Better Auth

Profile types for Apple, Cognito, Discord, Dropbox, Facebook, GitHub, GitLab, Gumroad, Linear, Microsoft Entra ID, Notion, Patreon, PayPal, Railway, Slack, and Twitter(X) were reviewed against each provider's official resources and updated, with previously assumed fields now optional, nullable, or retyped. Custom profile mappings for these providers must be reviewed for fields that changed.

Two-factor TOTP now accepts imported Base32 secrets stored as base32:<secret>, and Kakao sign-in forwards loginHint so the Kakao Account login page opens with the ID field prefilled.

The Cloudflare provider gains tokenEndpointAuth: { method } while tokenEndpointAuthMethod is deprecated but still supported. Also adds Vercel token endpoint auth options (dynamic OIDC tokens, private key JWT client assertions), Stripe SDK v23 support in the Stripe plugin, and fixes type declarations so type-only exports are no longer listed as values.

ID token sign-in now rejects tokens from providers with no clientId, since audience cannot be checked, so every provider using ID token sign-in must set clientId. The JWT plugin now verifies tokens with the stored key's algorithm and warns when issuer or audience is missing, and OAuth proxy callbacks run the same issuer and nonce checks as standard callbacks.

Fixed repeated PostgreSQL migration diffs for int8 columns and database-backed rate limiting returning an excessively large X-Retry-After value. ID token signature and claim validation is fixed for Twitch and Paybin sign-in, and CIMD metadata refreshes no longer overwrite concurrent administrator changes to discovered clients.

Stale cookies no longer persist after customSession sessions expire or are revoked, and failed password resets no longer consume reset links or OTPs before the new password is saved. Also fixed customSession treating session lookup errors as signed-out users, secondary-storage session failures leaving sign-ups and SSO sign-ins inconsistent, and ID token sign-in failures from up to 30 seconds of IdP clock difference.

Fixed a critical Magic Link account-takeover vulnerability and an OAuth Proxy bug that accepted sign-in state as a provider profile; upgrade Magic Link servers sharing verification storage together, request new Magic Links, and restart pending OAuth/SAML sign-ins, with no database migration required. Also fixed ID-token sign-in ignoring the social provider's disableSignUp setting, concurrent PostgreSQL requests exceeding database-backed rate limits, and missing JSON Content-Type headers on CAPTCHA and rate-limit errors.

Added Vercel BotID as a captcha provider for protected authentication routes and a bannedUserMessage function so sign-in errors can include details like the ban reason. Passwords over maxPasswordLength are now rejected with PASSWORD_TOO_LONG before hashing, and fixes address React hydration mismatches, overlapping auth-query races, OAuth Proxy social account linking, and adapter schema validation across Kysely, Prisma, D1, and SQLite.

Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance, plus Vitest 5 support in test utilities. Fixed multibyte session data storage and stale sessions/corrupted cookies in Expo SecureStore.

The 1.6 account schema has been restored to avoid a disruptive backfill for existing users; those who already applied the 1.7 issuer schema should follow the upgrade guide for cleanup. Adds Cloudflare as a built-in social provider with client-secret and PKCE support, plus schema validation enabled by default during initialization that rejects auth requests on detected mismatches, and a new isPasswordCompromised check against Have I Been Pwned. Also fixes TOTP re-enrollment overwriting active authenticators, callback hook skips after proxied OAuth sign-ins, and Nuxt duplicate session requests.

Permanent user bans now clear expiration dates left by previous temporary bans, and validation for relative callback and redirect URLs was improved with path, query, and fragment support. Also fixed Cloudflare Workers async context loss, D1 programmatic migrations, and MyISAM index checks.

Concurrent cold-start requests no longer lose authentication or transaction context due to an async storage initialization race. SSO now requires both a verified provider domain and a verified stored user email for automatic organization assignment, and domain verification snapshots provider domains at request start to return 409 on mid-flight changes.