mirror of https://github.com/better-auth/better-auth.git synced 2026-10-19 23:53:17 -05:00

Files

T

Gustavo Valverde 539a1adac8 fix(auth): request the TikTok identity scope and keep provider bindings on refresh

TikTok returns `open_id`, `union_id`, `display_name`, and `avatar_large_url`
only under `user.info.basic`, while `username` belongs to `user.info.profile`.
Sign-in requested the profile scope alone and read fields from both, which held
together only because the identity subject was not load-bearing. It is now.

Updating a session or a user profile reissued the session cookie through the
new-sign-in path, which clears the provider account binding. Same-user refreshes
keep their binding, as the password-change path already does.

2026-07-17 12:58:34 +01:00