All of the changes made will be available here.

Dec 3, 2025

v1.4.5

Dec 3, 2025

Nov 30, 2025

v1.4.4

Nov 30, 2025

🚀 Features

---

• cli: Better-auth-command –
• scim: Add support to parse custom scim+json media type –

🐞 Bug Fixes

---

• Customizing fields should be optional for rate limit options –
• Chunk account data cookie when exceeding limit –
• Remove applying user-agent by default –
• Additional fields default values should apply when creating session –
• Return null early if userid isn't defined –
• logger: Log level priority –
• mcp: Return origin url as authorization server –
• multi-session: Endpoints breaks with invalid signatures –
• oidc-provider: Resolve getSignedCookie return type –

    View changes on GitHub

Nov 26, 2025

v1.4.3

Nov 26, 2025

🚀 Features

---

• Add Vercel as OAuth provider –
• Add support for trusted proxy headers in base URL inference –

🐞 Bug Fixes

---

• Support @tanstack/solid-start in tanstackStartCookies plugin " –
• open-api: Clean up incorrect null type in OpenAPI –
• two-factor: Remove incorrect blocking logic in OTP setup and verification –

    View changes on GitHub

Nov 25, 2025

v1.4.2

Nov 25, 2025

🚀 Features

---

• cli: Check /auth for auth.ts –
• github: Add PKCE support for Github –
• jwt: Allow custom jwks endpoint –

🐞 Bug Fixes

---

• Support @tanstack/solid-start in tanstackStartCookies plugin –
• SignIn/signUp API returns user additional field –
• cli:
  • Kysely migration fails due to chaining addIndex and addColumn on the same alterTable builder –
  • Prevent duplicate index creation in Prisma schema generation –
• client:
  • Get-session gets triggered twice on foucs –
• email-otp:
  • Sign-in email-otp bugs with capitalized emails –
• oidc-provider:
  • Session shouldn't be required –
• organization:
  • Have deleteOrganization use adapter.deleteMany instead of delete –

    View changes on GitHub

Nov 22, 2025

v1.4.1

Nov 22, 2025

🚀 Features

---

• api-key: Support secondary storage –

🐞 Bug Fixes

---

• Custom fn field default values should be properly evaluted –
• jwt: Retrieve latest keys from storage properly –
• passkey: Change generate-authenticate-options from POST to GET –

    View changes on GitHub

Nov 22, 2025

v1.4.0

Nov 22, 2025

🚀 Features

---

• Bypass transaction with async local storage –
• Add returnHeaders to getSession –
• Waku integration guide –
• Add support for custom callback for authorization url –
• Additional fields on account –
• Add support for custom callback for token url –
• Enum support for drizzle schema –
• Nextjs 16 guide –
• Add storeStateStrategy –
• Enhance PostgreSQL support for non-public schema by respecting search_path configuration –
• Add polar oauth provider –
• Session store chunking –
• Stateless session management –
• Esm only –
• Implement automatic server-side IP detection –
• Async import in getAdapter –
• Improved API error page –
• Add request state –
• Add support for uuids –
• Auto-index CLI –
• Expose additional http methods –
• better-auth/minimal –
• Add support for custom response status codes –
• Support pass raw function as middleware –
• Support pass raw function as middleware " –
• Adapter join support –
• Refactor fetch plugins config disableDefaultFetchPlugins to include userAgentPlugin –
• Utilize database joins across better-auth –
• Support storing account data in a cookie –
• Adding support for SCIM provisioning –
• Add support for organization slug on list members –
• anonymous:
  • Support phone number verification for account linking –
  • Allow customizing random email generator –
• captcha:
  • Add support for CaptchaFox –
• cli:
  • Add mcp client configs from cli –
  • Support Cloudflare Workers virtual module imports –
• client:
  • Refetch session when browser state changes –
  • Add type helper AuthClient –
  • Introduce disableSignal client option –
• core:
  • Replace ZodType with @standard-schema/spec –
• db:
  • Delete hooks –
• device-authorization:
  • Add verification uri –
• discord:
  • Allow specification of permissions –
• docs:
  • Adding missing auth & colour in builder –
• email-otp:
  • Allow returning undefined in generateOTP –
• expo:
  • Support multiple cookie prefixes for better-auth detection –
• generic-oauth:
  • Provide pre configured provider helpers –
  • Add custom token exchange support for non-standard providers –
• jwt:
  • Support custom adapter option for jwt –
  • Add JWT verification endpoint and refactor verification logic –
  • Add key rotation –
• last-login-method:
  • Update OAuth login method tracking for multiple auth type –
  • Add support for 'siwe' as a last login method and added tests –
• mongodb:
  • Support string IDs over ObjectIDs –
• oauth-proxy:
  • Stateless mode compatibility –
• oidc-provider:
  • Add RP-Initiated Logout endpoint –
• organization:
  • Support createdAt on invitations –
  • Refactor organization schema to use BetterAuth types –
• passkey:
  • Allow multiple passkey origins –
• paybin:
  • Add Paybin OAuth provider –
• phone-number:
  • Allow custom verifyOTP implementation –
• plugin-openapi:
  • Allow passing nonce for CSP –
• prisma:
  • Enhance JSON default value handling for arrays and objects in schema generation –
• session:
  • Use JWE for cookie cache by default –
• sso:
  • DefaultSSO options and ACS endpoint –
  • Provide default service provider metadata –
  • Add option to provide login hint –
  • Add domain verification for SSO providers –
• stripe:
  • Upgrade stripe support to v19.1.0 –
  • Add StripePlugin type –
  • Allow any scheme –
  • Allow flexible types in plan limits –

