npx @buildinternet/releases get better-authAdded database.schemaName support for direct PostgreSQL connections, and fixed PostgreSQL migrations incorrectly identifying tables and views across schemas. Also fixed MySQL index validation for existing string columns and lazy database initialization with Drizzle relations, and removed the unused optional better-sqlite3 peer dependency to prevent installation conflicts.
Fixed database option type inference in @better-auth/core for projects that do not use Cloudflare Workers.
Diagnostics for Cloudflare Turnstile verification failures are improved.
Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance, plus Vitest 5 support in test utilities. Fixed multibyte session data storage and stale sessions/corrupted cookies in Expo SecureStore.
Added an option to disable OpenTelemetry span creation for individual auth instances.
The 1.6 account schema has been restored to avoid a disruptive backfill for existing users; those who already applied the 1.7 issuer schema should follow the upgrade guide for cleanup. Adds Cloudflare as a built-in social provider with client-secret and PKCE support, plus schema validation enabled by default during initialization that rejects auth requests on detected mismatches, and a new isPasswordCompromised check against Have I Been Pwned. Also fixes TOTP re-enrollment overwriting active authenticators, callback hook skips after proxied OAuth sign-ins, and Nuxt duplicate session requests.
Permanent user bans now clear expiration dates left by previous temporary bans, and validation for relative callback and redirect URLs was improved with path, query, and fragment support. Also fixed Cloudflare Workers async context loss, D1 programmatic migrations, and MyISAM index checks.
Fixed case-insensitive parsing of Boolean values for SCIM User active and primary sub-attributes at HTTP ingress, improving Microsoft Entra interoperability, and added an optional SCIM-owned connection and credential catalog via managedConnections. SAML assertion signatures are now validated on the raw assertion, and native database transactions were added to Kysely/raw adapter instances and test setups.
Blog post: Better Auth 1.7
Concurrent cold-start requests no longer lose authentication or transaction context due to an async storage initialization race. SSO now requires both a verified provider domain and a verified stored user email for automatic organization assignment, and domain verification snapshots provider domains at request start to return 409 on mid-flight changes.
Fixed duplicate session requests during transient Suspense remounts while ensuring incomplete refreshes are revalidated. Completed the RP-Initiated Logout flow with form-encoded POST support, explicit confirmation pages, and strict redirect URI validation.
Automatic email-domain organization assignment now requires both a verified provider domain and a verified user email, preventing social sign-in from granting access through a claimed domain. Domain verification snapshots the provider's domains at request start, returning 409 on changes. Session deletion now runs in parallel instead of sequentially.
The OAuth device grant is now owned by oauthDeviceAuthorization() used alongside oauthProvider() or mcp(), replacing the standalone deviceCodeGrant() plugin. The schema changed, requiring migration and letting pending device codes expire, and the silenceWarnings config option was removed from the OAuth provider.
Fixed duplicate session requests being made across Suspense retries in the core package. Also aligned SCIM auth endpoint types with better-call, and made the CLI install packages matching the running CLI version.
Expo's secure storage access is now async to prevent crashes when iOS Keychain is unavailable — getCookie() returns a Promise, breaking custom storage implementations. Also fixed sessions not being cleaned up on user deletion, missing PKCE challenge in Apple OAuth flows, and a range of other OAuth, OTP, JWT, and client type-inference fixes.
Fixed JWT key minting inside database transactions to prevent deadlocks on SQLite, session cleanup on user deletion now also removes sessions from secondary storage, and email OTP verification no longer reveals whether an email is registered before the OTP is verified. Plus a dozen other fixes across Redis storage, Apple OAuth, client type inference, and rate-limit cleanup.
MCP authorization aligns with the 2026-07-28 specification, replacing legacy client fields with applicationType and enforcing stricter redirect validation and scope controls. Microsoft and microsoftEntraId accounts now use the stable oid claim as the account identifier instead of sub. Database indexes added for device code lookups; MySQL and SQL Server users must convert device code columns to bounded strings. RP-initiated logout and RFC 8628 device authorization grant also added.
Fixed Apple OAuth not sending the PKCE code challenge, causing token exchange failures, and fixed Google One Tap creating new users when sign-up was disabled. Also fixed Solid client $fetch/$store exposure and an internal adapter table routing bug.
Account.accountId renamed to Account.providerAccountId, issuer is now required, and OAuth provider identity uses verified profiles. The joins config moves from experimental to advanced.database.joins. SCIM is decoupled from the organization plugin and requires full directory reprovisioning. Plus fixes for request clone failures, session cache headers, and cookie management.
