], }, }, baseURL: import.meta.env.PUBLIC_URL, database: drizzleAdapter(db, { provider: "pg" }), emailAndPassword: { enabled: true, }, plugins: [ genericOAuth({ config: [ { providerId: "bluesky", clientId: `${import.meta.env.PUBLIC_URL}/auth/client-metadata.json`, clientSecret: "NONE", scopes: ["atproto", "transition:generic", "transition:chat.bsky"], responseType: "code", authorizationUrl: "https://bsky.social/oauth/authorize", tokenUrl: `${import.meta.env.PUBLIC_URL}/api/bluesky/token`, getUserInfo(tokens) { console.info({ tokens }); return {}; }, ``` ### Additional context I'm able to bastardize the token by setting `id_token: sub`, but this only works with `getUserInfo` as calling the `tokenUrl` fails with an invalid JWT.
GiteaMirror added the lockedbug labels 2026-04-13 04:13:37 -05:00
GiteaMirror commented 2026-04-13 04:13:38 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Jun 21, 2025):

Hi, @ericclemmons. I'm Dosu, and I'm helping the better-auth team manage their backlog. I'm marking this issue as stale.

Issue Summary:

  • The getOAuth2Tokens function in Better Auth version 1.2.4 only returns the accessToken.
  • You suggested it should also return aud, iss, and sub for API compatibility.
  • This issue affects backend users on macOS with Chrome and Astro.
  • No comments or developments have been made on this issue yet.

Next Steps:

  • Please let me know if this issue is still relevant to the latest version of the better-auth repository by commenting here.
  • If there is no further activity, this issue will be automatically closed in 7 days.

Thank you for your understanding and contribution!

<!-- gh-comment-id:2993649945 --> @dosubot[bot] commented on GitHub (Jun 21, 2025): Hi, @ericclemmons. I'm [Dosu](https://dosu.dev), and I'm helping the better-auth team manage their backlog. I'm marking this issue as stale. **Issue Summary:** - The `getOAuth2Tokens` function in Better Auth version 1.2.4 only returns the `accessToken`. - You suggested it should also return `aud`, `iss`, and `sub` for API compatibility. - This issue affects backend users on macOS with Chrome and Astro. - No comments or developments have been made on this issue yet. **Next Steps:** - Please let me know if this issue is still relevant to the latest version of the better-auth repository by commenting here. - If there is no further activity, this issue will be automatically closed in 7 days. Thank you for your understanding and contribution!
GiteaMirror commented 2026-04-13 04:13:38 -05:00
Author
Owner
Copy Link

@zilahir commented on GitHub (Sep 13, 2025):

hi @ericclemmons! have you eventually managed to get this working? been stuck with the bluesky oauth flow for a couple of days now.

<!-- gh-comment-id:3288432857 --> @zilahir commented on GitHub (Sep 13, 2025): hi @ericclemmons! have you eventually managed to get this working? been stuck with the bluesky oauth flow for a couple of days now.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#8977
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?