Better Auth

The 1.6 account schema has been restored to avoid a disruptive backfill for existing users; those who already applied the 1.7 issuer schema should follow the upgrade guide for cleanup. Adds Cloudflare as a built-in social provider with client-secret and PKCE support, plus schema validation enabled by default during initialization that rejects auth requests on detected mismatches, and a new isPasswordCompromised check against Have I Been Pwned. Also fixes TOTP re-enrollment overwriting active authenticators, callback hook skips after proxied OAuth sign-ins, and Nuxt duplicate session requests.

Permanent user bans now clear expiration dates left by previous temporary bans, and validation for relative callback and redirect URLs was improved with path, query, and fragment support. Also fixed Cloudflare Workers async context loss, D1 programmatic migrations, and MyISAM index checks.

Concurrent cold-start requests no longer lose authentication or transaction context due to an async storage initialization race. SSO now requires both a verified provider domain and a verified stored user email for automatic organization assignment, and domain verification snapshots provider domains at request start to return 409 on mid-flight changes.

Duplicate session requests during React Suspense retries are prevented while preserving revalidation for interrupted refreshes. Client plugin declaration compatibility is restored for downstream TypeScript consumers in better-auth, @better-auth/electron, and @better-auth/expo.

Expo's secure storage access is now async to prevent crashes when iOS Keychain is unavailable — getCookie() returns a Promise, breaking custom storage implementations. Also fixed sessions not being cleaned up on user deletion, missing PKCE challenge in Apple OAuth flows, and a range of other OAuth, OTP, JWT, and client type-inference fixes.

Fixed JWT key minting inside database transactions to prevent deadlocks on SQLite, session cleanup on user deletion now also removes sessions from secondary storage, and email OTP verification no longer reveals whether an email is registered before the OTP is verified. Plus a dozen other fixes across Redis storage, Apple OAuth, client type inference, and rate-limit cleanup.

MCP authorization aligns with the 2026-07-28 specification, replacing legacy client fields with applicationType and enforcing stricter redirect validation and scope controls. Microsoft and microsoftEntraId accounts now use the stable oid claim as the account identifier instead of sub. Database indexes added for device code lookups; MySQL and SQL Server users must convert device code columns to bounded strings. RP-initiated logout and RFC 8628 device authorization grant also added.

Fixed Apple OAuth not sending the PKCE code challenge, causing token exchange failures, and fixed Google One Tap creating new users when sign-up was disabled. Also fixed Solid client $fetch/$store exposure and an internal adapter table routing bug.

Yandex is now a supported OAuth social provider. The auth migrate command no longer aborts when adding required or unique columns to an existing table, and string default values are properly escaped in generated Drizzle schemas. Fixed affected row counting for D1 and postgres-js adapters in the drizzle adapter.

Fixed organization subscription actions (cancel, upgrade, restore, billing portal) that could act on the wrong organization. Also added Yandex as a social OAuth provider, fixed affected row counting for D1 and postgres-js drizzle adapters, and fixed string default values not being properly escaped in generated Drizzle schemas.