🐞 Bug Fixes

---

• Device authorization plugin –
• Device authorization plugin –
• Reduce any type in generator.ts –
• Refresh secondary storage sessions on user update –
• Allow disable database transaction –
• Wrap Math.floor around the division when calculating TTL –
• Ttl sessions list expiration –
• Tests failing due to clock drift –
• Refresh secondary storage sessions on user update –
• Refresh secondary storage sessions on user update –
• Support compressed ipv6 format –
• Add required constraint to slug filed in org plugin –
• Use consistent messaging on requestPasswordReset –
• Cookie size limit shouldn't throw error –
• Handle symbols in proxy get trap to prevent TypeError –
• Ttl for rate limited secondary storage –
• Properly encode callback url for email verificaiton –
• Session update database hook should expect partial session type –
• Deprecate options.advanced.generateId type –
• Api keys should properly check if a request is from client or server –
• Refactor account deletion functions to trigger database hooks –
• Improve username transformation logic –
• Ensure falsy values are valid default values –
• Import node:async_hooks directly –
• Undeclared variable reference on docs –
• Argument where of type TwoFactorWhereUniqueInput needs at least one of id arguments –
• Mobile ai search responsiveness –
• Type compatibility with exactOptionalPropertyTypes –
• Remove deprecated ssoClient export from client plugin –
• GetAcccessToken refresh should properly refresh when oauth tokens are encrypted –
• Resolve custom URL scheme origin matching with wildcards –
• Respect additionalFields returned config for user data when setting cookie cache –
• Correct type HookEndpointContext and InternalContext –
• Add optional chaining for process.platform –
• User-agent requirement when fetching from clients –
• Unused peer dependency –
• Rename sha to branch and made it canary by default –
• Remove deprecated forgetPassword endpoints –
• Respect onAPIError.errorURL in OAuth callback flow –
• Call db hooks when calling deleteUser –
• Allow user update to handle additional fields and validation –
• Missing email validation –
• Urls without protocol shouldn't be able to satisfy a wildcard origin –
• Use standard validator –
• Add undefined type for optional property types –
• Type mismatch for 'banned' on UserWithRole –
• Delete duplicate email existence check in changeEmail endpoint –
• Add missing userId in listAccounts response –
• Trigger use session on revoke sessions –
• string[] inference for additionalFields –
• Unsanitized endpoints provided dates will cause DB insert failure –
• Update hooks return should merge with original data –
• Dont trigger session refresh on magic-link sign-in –
• Treat generateId "serial" as numeric ID and correct UUID column types across adapters –
• Validate baseURL protocol and improve error messages –
• Use ctx over request in plugin options –
• Use identity instead of serial for pg schema –
• Zoom refresh token –
• /change-email should trigger session signal –
• Resolve SESSION_IS_NOT_FRESH error with cookieCache –
• Preserve provided string IDs in the MongoDB adapter when they are not valid ObjectId –
• GenericOAuth and SSO ignore discoveryUrl for authorization –
• Remove active session requirement for change email verification –
• adapter:
  • Returning null as string for optional id references –
  • Use updated field values in WHERE clause during update –
  • Foreign keys that are nullable on number ids can return string of null –
  • Ensure transaction function is implemented in the adapter –
  • Missing data type transformation on where clauses –
  • Inconsistent mongo ends_with query –
  • Kysely with CamelCasePlugin breaks for OIDC. –
  • Should not apply defaultValue during find calls –
  • Drizzle deleteMany result should be a number –
• adapters:
  • Mongodb id issue –
• admin:
  • Stricter body validation with the setUserPassword api –
