chore(deps): bump @better-auth/oauth-provider from 1.6.26 to 1.7.0

[dependabot]

Bumps @better-auth/oauth-provider from 1.6.26 to 1.7.0.

Release notes

Sourced from @​better-auth/oauth-provider's releases.

v1.7.0

Blog post:Better Auth 1.7

better-auth

❗ Breaking Changes

• Moved database joins out of experimental into the stable advanced.database.joins option (#10359)

  Migration: Replace experimental: { joins: true } with advanced: { database: { joins: true } }. Drizzle and Prisma users should regenerate their schema (npx auth@latest generate) so it includes the required relations.

• Scoped account identity by trusted issuer, keying accounts on (issuer, accountId) (#10403)

  Migration: Accounts now require Account.issuer. Read provider identity from accountInfo.account.accountId, drop mapping.id from SSO configs, and give the microsoftEntraId helper a concrete tenant GUID. Apply the account-identity backfill in the 1.7 upgrade guide before deploying.

• Required captcha endpoint entries to match full auth paths, with wildcard support (#10004)

  Migration: Replace partial paths such as /sign-in with explicit wildcards like /sign-in/* or /sign-in/**.

• Moved the MCP plugin into its own @better-auth/mcp package built on the OAuth provider (#9992)

  Migration: Install @better-auth/mcp and @better-auth/cimd, add the now-required jwt() plugin, and move options nested under oidcConfig to flat mcp({ ... }) options. Rename withMcpAuth to requireMcpAuth and mcpHandler to createMcpProtectedRequestHandler. Regenerate the schema (npx auth migrate): oauthApplication becomes oauthClient, plus new oauthRefreshToken and oauthClientAssertion tables.

• Added OIDC back-channel logout so ending a session cuts off every connected app's API access (#9304)

  Migration: Introspecting an access token whose session has ended now returns { active: false }, and /oauth2/userinfo rejects it. Clients opt into notifications by registering backchannel_logout_uri. Run the schema migration for the new oauthClient and oauthAccessToken columns.

• Modeled OAuth protected resources explicitly, with per-resource TTLs, scopes, claims, and signing pins (#9648)

  Migration:validAudiences is removed: move each resource identifier into resources and link restricted clients through oauthClientResource. @better-auth/mcp now requires an explicit resource. Run npx @better-auth/cli generate and apply the migration before deploying.

• Decoupled SCIM provisioning from the organization plugin (#10390)

  Migration: SCIM configuration, client APIs, database schema, and the Group model are all replaced, and provisioning state cannot migrate in place. Follow the SCIM cutover in the 1.7 upgrade guide, including a full directory reprovision, before resuming traffic.

• Added OTP-only two-factor enablement with a discriminated enableTwoFactor response (#9057)

  Migration:enableTwoFactor now returns a method field ("otp" or "totp"); narrow on it before reading totpURI and backupCodes. Pass method: "otp" for OTP enrollment, which requires otpOptions.sendOTP.

• Resolved the auth origin from Host by default when using a dynamic baseURL (#9134)

  Migration: If your proxy exposes the public hostname only through x-forwarded-host, set advanced.trustedProxyHeaders: true. Deployments where the proxy rewrites Host (nginx default, Vercel, Cloudflare, Netlify) are unaffected.

• Added unique lookup indexes for the device authorization deviceCode and userCode columns (#10059)

  Migration: Resolve duplicate code values before applying the migration. MySQL and SQL Server installations must also convert both columns to bounded strings and clean up values longer than 191 characters.

• Enforced S256 PKCE in the Electron sign-in flow and hardened custom-scheme origin checks (#9645)

  Migration: Upgrade the @better-auth/electron client and server together and add your app's scheme to trustedOrigins. The code_challenge_method parameter and disableOriginOverride option are removed, and host-bearing custom-scheme entries now match that host exactly.

• Identified Microsoft Entra accounts by the stable oid claim (#10204)

  Migration: Migrate existing Microsoft account rows created from sub before upgrading. Tokens without a valid oid are rejected.

• Required a Google client ID before Google One Tap verifies ID tokens (#10036)

  Migration: Configure oneTap({ clientId }) or socialProviders.google.clientId.

• Removed the deprecated oidcProvider plugin (#10031)

  Migration: Move OIDC authorization-server integrations to @better-auth/oauth-provider.

