better-auth

add-hydrate-session.md

feat(client): add hydrateSession for SSR session hydration (#8733 )

2026-04-22 21:09:45 +00:00

anonymous-oauth-server-context.md

feat(oauth): server-trusted state channel; fix anonymous cookieless linking (#9930 )

2026-06-08 01:00:05 +00:00

authorize-missing-response-type.md

fix(oauth-provider): redirect missing response_type errors (#10149 )

2026-06-19 08:55:26 -07:00

authorize-post-request-objects.md

fix(oauth-provider): handle OIDC authorization request inputs (#10151 )

2026-06-19 10:17:35 -07:00

canonical-oauth-client-registration.md

chore(changeset): restore minor release levels for the 1.7 line (#10606 )

2026-07-30 22:00:33 -04:00

captcha-wildcard-endpoints.md

feat(captcha)!: support wildcard endpoint matching (#10004 )

2026-06-11 23:47:25 +00:00

cimd-cache-and-redirect-validation.md

feat(oauth-provider)!: align MCP authorization with 2026-07-28 (#10577 )

2026-07-30 21:42:14 -04:00

cimd-plugin.md

chore(changeset): restore minor release levels for the 1.7 line (#10606 )

2026-07-30 22:00:33 -04:00

claim-input-session-id.md

feat(oauth-provider): expose sessionId to id_token claim contributors (#10113 )

2026-06-17 11:53:30 +00:00

clever-claims-request.md

feat(oauth-provider): honor requested UserInfo claims via a claim registry (#10156 )

2026-06-19 18:08:35 -07:00

cli-named-default-auto-detect.md

chore(changeset): restore changeset for cli named+default fix (#9477 ) (#9501 )

2026-05-09 13:50:16 +00:00

cli-requires-node-22.md

chore(deps)!: upgrade dependencies to latest (#10170 )

2026-06-20 10:15:37 -07:00

cloudflare-create-require-runtime.md

fix: cloudflare runtime require helper (#10014 )

2026-06-11 21:53:18 -07:00

code-replay-invalid-grant.md

fix(oauth-provider): reject authorization code replay correctly (#10150 )

2026-06-19 10:04:57 -07:00

compound-database-indexes.md

feat(db): add compound table indexes (#10402 )

2026-07-16 14:31:48 +01:00

config.json

chore(release): prepare 1.7 RC channel (#10255 )

2026-06-26 22:59:20 +01:00

consume-phone-number-otp.md

feat(phone-number): add server-side OTP consumption API (#9766 )

2026-06-11 16:58:16 -07:00

cool-lights-burn.md

fix(stripe)!: remove optional marker from onSubscriptionCancel event (#9359 )

2026-04-26 10:23:30 +00:00

create-initial-admin-cli.md

feat(cli): add create-admin command (#9547 )

2026-05-12 10:30:04 +00:00

dcr-graceful-override-confidential.md

fix(oauth-provider): preserve dcr client key metadata (#10144 )

2026-06-18 22:46:03 -07:00

dcr-pkce-policy.md

feat(oauth-provider): allow confidential DCR clients without PKCE (#10146 )

2026-06-19 06:29:08 -07:00

dedupe-session-suspense-retries.md

fix(client): deduplicate session requests across suspense retries (#10676 )

2026-08-04 22:25:16 +00:00

device-authorization-indexes.md

fix(device-authorization)!: add lookup indexes (#10059 )

2026-07-23 07:22:08 -04:00

drizzle-relations-v2-schema-name.md

feat(drizzle): generate drizzle schema with schema namespace (#7169 )

2026-07-07 17:57:24 +00:00

dynamic-baseurl-hardening.md

feat(oauth-provider)!: align MCP authorization with 2026-07-28 (#10577 )

2026-07-30 21:42:14 -04:00

fiery-guests-visit.md

fix(electron)!: enforce S256 PKCE and harden origin checks (#9645 )

2026-06-07 23:43:06 +00:00

fix-2fa-bypass.md

chore: release v1.6.3 (#9081 )

