mirror of
https://github.com/better-auth/better-auth.git
synced 2026-08-04 22:00:13 -05:00
Gustavo Valverde
74cdffddde
Client registration carried two overlapping profile fields. `type` (web/native/user-agent-based) was a better-auth invention with no RFC 7591 standing, validated only for self-consistency against the auth method; `application_type` is the OIDC Registration field, and the one MCP clients are told to send. Registration accepted both without cross-checking, so a client could declare `type: "web"` alongside `application_type: "native"` and be stored claiming two profiles. Collapsing to `application_type` removes the ambiguity and gives the field a real column rather than the untyped metadata bag. `user-agent-based` has no successor: a browser app registers with `token_endpoint_auth_method: "none"`, which already marks it public. PKCE enforcement reads `application_type` for the native case that `type` used to cover, so a native client stays public whatever auth method it registered with.