• Rewrote the generic OAuth plugin as a first-class social provider with OAuth 2.1 defaults (#9069)

  Migration: Replace signIn.oauth2({ providerId }) with signIn.social({ provider }), oauth2.link() with linkSocial(), and drop genericOAuthClient(). Callbacks move to /api/auth/callback/:id, pkce now defaults to true, and issuer and requireIssuerValidation are removed in favor of OIDC discovery.

• Separated OAuth device grant ownership into oauthDeviceAuthorization() (#10746)

  Migration: The OAuth integration replaces the optional resource column with oauthClientId and resources, so regenerate and apply the schema. Let pending device codes expire before upgrading from an earlier 1.7 prerelease.

• Verified provider id_tokens with a single shared verifier (#9828)

  Migration: Custom UpstreamProvider implementations replace the removed verifyIdToken method with an idToken config carrying a JWKS source, issuer, and audience. PayPal client id_token sign-in now returns ID_TOKEN_NOT_SUPPORTED; its redirect flow is unchanged.

Features

• Added clientAssertion support to the Microsoft Entra ID social provider (#9898)
• Made the Auth instance directly fetchable (#9431)
• Added per-provider requireEmailVerification for social sign-in (#9929)
• Added a user.validateUserInfo gate for rejecting an identity before a user is created or linked (#9864)
• Added hydrateSession so useSession returns server-fetched data on the first render (#8733)
• Added compound table indexes to plugin database schemas (#10402)

... (truncated)

Changelog

Sourced from @​better-auth/oauth-provider's changelog.

1.7.0

Minor Changes

• #105775c45abc Thanks @​gustavovalverde! - OAuth clients now store applicationType and expose it as application_type in OAuth metadata. tokenEndpointAuthMethod alone determines authentication: "none" is public, and every other method is confidential. The legacy type and public fields are removed.

  OAuthClient no longer has a catch-all string index. Model custom wire extensions explicitly with a named intersection such as OAuthClient & YourExtensionMetadata; legacy type and public fields no longer type-check as unknown baggage.

  • Dynamic, administrative, and user-managed registrations default an omitted application_type to web. Client ID Metadata Documents preserve an omitted value as null.
  • Web redirects require HTTPS on a non-loopback host. Native redirects accept claimed HTTPS URLs, exact HTTP loopback hosts, or reverse-domain private-use schemes.
  • Registration resource options control resource links. mcp() contributes its protected resource by default, so standards-based clients no longer need a resources extension.
  • mcp() no longer enables unauthenticated Dynamic Client Registration. Compose mcp() with cimd() for Client ID Metadata Documents, or enable both DCR flags explicitly.

  This release requires a database migration. Add applicationType and nullable clientDiscoveryId; map old web and native values directly, map user-agent-based to NULL for manual reclassification, and never derive it from public. Set clientDiscoveryId only from known discovery provenance, never by inspecting an HTTPS client ID. Deduplicate existing (clientId, resourceId) links before adding the new compound unique index, then drop the legacy columns. Deployments with custom schema mappings must apply this backfill manually.

  Machine-to-machine scope authority is now stored separately in nullable oauthClient.clientCredentialsScopes. Missing, NULL, and empty values deny client_credentials token issuance. Only the administrative create and update endpoints expose client_credentials_scopes, and assigning a non-empty value requires clientPrivileges to approve the new configure-client-credentials-scopes action. DCR, CIMD, and user-managed registration cannot assign this field; CIMD refresh preserves an existing administrator-owned value. Remove clientCredentialGrantDefaultScopes, backfill every existing client to [], configure [] as the default for new rows, then explicitly assign every approved machine scope after auditing the client.

• #105775c45abc Thanks @​gustavovalverde! - Client ID Metadata Documents now follow shared-cache freshness rules and fail closed when freshness is ambiguous. The plugin prefers s-maxage over max-age and Expires, honors s-maxage=0, conditionally revalidates with ETag or Last-Modified, and treats invalid or duplicate freshness directives as immediately stale. Concurrent refreshes converge on one client-resource link instead of failing on its unique constraint.

  Shared OAuth metadata validation now rejects a blank client_name without trimming a valid display name. Native private-use redirects require the RFC 8252 single-slash form, such as com.example.app:/callback. Native HTTP redirects accept only exact localhost, 127.0.0.1, or [::1] hosts; other 127.0.0.0/8 addresses and localhost subdomains are rejected.