2026-04-14 12:04:31 +01:00

fix-backup-codes-storage.md

chore: release v1.6.3 (#9081 )

2026-04-14 12:04:31 +01:00

fix-oauth-provider-rfc-error-envelope.md

fix(oauth-provider)!: return RFC-compliant error envelopes from validation failures (#9277 )

2026-04-22 06:48:34 +00:00

fix-password-reset-callback-operation-id.md

chore: release v1.6.3 (#9081 )

2026-04-14 12:04:31 +01:00

fix-revert-2fa-broadening.md

chore: main to next conflict resolution

2026-04-15 15:40:35 +01:00

fix-stripe-defu-prototype-pollution.md

chore: release v1.6.3 (#9081 )

2026-04-14 12:04:31 +01:00

force-allow-id-uuid.md

chore: main to next conflict resolution

2026-04-15 15:40:35 +01:00

four-turkeys-thank.md

feat(drizzle-adapter): support Drizzle Relations v2 (#9489 )

2026-06-26 11:01:48 +00:00

free-files-tease.md

feat(oauth-provider)!: model OAuth protected resources explicitly (#9648 )

2026-06-12 10:08:43 -07:00

generic-oauth-refresh-token-params.md

feat(generic-oauth): forward refreshTokenParams to token endpoint (#9948 )

2026-06-17 21:03:56 +00:00

generic-oauth-unification.md

feat: add token endpoint client authentication (#9625 )

2026-05-16 18:27:15 +00:00

generic-oauth-verify-id-token.md

fix(generic-oauth): bind id token nonce in redirect flow (#10095 )

2026-06-16 21:20:07 +00:00

green-chairs-drum.md

feat(generic-oauth): add RP-initiated logout support (#9368 )

2026-07-23 12:24:53 +00:00

heavy-planes-remain.md

feat(sso)!: support multiple IdP signing certificates (#8805 )

2026-05-18 03:07:37 +00:00

honest-regions-jam.md

chore: release v1.6.3 (#9081 )

2026-04-14 12:04:31 +01:00

honest-symbols-stick.md

chore: release v1.6.3 (#9081 )

2026-04-14 12:04:31 +01:00

host-classifier-ssrf-hardening.md

fix(cimd): route client_id SSRF checks through the shared host classifier (#10126 )

2026-06-17 18:29:06 -07:00

hungry-camels-listen.md

chore: widen drizzle-kit peer dependency range (#10299 )

2026-07-07 18:59:55 +00:00

hungry-drinks-read.md

feat: make Auth instance fetchable (#9431 )

2026-05-07 13:55:03 -07:00

i18n-built-in-translations.md

feat(i18n): add built-in translations for 22 languages (#9157 )

2026-05-06 11:51:17 +00:00

id-token-claim-authority.md

feat(oauth-provider)!: make id-token claim authority explicit (#10140 )

2026-06-18 14:25:12 -07:00

insufficient-scope-challenge.md

feat(oauth-provider)!: align MCP authorization with 2026-07-28 (#10577 )

2026-07-30 21:42:14 -04:00

issuer-scoped-account-identities.md

fix(core): preserve issuer-scoped account identities (#10668 )

2026-08-04 13:47:09 -04:00

joins-out-of-experimental.md

chore!: move joins to advanced.database.joins (#10359 )

2026-07-14 22:21:38 +00:00

jwt-cookie-cache-transaction-scoped-adapter.md

docs(changeset): describe the jwt transaction fix by its mechanism (#10633 )

2026-08-03 12:52:31 -04:00

kysely-auto-detect-native-transactions.md

fix(kysely-adapter): report native transaction support for auto-detected dialects (#10622 )

2026-08-03 12:52:06 -04:00

kysely-migrate-add-column-defaults.md

fix(db): don't abort auth migrate when adding required or unique columns (#10293 )

2026-07-02 14:07:53 +01:00

kysely-migration-constants.md

fix(kysely-adapter): restore local migration constants (#10377 )

