Better Auth

Shipped v1.7.0, scoping accounts by issuer and enabling native database joins where adapters support them.

Account identity is scoped by issuer. Account.issuer is now required, and account APIs select the local account id through accountId. Regenerate or migrate the schema before upgrading.

Native joins moved under the advanced database config. experimental.joins became advanced.database.joins. Adapters that support native joins use them; others fall back to combined queries. Prisma and Drizzle users should regenerate relations.

Device authorization changed shape. The standalone deviceCodeGrant() plugin was replaced by oauthDeviceAuthorization() alongside oauthProvider() or mcp(); the schema swaps resource for oauthClientId and resources. RFC 8628 support landed with new lookup indexes — MySQL and SQL Server must convert those columns to bounded strings (max 191 chars). Let pending device codes expire before upgrading.

OAuth and OIDC tightened up. Microsoft accounts now key on the stable oid claim instead of sub — migrate rows before upgrading, since tokens without oid are rejected. Generic OAuth providers gained RP-initiated logout, and private_key_jwt client assertions accept the issuer URL as a valid aud on token, introspection, and revocation requests.

SSO and SCIM hardened. Domain-based organization assignment now requires both a verified provider domain and verified user email. SCIM parses Boolean values case-insensitively for Entra interop, and an optional managedConnections catalog lets server code issue and rotate bearer credentials.

Stability fixes. Concurrent cold-start requests no longer lose auth context; session deletion runs in parallel; test instances gained native DB transactions; bundled deps (jose, SimpleWebAuthn, noble) updated.