  CIMD now bounds metadata request amplification through metadataFetchPolicy: same-client fetches coalesce, per-client pacing and global/per-origin concurrency reject immediately, and rolling 60-second budgets cap unique-client sprays. HTTP no-store, private, and Vary: * behavior is unchanged and never feeds metadata or validators into the governor.

  Node.js deployments can import fetchClientMetadataResource from @better-auth/cimd/node. The transport resolves once, rejects any non-public DNS answer, pins the approved connection without using the global HTTPS pool, preserves Host and TLS certificate identity, and returns redirects and response bodies without buffering. Other runtimes remain responsible for providing an equivalent secure transport.

  Unknown draft-02 metadata members are now ignored and never persisted. Recognized secrets, privilege fields, and server controls remain fatal, while generic internal aliases and nonstandard client-credentials authority spellings are stripped.

• #9159cd8313b Thanks @​gustavovalverde! - Add @better-auth/cimd for Client ID Metadata Document draft-02. An exact HTTPS metadata-document URL becomes the OAuth client_id, and OAuth discovery advertises support when the plugin is installed. The explicit metadataProfile: "mcp-2026-07-28" mode applies the draft-00 metadata requirements pinned by MCP 2026-07-28.

  • Validate the complete shared OAuth client metadata schema. Generic draft-02 clients may omit client_name and redirect_uris and may use any grant supported by the OAuth Provider; the MCP profile requires client_id, client_name, and redirect_uris.
  • Reject client secrets, private JWK material, back-channel logout metadata, server-owned fields, unsafe metadata URLs, non-JSON responses, oversized documents, redirects, and private or reserved network targets. Loopback Client Identifier URLs are no longer supported.
  • Validate registered, discovered, and remotely fetched client JWKS through one public-asymmetric-key boundary. RFC 7517 JWK Sets must use { "keys": [...] }; replace the removed bare-array form jwks: [key] with jwks: { keys: [key] }. Empty, malformed, symmetric, private, and unsupported key sets fail before they can enter a provider-scoped cache. EC keys must use P-256, P-384, or P-521; OKP keys must use Ed25519. A declared alg must match the key type and curve. Existing OAuth client rows written through oauthToSchema are already normalized, so no database rewrite is required unless rows were written outside Better Auth.
  • Require fetchClientMetadataResource as the deployment-owned transport for both metadata documents and discovery-owned jwks_uri resources. It must resolve once, reject RFC 6890 special-use addresses, pin the approved address for the connection, and refuse redirects. isMetadataDocumentUrlAllowed remains available for additional application policy.
  • Cache only valid successful metadata with bounded storage, HTTP shared-cache freshness rules, ETag and Last-Modified conditional revalidation, and fail-closed refresh behavior. Cache-Control: private and Vary: * are noncacheable, and an unconditional 304 is rejected.
  • Persist oauthClient.clientDiscoveryId as nullable discovery provenance. Discovery IDs are globally unique, and an owned client fails closed when its matching discovery is unavailable. Only that discovery may refresh the client or provide transport for its metadata-owned resources, so managed and DCR HTTPS client IDs cannot be taken over.
  • Preserve custom model names, resource links, and administrator-controlled client flags when clients are created or refreshed. Refresh notifications now receive previousClient.

  OAuth Provider also exposes clientDiscovery for custom verified client-resolution plugins. A discovery may provide fetchClientMetadataResource, and its stable id is persisted as client provenance.

  Prerelease adopters must rename createCimdResolver or cimdClientDiscovery to createCimdClientDiscovery, ClientIdMetadataDocumentResult to CimdMetadataValidationResult, ValidateCimdMetadataOptions to CimdMetadataValidationOptions, isUrlClientId to isCimdClientIdUrlCandidate, and MetadataDocumentFetch to ClientMetadataResourceFetch. Rename refreshRate to metadataRevalidationInterval; there is no compatibility fallback. Numeric revalidation and minimumFetchInterval values are seconds.

  Lifecycle callbacks now receive named CimdClientCreatedEvent and CimdClientRefreshedEvent values. Read validated metadata from clientMetadataDocument instead of metadata, and the endpoint context from context instead of ctx. CimdOptions is now required because fetchClientMetadataResource is mandatory. Remove the prerelease allowFetch, fetchMetadataDocument, and allowLoopback options.