2026-07-13 06:32:49 +00:00

lovely-toes-swim.md

chore: release v1.6.3 (#9081 )

2026-04-14 12:04:31 +01:00

mcp-oauth-provider-migration.md

chore(changeset): restore minor release levels for the 1.7 line (#10606 )

2026-07-30 22:00:33 -04:00

microsoft-client-assertion.md

feat: add clientAssertion support to the Microsoft Entra ID social provider (#9898 )

2026-06-05 20:28:46 -07:00

microsoft-oid-account-id.md

fix(microsoft)!: use oid as account id (#10204 )

2026-07-23 12:23:34 +00:00

oauth-access-token-claim-authority.md

feat(oauth-provider): consistent and audience-scoped token introspection (#10045 )

2026-06-13 12:58:25 -07:00

oauth-additional-params.md

fix(generic-oauth): bind id token nonce in redirect flow (#10095 )

2026-06-16 21:20:07 +00:00

oauth-callback-path-declarative.md

fix(oauth): derive redirect URI from per-request baseURL (#10127 )

2026-06-18 07:26:59 -07:00

oauth-dpop-support.md

feat(oauth-provider): add DPoP support (#10039 )

2026-06-14 18:28:21 -07:00

oauth-idp-initiated-bounce.md

feat(generic-oauth,sso): support IDP-initiated flows via secure bounce (#9301 )

2026-05-19 12:29:04 +00:00

oauth-idtoken-verifier.md

refactor(oauth)!: verify provider id_tokens with a single shared verifier (#9828 )

2026-06-05 08:00:03 -04:00

oauth-no-store-headers.md

feat(oauth): enforce no-store on credential responses via a declarative flag (#10065 )

2026-06-14 20:45:45 -07:00

oauth-override-user-null.md

fix(oauth): preserve user on null profile override (#10124 )

2026-06-17 22:48:14 -07:00

oauth-provider-at-hash.md

feat(oauth-provider): compute at_hash in id tokens per OIDC Core §3.1.3.6 (#9079 )

2026-04-11 10:29:20 +00:00

oauth-provider-backchannel-logout.md

feat(oauth-provider)!: align MCP authorization with 2026-07-28 (#10577 )

2026-07-30 21:42:14 -04:00

oauth-provider-conditional-redirect-uri.md

fix(oauth-provider): make redirect_uri conditional at the token endpoint (#10159 )

2026-06-19 15:03:25 -07:00

oauth-provider-device-code.md

feat(oauth-provider): add device authorization grant (RFC 8628) (#10135 )

2026-07-23 12:32:32 +00:00

oauth-provider-extension-surface.md

fix(oauth-provider)!: bind client authentication to the issuing grant (#10063 )

2026-06-14 20:46:40 -07:00

oauth-provider-max-age.md

feat(oauth-provider)!: enforce max_age (#9936 )

2026-06-09 19:36:30 -07:00

oauth-provider-token-refactor.md

chore: release v1.6.3 (#9081 )

2026-04-14 12:04:31 +01:00

oauth-require-email-verification.md

feat(auth): add per-provider requireEmailVerification for social sign-in (#9929 )

2026-06-08 00:31:20 +00:00

oauth-resources-entity.md

feat(oauth-provider)!: model OAuth protected resources explicitly (#9648 )

2026-06-12 10:08:43 -07:00

oauth-revoke-jwt-unsupported.md

feat(oauth-provider)!: model OAuth protected resources explicitly (#9648 )

2026-06-12 10:08:43 -07:00

oauth-signup-transaction.md

fix(oauth): create new oauth account in transaction (#10125 )

2026-06-17 22:58:04 -07:00

oidc-id-token-userinfo-claims.md

fix(oauth-provider): keep OIDC scope claims on UserInfo (#10152 )

2026-06-19 10:55:51 -07:00

oidc-offline-access-nonce.md

fix(oauth-provider): allow nonce-bound offline access without PKCE (#10153 )