  • Validate admin role updates against the configured roles to prevent setting a non-existent role –
• anonymous:
  • Provide ctx on accountLink –
  • isAnonymous should default to false instead of null –
• api-key:
  • Cascade api keys on user deletion –
  • Cascade api keys on user deletion –
  • Calling client on server side –
  • Correct refill interval time calculation –
  • Shouldn't issue api key a mock session by default –
  • Don't update the lastRequest when calling updateApiKey –
  • Remove incorrect usage tracking in updateApiKey –
• better-auth:
  • Moved email verification check after password check –
• cli:
  • DefaultNow is deprecated in schema for Drizzle with SQLite –
  • Timestamp in schema for Drizzle with SQLite –
  • Move type dependencies to devDependencies –
• client:
  • BaseURL is undefined for SSR –
  • Add lynx client exports –
  • Missing isRefetching type in react useSession –
  • Ensure refetchInterval triggers active network request –
• cookie:
  • SameSite to "none" for oauth state –
  • SameSite to "none" for oauth state " –
• core:
  • Correctly set typesVersions paths –
• create-adapter:
  • Disable transaction by default –
• custom-session:
  • Don't overwrite the Set-Cookie header –
  • Infer.Session to infer the return type of the custom session –
• db:
  • onDelete is ignored –
  • Postgres - explicitly define pg_catalog for gen_random_uuid() –
• deps:
  • Update dependency @nanostores/react to v1
• device-authorization:
  • Fix client error type for deny device –
  • Sanitize user code input on device approve –
• docs:
  • Set default tab to next-js since react was not listed –
  • Anchor link scrolling with conflict prevention –
  • Enable code block copying in documentation page –
• drizzle:
  • Replace pgEnum with text enum type in Drizzle schema generation –
• drizzle-adapter:
  • Handle all operators in multiple where conditions –
• email-otp:
  • Call reset password callback –
  • Email-verification doesn't trigger session signal –
  • Fix openapi schema for /email-otp/verify-email endpoint –
  • Prevent duplicate verification emails when override is enabled –
  • Prevent user enumeration on email OTP –
  • Use constant time equal for equality checks –
• expo:
  • Set-header retrigger $sessionSignal –
  • Store normalized cookie name in storage –
  • Origin check failing due to null origin in expo –
  • Account linking flow on mobile –
  • Clear peer dependence and flag optional –
  • Enhance cookie detection for better-auth cookies –
• generic-oauth:
  • overrideUserInfo doesn't work –
  • Await async mapProfileToUser –
• gitlab:
  • Fix the token endpoint –
• haveibeenpwned:
  • Check for limited set of paths –
• last-login-method:
  • Custom resolver method default logic –
  • LastLoginMethod cookie is not set when using a generic oauth provider –
  • Detect passkey login to set last used method –
• magic-link:
  • Avoid returning error for disabled signup early –
  • Ensure emailVerified update is reflected in user object –
• mcp:
  • Missing Content-Type header for mcp DCR –
  • Consent requirement should be respected –
• mongodb:
  • Mongodb findOneAndUpdate should return .value –
• multi-session:
  • Reject cookies without valid signatures on signout hook –
• nuxt:
  • Avoid load env base url for SSR –
• oauth:
  • Redirect to GET for POST method –
• oauth-proxy:
  • Should skip state check for oauth proxy –
  • Handle cross-origin flows –
  • Return multiple Set-Cookie headers instead of a single comma-separated header –
• oauth2:
  • Fix user data not reflecting provider updates with overrideUserInfo –
• odic:
  • Case when prompt=login –
  • Case when prompt=login " –
• odic-provider:
  • Default options –
• oidc:
  • Properly enforce consent requirements per OIDC spec –
• oidc-provider:
  • OIDC token-type capitalization –
  • Use consistent iat claim and allow configurable issuer –
  • Improve typing –
  • oidc_login_prompt not cleared after login –