  When adopting CIMD, remove allowUnauthenticatedClientRegistration unless the authorization server deliberately supports Dynamic Client Registration as a separate fallback.

• #107466782647 Thanks @​gustavovalverde! - OAuth device grants now use oauthDeviceAuthorization() alongside oauthProvider() or mcp(). This single integration replaces both the standalone deviceCodeGrant() plugin and the shared-grant configuration. Standalone Device Authorization no longer accepts or stores RFC 8707 resources, and onDeviceAuthRequest receives only clientId and scope. The OAuth integration rejects resource indicators that are not absolute, fragment-free URIs.

  The OAuth integration replaces the optional resource column with oauthClientId and resources. Regenerate and apply the schema when using it. Before upgrading from an earlier 1.7 prerelease, let pending OAuth device codes expire or delete them because they cannot be exchanged through the new integration.

• #10156e3125e8 Thanks @​gustavovalverde! - The OIDC provider now honors the claims.userinfo authorization request parameter. A client can ask for individual standard claims, and the UserInfo endpoint returns the ones it can supply in addition to the scope-granted claims. The requested claims become part of the user's consent, and claims_parameter_supported is advertised in discovery.

  Authorization requests that use the claims parameter without requesting the openid scope are rejected.

... (truncated)

Commits

• ccd57c2 docs(changelog): align v1.7 release notes with final behavior (#10846)
• f577ec5 chore: exit pre-release mode for v1.7.0
• 69258d1 chore: sync main to next
• e84ec5e chore: release v1.6.30 (#10840)
• bc93b27 chore: release v1.7.0-rc.6 (#10772)
• 58c49eb chore: release v1.6.29 (#10809)
• 14975fb chore: sync main to next
• f451d1c fix(oauth-provider): complete RP-initiated logout flow (#10812)
• 801968e fix(oauth-provider): accept issuer audience for client assertions (#10811)
• 80799e6 chore: sync main to next
• Additional commits viewable in compare view

[Medformatik]

Superseded by #274, which upgrades the complete Better Auth package family to 1.7.1 and includes the required schema migration and application API changes.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[dependabot]

Bumps @better-auth/oauth-provider from 1.6.26 to 1.7.0.

Release notes

Sourced from @​better-auth/oauth-provider's releases.

v1.7.0

Blog post:Better Auth 1.7

better-auth

❗ Breaking Changes

• Moved database joins out of experimental into the stable advanced.database.joins option (#10359)

  Migration: Replace experimental: { joins: true } with advanced: { database: { joins: true } }. Drizzle and Prisma users should regenerate their schema (npx auth@latest generate) so it includes the required relations.

• Scoped account identity by trusted issuer, keying accounts on (issuer, accountId) (#10403)

  Migration: Accounts now require Account.issuer. Read provider identity from accountInfo.account.accountId, drop mapping.id from SSO configs, and give the microsoftEntraId helper a concrete tenant GUID. Apply the account-identity backfill in the 1.7 upgrade guide before deploying.

• Required captcha endpoint entries to match full auth paths, with wildcard support (#10004)

  Migration: Replace partial paths such as /sign-in with explicit wildcards like /sign-in/* or /sign-in/**.

• Moved the MCP plugin into its own @better-auth/mcp package built on the OAuth provider (#9992)

  Migration: Install @better-auth/mcp and @better-auth/cimd, add the now-required jwt() plugin, and move options nested under oidcConfig to flat mcp({ ... }) options. Rename withMcpAuth to requireMcpAuth and mcpHandler to createMcpProtectedRequestHandler. Regenerate the schema (npx auth migrate): oauthApplication becomes oauthClient, plus new oauthRefreshToken and oauthClientAssertion tables.

• Added OIDC back-channel logout so ending a session cuts off every connected app's API access (#9304)

  Migration: Introspecting an access token whose session has ended now returns { active: false }, and /oauth2/userinfo rejects it. Clients opt into notifications by registering backchannel_logout_uri. Run the schema migration for the new oauthClient and oauthAccessToken columns.

• Modeled OAuth protected resources explicitly, with per-resource TTLs, scopes, claims, and signing pins (#9648)

  Migration:validAudiences is removed: move each resource identifier into resources and link restricted clients through oauthClientResource. @better-auth/mcp now requires an explicit resource. Run npx @better-auth/cli generate and apply the migration before deploying.

