Gustavo Valverde
3390792bbe
A confidential client with inline `jwks` can now replace its keys at `POST /oauth2/client/rotate-keys` without a user session. The request carries the complete new JWK Set and a client assertion signed by a current key, addressed to the rotation endpoint itself, so an assertion minted for the token endpoint or the issuer cannot be redirected here. Enabled with `allowClientKeyRotation`. Keys left out of the new set stop verifying at once. A client rolls a key in two steps, the way a jwks_uri client does: it sends the old and new keys together, then drops the old key once every instance signs with the new one. Only current keys can authorize a rotation, matching RFC 7592, node-oidc-provider, Ory Hydra, and Keycloak, where only the current management credential can change a client. The write is guarded on the exact key set the assertion was verified against, so a concurrent rotation fails with 409 instead of overwriting. No schema change is needed.
Better Auth
Better Auth is a framework-agnostic authentication (and authorization) framework for TypeScript. It provides a comprehensive set of features out of the box and includes a plugin ecosystem that simplifies adding advanced functionalities with minimal code in a short amount of time. Whether you need 2FA, multi-tenant support, or other complex features, it lets you focus on building your actual application instead of reinventing the wheel.
Why Better Auth
Authentication in the TypeScript ecosystem is a half-solved problem. Other open-source libraries often require a lot of additional code for anything beyond basic authentication. Rather than just pushing third-party services as the solution, I believe we can do better as a community—hence, Better Auth.
Contribution
Better Auth is a free and open source project licensed under the MIT License. You are free to do whatever you want with it.
You could help continuing its development by:
Security
If you discover a security vulnerability within Better Auth, please report it via GitHub Security Advisories.
All reports will be promptly addressed, and you'll be credited accordingly.