Better Auth

Shipped a FedCM account chooser for Google sign-in buttons and breaking profile-mapping changes across five social providers in the v1.8.0 betas.

Google sign-in buttons can offer a browser account chooser. On supported Chrome browsers, Google sign-in buttons use FedCM to let users pick an account from the browser's own chooser.

Profile mappings changed for five social providers (breaking). Update mappings before moving to the v1.8.0 beta:

• Zoom: handle login types 11, 21, and 23 in exhaustive checks.
• VK: user.phone arrives as a string, not a number.
• Naver: handle omitted personal fields and supply an email when Naver shares none.
• Kakao: handle a missing kakao_account.
• Roblox: handle optional scoped fields, a null picture, and unknown custom claims.

Provider token endpoint auth gained options. The Vercel provider accepts dynamic OIDC tokens and private key JWT client assertions without replacing the built-in sign-in flow. Cloudflare added tokenEndpointAuth: { method }; tokenEndpointAuthMethod is deprecated but still supported.

ID token sign-in needs explicit client IDs (breaking). Providers without a clientId now need it set to every client ID your apps sign in with. Separately, the JWT plugin verifies tokens with the stored key's algorithm instead of the token header's, and warns when issuer or audience is missing.

OAuth and adapter fixes. OAuth proxy callbacks now run the standard callback checks, including issuer and ID token nonce validation. Type-only exports are no longer listed as values, so a bad value import fails type checking. PostgreSQL int8 columns stop producing repeated migration diffs.

Earlier: the Magic Link account-takeover advisory still requires upgrading servers that share verification storage together, requesting new Magic Links, and restarting pending OAuth/SAML sign-ins — no database migration. Device-code approval keeps the stricter assertStandaloneUse contract from beta.0.