• Decoupled SCIM provisioning from the organization plugin (#10390)

  Migration: SCIM configuration, client APIs, database schema, and the Group model are all replaced, and provisioning state cannot migrate in place. Follow the SCIM cutover in the 1.7 upgrade guide, including a full directory reprovision, before resuming traffic.

• Added OTP-only two-factor enablement with a discriminated enableTwoFactor response (#9057)

  Migration:enableTwoFactor now returns a method field ("otp" or "totp"); narrow on it before reading totpURI and backupCodes. Pass method: "otp" for OTP enrollment, which requires otpOptions.sendOTP.

• Resolved the auth origin from Host by default when using a dynamic baseURL (#9134)

  Migration: If your proxy exposes the public hostname only through x-forwarded-host, set advanced.trustedProxyHeaders: true. Deployments where the proxy rewrites Host (nginx default, Vercel, Cloudflare, Netlify) are unaffected.

• Added unique lookup indexes for the device authorization deviceCode and userCode columns (#10059)

  Migration: Resolve duplicate code values before applying the migration. MySQL and SQL Server installations must also convert both columns to bounded strings and clean up values longer than 191 characters.

• Enforced S256 PKCE in the Electron sign-in flow and hardened custom-scheme origin checks (#9645)

  Migration: Upgrade the @better-auth/electron client and server together and add your app's scheme to trustedOrigins. The code_challenge_method parameter and disableOriginOverride option are removed, and host-bearing custom-scheme entries now match that host exactly.

• Identified Microsoft Entra accounts by the stable oid claim (#10204)

  Migration: Migrate existing Microsoft account rows created from sub before upgrading. Tokens without a valid oid are rejected.

• Required a Google client ID before Google One Tap verifies ID tokens (#10036)

  Migration: Configure oneTap({ clientId }) or socialProviders.google.clientId.

• Removed the deprecated oidcProvider plugin (#10031)

  Migration: Move OIDC authorization-server integrations to @better-auth/oauth-provider.

• Rewrote the generic OAuth plugin as a first-class social provider with OAuth 2.1 defaults (#9069)

  Migration: Replace signIn.oauth2({ providerId }) with signIn.social({ provider }), oauth2.link() with linkSocial(), and drop genericOAuthClient(). Callbacks move to /api/auth/callback/:id, pkce now defaults to true, and issuer and requireIssuerValidation are removed in favor of OIDC discovery.

• Separated OAuth device grant ownership into oauthDeviceAuthorization() (#10746)

  Migration: The OAuth integration replaces the optional resource column with oauthClientId and resources, so regenerate and apply the schema. Let pending device codes expire before upgrading from an earlier 1.7 prerelease.

• Verified provider id_tokens with a single shared verifier (#9828)

  Migration: Custom UpstreamProvider implementations replace the removed verifyIdToken method with an idToken config carrying a JWKS source, issuer, and audience. PayPal client id_token sign-in now returns ID_TOKEN_NOT_SUPPORTED; its redirect flow is unchanged.

Features

• Added clientAssertion support to the Microsoft Entra ID social provider (#9898)
• Made the Auth instance directly fetchable (#9431)
• Added per-provider requireEmailVerification for social sign-in (#9929)
• Added a user.validateUserInfo gate for rejecting an identity before a user is created or linked (#9864)
• Added hydrateSession so useSession returns server-fetched data on the first render (#8733)
• Added compound table indexes to plugin database schemas (#10402)

... (truncated)

Changelog

Sourced from @​better-auth/oauth-provider's changelog.

1.7.0

Minor Changes

• #105775c45abc Thanks @​gustavovalverde! - OAuth clients now store applicationType and expose it as application_type in OAuth metadata. tokenEndpointAuthMethod alone determines authentication: "none" is public, and every other method is confidential. The legacy type and public fields are removed.

  OAuthClient no longer has a catch-all string index. Model custom wire extensions explicitly with a named intersection such as OAuthClient & YourExtensionMetadata; legacy type and public fields no longer type-check as unknown baggage.