2026-06-19 11:18:05 -07:00

organization-get-organization.md

feat(organization): add getOrganization for metadata-only fetches (#10397 )

2026-07-15 12:49:26 +00:00

passkey-registration-session.md

feat(passkey): create session during passkey registration (#9873 )

2026-07-23 11:29:19 -04:00

pr-8926.md

chore: release v1.6.3 (#9081 )

2026-04-14 12:04:31 +01:00

pr-8931.md

fix(cookies): decouple cookie cache from JWT plugin internals (#10666 )

2026-08-04 14:40:27 -04:00

pr-8977.md

feat(org): allow passing userId and organizationId to listUserTeams API (#8977 )

2026-04-21 08:15:16 +00:00

pr-9032.md

chore: release v1.6.3 (#9081 )

2026-04-14 12:04:31 +01:00

pr-9084.md

chore: release v1.6.3 (#9081 )

2026-04-14 12:04:31 +01:00

pre.json

chore: release v1.7.0-rc.3 (#10496 )

2026-08-03 13:27:15 -04:00

preserved-session-delete-hooks.md

fix(session): fire session-delete hooks for preserved sessions on secondaryStorage (#9969 )

2026-06-10 00:40:56 +00:00

private-key-jwt-followups.md

feat(oauth-provider)!: align MCP authorization with 2026-07-28 (#10577 )

2026-07-30 21:42:14 -04:00

private-key-jwt.md

feat: add token endpoint client authentication (#9625 )

2026-05-16 18:27:15 +00:00

protected-oauth-registration.md

feat(oauth-provider): support protected dynamic client registration (#10037 )

2026-06-14 15:00:17 -07:00

proxy-trust-default-dynamic.md

fix(auth)!: ignore x-forwarded headers by default on dynamic baseURL (#9134 )

2026-06-11 21:54:05 -07:00

quiet-donuts-tan.md

feat(username): add immutable username option (#9240 )

2026-05-06 20:58:46 +00:00

quiet-lions-store.md

fix(expo)!: use async secure storage access (#10438 )

2026-08-04 21:00:23 +00:00

quiet-pandas-merge.md

fix(oauth): preserve account.scope across re-auth and refresh (#10128 )

2026-06-18 08:17:27 -07:00

quiet-tokens-retry.md

feat(oauth-provider)!: align MCP authorization with 2026-07-28 (#10577 )

2026-07-30 21:42:14 -04:00

README.md

…

refresh-runtime-dependencies.md

chore(deps)!: upgrade dependencies to latest (#10170 )

2026-06-20 10:15:37 -07:00

refresh-token-client-binding.md

fix(oauth-provider): return invalid_grant for cross-client refresh tokens (#10154 )

2026-06-19 11:32:12 -07:00

remove-oidc-provider.md

refactor!: remove deprecated oidc-provider plugin (#10031 )

2026-06-12 21:45:19 +00:00

restore-stripe-cancel-event-required.md

fix(stripe)!: make onSubscriptionCancel.event required (#9531 )

2026-05-09 20:17:44 +00:00

safe-url-runtime-fragment.md

chore: release v1.6.14 (#9846 )

2026-06-02 16:56:28 -04:00

saml-response-validation-hardening.md

fix(sso)!: harden SAML response validation (InResponseTo, Audience, SessionIndex) (#9055 )

2026-04-09 17:30:01 +00:00

schema-preserving-sso-user-resolution.md

feat(sso): add transactional OIDC user resolution (#10473 )

2026-07-22 06:53:55 -04:00

scim-active-user-link.md

feat(scim): expose active provisioned user links (#10474 )

2026-07-22 07:07:34 -04:00

scim-decoupled-provisioning.md

feat(scim)!: decouple provisioning from the organization plugin (#10390 )

2026-07-16 11:17:06 +01:00

scim-dynamic-connection-resolution.md

feat(scim): add managed connection catalog and runtime connection resolution (#10592 )