  • Change updated_at to be a UNIX numeric timestamp –
  • Fix opts order –
  • oidc_login_prompt not cleared after login " –
  • Missing options –
  • Implement proper OIDC prompt parameter handling –
  • Redirect to consent when scope changed –
• openapi:
  • Add operationIds to routes –
• org:
  • Use correct adapter during db tranaction –
  • Update type to include undefined –
• organization:
  • Decouple client and server permission checks –
  • Decouple client and server permission checks –
  • Membership check for organizations with large member counts –
  • Remove autoCreateOnSignUp option as it's not implemented yet –
  • Pass ctx to DB hooks –
  • Allow passing id through beforeCreateOrganization –
  • Prevent empty name and slug in create/update –
  • Certain parameters not showing in client types –
  • Prevent duplicate slug on organization update –
  • Compatibility with declaration on tsconfig.json –
  • Compatibility with exactOptionalPropertyTypes –
  • Typecheck node exceeds the maximum length –
  • Fix the schema type –
  • RemoveTeamMember breaks for prisma –
  • Correct migration order when dynamicAccessControl is enabled –
  • Deleting member from org doesn't delete them from teams –
  • All endpoints should properly infer additional fields –
  • ActiveOrgId no longer inferred after enabling dynamic AC –
• passkey:
  • Remove email from query –
  • Atom listeners not working –
  • Passkey breaks with throw: true –
  • Wrong Session type being used on passkey –
  • Filter delete passkey with userId –
  • Ensure addPasskey returns passkey data instead of undefined –
• phone-number:
  • Shouldn't allow updating phone number on /update-user endpoint –
• session:
  • Refresh cache before it expires –
  • Persist additionalFields in cookie cache –
• social-providers:
  • Core module import –
• sso:
  • Safe json parsing for saml/oidc configs –
  • Prevent duplicate SSO provider creation with same providerId –
  • OIDC scopes should fallback to provider scopes –
  • Add deprecated flag to the old sso plugin export –
  • Move oauth2-mock-server dep into devDependencies for sso package –
  • Use the internalAdapter for user queries to avoid skipping database hooks –
  • Respect disableImplicitSignUp in SAML callback –
  • Prevent server instance from leaking to client –
  • Export SSOProvider type –
• stripe:
  • OnCustomerCreate should be called even if update user isn't returned –
  • Update with an existing subscription –
  • Sync customer email on db change –
  • getCustomerCreateParams not actually being called –
  • Throw error if event failed to be constructed –
  • Check for reference IDs inside during Stripe reference validation –
  • Stripe error codes should be returned from the plugin –
  • Remove TS error suppression updating getCheckoutSessionParams –
  • Prevent duplicate customer creation on signup –
  • Return updated subscription in onSubscriptionUpdate callback –
  • Throw error if query.referenceId is defined –
  • Cancel subscription fails with Prisma –
• telemetry:
  • Avoid async import if telemetry disabled, fix for esbuild –
  • Avoid async import if telemetry disabled, fix for esbuild " –
• test:
  • Use async import for db –
• two-factor:
  • Return parsed array in viewBackupCodes –
  • Backup codes shouldn't be encrypted twice –
  • Avoid GET endpoints with body –
  • Incorrect reference for server only actions –
  • Improve error message for bad totp code in 2FA setup –
  • Trust device token refresh –
  • Use constant time equal for otp comparison –
• types:
  • Include null in getSession return type –
• url:
  • Handle empty and root path in withPath, prevent double slashes, add tests –
• username:
  • Username should respect send on sign config –
  • Compacity with exactOptionalPropertyTypes –
• vk:
  • Check for empty email after user profile mapping –

🏎 Performance

---

• Improve type Auth –
• Lazy load create telemetry –
• Lazy load create telemetry " –

    View changes on GitHub