  • Dynamic, administrative, and user-managed registrations default an omitted application_type to web. Client ID Metadata Documents preserve an omitted value as null.
  • Web redirects require HTTPS on a non-loopback host. Native redirects accept claimed HTTPS URLs, exact HTTP loopback hosts, or reverse-domain private-use schemes.
  • Registration resource options control resource links. mcp() contributes its protected resource by default, so standards-based clients no longer need a resources extension.
  • mcp() no longer enables unauthenticated Dynamic Client Registration. Compose mcp() with cimd() for Client ID Metadata Documents, or enable both DCR flags explicitly.

  This release requires a database migration. Add applicationType and nullable clientDiscoveryId; map old web and native values directly, map user-agent-based to NULL for manual reclassification, and never derive it from public. Set clientDiscoveryId only from known discovery provenance, never by inspecting an HTTPS client ID. Deduplicate existing (clientId, resourceId) links before adding the new compound unique index, then drop the legacy columns. Deployments with custom schema mappings must apply this backfill manually.

  Machine-to-machine scope authority is now stored separately in nullable oauthClient.clientCredentialsScopes. Missing, NULL, and empty values deny client_credentials token issuance. Only the administrative create and update endpoints expose client_credentials_scopes, and assigning a non-empty value requires clientPrivileges to approve the new configure-client-credentials-scopes action. DCR, CIMD, and user-managed registration cannot assign this field; CIMD refresh preserves an existing administrator-owned value. Remove clientCredentialGrantDefaultScopes, backfill every existing client to [], configure [] as the default for new rows, then explicitly assign every approved machine scope after auditing the client.

• #105775c45abc Thanks @​gustavovalverde! - Client ID Metadata Documents now follow shared-cache freshness rules and fail closed when freshness is ambiguous. The plugin prefers s-maxage over max-age and Expires, honors s-maxage=0, conditionally revalidates with ETag or Last-Modified, and treats invalid or duplicate freshness directives as immediately stale. Concurrent refreshes converge on one client-resource link instead of failing on its unique constraint.

  Shared OAuth metadata validation now rejects a blank client_name without trimming a valid display name. Native private-use redirects require the RFC 8252 single-slash form, such as com.example.app:/callback. Native HTTP redirects accept only exact localhost, 127.0.0.1, or [::1] hosts; other 127.0.0.0/8 addresses and localhost subdomains are rejected.

  CIMD now bounds metadata request amplification through metadataFetchPolicy: same-client fetches coalesce, per-client pacing and global/per-origin concurrency reject immediately, and rolling 60-second budgets cap unique-client sprays. HTTP no-store, private, and Vary: * behavior is unchanged and never feeds metadata or validators into the governor.

  Node.js deployments can import fetchClientMetadataResource from @better-auth/cimd/node. The transport resolves once, rejects any non-public DNS answer, pins the approved connection without using the global HTTPS pool, preserves Host and TLS certificate identity, and returns redirects and response bodies without buffering. Other runtimes remain responsible for providing an equivalent secure transport.

  Unknown draft-02 metadata members are now ignored and never persisted. Recognized secrets, privilege fields, and server controls remain fatal, while generic internal aliases and nonstandard client-credentials authority spellings are stripped.

• #9159cd8313b Thanks @​gustavovalverde! - Add @better-auth/cimd for Client ID Metadata Document draft-02. An exact HTTPS metadata-document URL becomes the OAuth client_id, and OAuth discovery advertises support when the plugin is installed. The explicit metadataProfile: "mcp-2026-07-28" mode applies the draft-00 metadata requirements pinned by MCP 2026-07-28.

