better-auth/packages/api-key/CHANGELOG.md

@better-auth/api-key

1.6.16

Patch Changes

• #9974 cb1cbfa Thanks @Bekacru! - Resolve the session from the authoritative store when creating an API key, rather than the signed cookie-cache snapshot. /api-key/create now fetches the session with disableCookieCache: true, so a session that was revoked — including the session deletion performed when a user is banned — is no longer accepted within the cookie-cache window. Server-side calls that pass userId in the body are unaffected.

• #9974 cb1cbfa Thanks @Bekacru! - Fix API key verification overwriting concurrent changes with stale state. Verification now persists only the fields it mutates (rate-limit counters, remaining count, refill and request timestamps) instead of writing back the entire record it read, so a concurrent disable, permission change, or expiry update can no longer be reverted by an in-flight verification. In secondary-storage mode, the record is re-read and merged before writing, so a key deleted mid-verification is no longer recreated.

• Updated dependencies [cb1cbfa, cb1cbfa, cb1cbfa, cb1cbfa, cb1cbfa, cb1cbfa, 87e7aa5, cb1cbfa, cb1cbfa, cb1cbfa, 893cf6c, cb1cbfa, cb1cbfa, 5e49c56, cb1cbfa]:

  • better-auth@1.6.16
  • @better-auth/core@1.6.16

1.6.15

Patch Changes

• Updated dependencies [1012b69, ad60333, 0933c05, b0ddfd3]:
  • better-auth@1.6.15
  • @better-auth/core@1.6.15

1.6.14

Patch Changes

• Updated dependencies [2d9781a, 5a2d642, 13abc79, 9d3450a]:
  • better-auth@1.6.14
  • @better-auth/core@1.6.14

1.6.13

Patch Changes

• #9794 e131d3a Thanks @bytaesu! - verifyApiKey rejected keys created under a non-default configId when the request omitted configId. It now validates the key against its own configuration.

• Updated dependencies [d3919dc, 5f282bd, 43c08a2, 43c08a2, be32012, 87c1a0c, 5c3e248, 9c8ded6, 23d7cbf]:

  • better-auth@1.6.13
  • @better-auth/core@1.6.13

1.6.12

Patch Changes

• #9759 f6bf451 Thanks @ping-maxwell! - fix(api-key): add better-call as peer dependency to fix TS4023 declaration emit

• Updated dependencies [9bd53e1, 23dbe1a, 7a12072, 09a1d50, a6f144a, f77060a, dcb2e6d, c92cd74, f5fcc9d, 9d91eb7, a3b0c63, 1b40dac, 5626e1b, ad9ad82, 62dabf6, 276d67f, 2d73fff, c5b9f93, ac96316, 0a7cb70, 015f96b, 43cc49c, f5e29ea, 1d372bb, 3f8f310, 83fa369, 17cd433, c01b2f1, 6b44606, 04303a9, 7bf5449, 2b7937f]:

  • better-auth@1.6.12
  • @better-auth/core@1.6.12

1.6.11

Patch Changes

• #9505 b039985 Thanks @Kvizas! - API key requests that exceed the configured rate limit now return HTTP 429 (Too Many Requests) instead of HTTP 401 (Unauthorized), so clients can distinguish throttling from authentication failures.

• Updated dependencies [0cbddb8, a26333b, 99a254a, ee93485, 5f09d56, b4bc65a, da7e50b, a1c9f3c, 23094a6, 142b86c, 1f2ff42, b0ef96f, 699b09a, e21d744]:

  • @better-auth/core@1.6.11
  • better-auth@1.6.11

1.6.10

Patch Changes

• #9393 62c4050 Thanks @IcanDivideBy0! - api.verifyApiKey now validate the key configId is matching the one in the body

• Updated dependencies [1e0f26d, 8c1e917, b2d655c, 09f1327, 906b7b3, e9c978e, e71aad3, 80a655d, 15ff28a, 88a7c67, 9a7b51d, 1b25902, cf59136, a597ee0, fc02ced, 9f1ef1f, 36ef808, c1336c5, 3a9a2c3, fde0432, 2220a6d]:

  • better-auth@1.6.10
  • @better-auth/core@1.6.10

1.6.9

Patch Changes

• Updated dependencies [815ecf6]:
  • @better-auth/core@1.6.9
  • better-auth@1.6.9

1.6.8

Patch Changes

• Updated dependencies [856ab24, 9aa8e63]:
  • better-auth@1.6.8
  • @better-auth/core@1.6.8

1.6.7

Patch Changes

• Updated dependencies [307196a, 4a180f0, 4f373ee, e1b1cfc, d053a45]:
  • better-auth@1.6.7
  • @better-auth/core@1.6.7

1.6.6

Patch Changes

• #9187 3728518 Thanks @ping-maxwell! - fix(api-key): run secondary-storage api-key executions in parallel

• Updated dependencies [b5742f9, 4debfb6, 9ea7eb1, a844c7d, ab4c10f, a61083e, e64ff72]:

  • @better-auth/core@1.6.6
  • better-auth@1.6.6

1.6.5

Patch Changes

• Updated dependencies [938dd80, 0538627]:
  • better-auth@1.6.5
  • @better-auth/core@1.6.5

1.6.4

Patch Changes

• Updated dependencies [9aed910, acbd6ef, 39d6af2]:
  • better-auth@1.6.4
  • @better-auth/core@1.6.4

1.6.3

Patch Changes

• Updated dependencies [5142e9c, 484ce6a, f875897, 6ce30cf, f6428d0, 9a6d475, 513dabb, c5066fe, 5f84335]:
  • better-auth@1.6.3
  • @better-auth/core@1.6.3

1.6.2

Patch Changes

• Updated dependencies [9deb793, 2cbcb9b, b20fa42, 608d8c3, 8409843, e78a7b1]:
  • better-auth@1.6.2
  • @better-auth/core@1.6.2

1.6.1

Patch Changes

• Updated dependencies [2e537df, f61ad1c, 7495830]:
  • better-auth@1.6.1
  • @better-auth/core@1.6.1

1.6.0

Minor Changes

• #8836 5dd9e44 Thanks @gustavovalverde! - Add optional version field to the plugin interface and expose version from all built-in plugins

Patch Changes

• Updated dependencies [dd537cb, bd9bd58, 5dd9e44, 5dd9e44, 5dd9e44, 5dd9e44, 5dd9e44, 5dd9e44, 5dd9e44, 5dd9e44, 5dd9e44, 5dd9e44, 5dd9e44, 5dd9e44, 5dd9e44, 469eee6, 560230f]:
  • better-auth@1.6.0
  • @better-auth/core@1.6.0

1.6.0-beta.0

Minor Changes

• 28b1291 Thanks @gustavovalverde! - Add optional version field to the plugin interface and expose version from all built-in plugins

Patch Changes

• Updated dependencies [28b1291, 28b1291, 28b1291, 28b1291, 28b1291, 28b1291, 28b1291, 28b1291, 28b1291, 28b1291, 28b1291, 28b1291, 28b1291]:
  • better-auth@1.6.0-beta.0
  • @better-auth/core@1.6.0-beta.0