2026-08-03 13:15:13 -04:00

scim-enterprise-user-attributes.md

feat(scim): add enterprise user attributes and interop conformance (#10620 )

2026-08-03 07:15:59 -04:00

scim-entra-active-normalization.md

feat(scim): add enterprise user attributes and interop conformance (#10620 )

2026-08-03 07:15:59 -04:00

scim-group-resources.md

feat(scim): add durable group resources (#10018 )

2026-06-12 15:37:16 +00:00

scim-managed-connection-catalog.md

feat(scim): add managed connection catalog and runtime connection resolution (#10592 )

2026-08-03 13:15:13 -04:00

scim-never-used-decommission.md

feat(scim): add managed connection catalog and runtime connection resolution (#10592 )

2026-08-03 13:15:13 -04:00

scim-org-scoped-connections.md

feat(scim)!: isolate provider connections by organization (#10249 )

2026-06-26 22:38:00 +01:00

scim-personal-provider-ownership.md

fix(scim)!: always bind personal SCIM connections to their creator (#9840 )

2026-05-31 12:53:18 +00:00

silver-gardens-wander.md

feat(google): add includeGrantedScopes option (#10129 )

2026-06-18 08:31:10 -07:00

siwe-addressless-nonces.md

fix(siwe): issue addressless nonces (#10234 )

2026-07-22 15:17:31 -04:00

social-auth-validation.md

fix(auth)!: harden validateUserInfo source contract (#9940 )

2026-06-07 22:52:59 -07:00

sso-oidc-manual-redirects.md

fix(sso): reject OIDC endpoint redirects portably (#10072 )

2026-06-15 06:56:55 +00:00

sso-provider-additional-fields.md

feat(sso): support additionalFields on ssoProvider (#9445 )

2026-06-12 10:00:55 -07:00

sso-saml-hardening.md

chore: release v1.6.3 (#9081 )

2026-04-14 12:04:31 +01:00

sso-saml-model-split.md

refactor(sso)!: remove callbackUrl, consolidate ACS endpoint, fix SLO (#9117 )

2026-04-11 10:03:56 +00:00

sso-saml-resolve-user-parity.md

feat(sso): extend resolveUser to SAML and harden provider lifecycle (#10621 )

2026-08-03 12:51:21 -04:00

sso-saml-signing-hardening.md

feat(sso): extend resolveUser to SAML and harden provider lifecycle (#10621 )

2026-08-03 12:51:21 -04:00

sso-scim-registration-coexistence.md

feat(scim): add managed connection catalog and runtime connection resolution (#10592 )

2026-08-03 13:15:13 -04:00

sso-upgrade-samlify.md

fix(sso): upgrade samlify to 2.12.0 with XPath injection and XXE fixes (#9121 )

2026-04-11 10:46:50 +00:00

strict-consumer-types.md

fix(types): expand workspace and consumer type checking (#10505 )

2026-07-27 16:01:26 +00:00

strict-one-tap-audience.md

fix(one-tap)!: require client id for audience validation (#10036 )

2026-06-13 01:05:01 +00:00

test-instance-native-transactions.md

feat(sso): extend resolveUser to SAML and harden provider lifecycle (#10621 )

2026-08-03 12:51:21 -04:00

tidy-ravens-revoke.md

fix(oauth-provider): defer logout effects until commit (#10472 )

2026-07-22 06:09:55 -04:00

tighten-adapter-peerdeps.md

chore: main to next conflict resolution

2026-04-15 15:40:35 +01:00

two-factor-otp-enable.md

feat(two-factor)!: add OTP enablement and discriminated response (#9057 )

2026-04-10 14:23:20 +00:00

userinfo-form-body-token.md

fix(oauth-provider): accept UserInfo form-body tokens (#10155 )

2026-06-19 11:57:22 -07:00

userinfo-invalid-access-token.md

fix(oauth-provider): challenge invalid userinfo tokens (#10068 )

2026-06-15 06:27:28 +00:00

README.md

Changesets