  • Validate the complete shared OAuth client metadata schema. Generic draft-02 clients may omit client_name and redirect_uris and may use any grant supported by the OAuth Provider; the MCP profile requires client_id, client_name, and redirect_uris.
  • Reject client secrets, private JWK material, back-channel logout metadata, server-owned fields, unsafe metadata URLs, non-JSON responses, oversized documents, redirects, and private or reserved network targets. Loopback Client Identifier URLs are no longer supported.
  • Validate registered, discovered, and remotely fetched client JWKS through one public-asymmetric-key boundary. RFC 7517 JWK Sets must use { "keys": [...] }; replace the removed bare-array form jwks: [key] with jwks: { keys: [key] }. Empty, malformed, symmetric, private, and unsupported key sets fail before they can enter a provider-scoped cache. EC keys must use P-256, P-384, or P-521; OKP keys must use Ed25519. A declared alg must match the key type and curve. Existing OAuth client rows written through oauthToSchema are already normalized, so no database rewrite is required unless rows were written outside Better Auth.
  • Require fetchClientMetadataResource as the deployment-owned transport for both metadata documents and discovery-owned jwks_uri resources. It must resolve once, reject RFC 6890 special-use addresses, pin the approved address for the connection, and refuse redirects. isMetadataDocumentUrlAllowed remains available for additional application policy.
  • Cache only valid successful metadata with bounded storage, HTTP shared-cache freshness rules, ETag and Last-Modified conditional revalidation, and fail-closed refresh behavior. Cache-Control: private and Vary: * are noncacheable, and an unconditional 304 is rejected.
  • Persist oauthClient.clientDiscoveryId as nullable discovery provenance. Discovery IDs are globally unique, and an owned client fails closed when its matching discovery is unavailable. Only that discovery may refresh the client or provide transport for its metadata-owned resources, so managed and DCR HTTPS client IDs cannot be taken over.
  • Preserve custom model names, resource links, and administrator-controlled client flags when clients are created or refreshed. Refresh notifications now receive previousClient.

  OAuth Provider also exposes clientDiscovery for custom verified client-resolution plugins. A discovery may provide fetchClientMetadataResource, and its stable id is persisted as client provenance.

  Prerelease adopters must rename createCimdResolver or cimdClientDiscovery to createCimdClientDiscovery, ClientIdMetadataDocumentResult to CimdMetadataValidationResult, ValidateCimdMetadataOptions to CimdMetadataValidationOptions, isUrlClientId to isCimdClientIdUrlCandidate, and MetadataDocumentFetch to ClientMetadataResourceFetch. Rename refreshRate to metadataRevalidationInterval; there is no compatibility fallback. Numeric revalidation and minimumFetchInterval values are seconds.

  Lifecycle callbacks now receive named CimdClientCreatedEvent and CimdClientRefreshedEvent values. Read validated metadata from clientMetadataDocument instead of metadata, and the endpoint context from context instead of ctx. CimdOptions is now required because fetchClientMetadataResource is mandatory. Remove the prerelease allowFetch, fetchMetadataDocument, and allowLoopback options.

  When adopting CIMD, remove allowUnauthenticatedClientRegistration unless the authorization server deliberately supports Dynamic Client Registration as a separate fallback.

• #107466782647 Thanks @​gustavovalverde! - OAuth device grants now use oauthDeviceAuthorization() alongside oauthProvider() or mcp(). This single integration replaces both the standalone deviceCodeGrant() plugin and the shared-grant configuration. Standalone Device Authorization no longer accepts or stores RFC 8707 resources, and onDeviceAuthRequest receives only clientId and scope. The OAuth integration rejects resource indicators that are not absolute, fragment-free URIs.

  The OAuth integration replaces the optional resource column with oauthClientId and resources. Regenerate and apply the schema when using it. Before upgrading from an earlier 1.7 prerelease, let pending OAuth device codes expire or delete them because they cannot be exchanged through the new integration.

• #10156e3125e8 Thanks @​gustavovalverde! - The OIDC provider now honors the claims.userinfo authorization request parameter. A client can ask for individual standard claims, and the UserInfo endpoint returns the ones it can supply in addition to the scope-granted claims. The requested claims become part of the user's consent, and claims_parameter_supported is advertised in discovery.

  Authorization requests that use the claims parameter without requesting the openid scope are rejected.

... (truncated)

Commits

• ccd57c2 docs(changelog): align v1.7 release notes with final behavior (#10846)
• f577ec5 chore: exit pre-release mode for v1.7.0
• 69258d1 chore: sync main to next
• e84ec5e chore: release v1.6.30 (#10840)
• bc93b27 chore: release v1.7.0-rc.6 (#10772)
• 58c49eb chore: release v1.6.29 (#10809)
• 14975fb chore: sync main to next
• f451d1c fix(oauth-provider): complete RP-initiated logout flow (#10812)
• 801968e fix(oauth-provider): accept issuer audience for client assertions (#10811)
• 80799e6 chore: sync main to next
• Additional commits viewable in compare view

[Medformatik]

Superseded by #274, which upgrades the complete Better Auth package family to 1.7.1 and includes the required schema migration and application API changes.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[dependabot]

Bumps @better-auth/oauth-provider from 1.6.26 to 1.7.0.

Release notes

Sourced from @​better-auth/oauth-provider's releases.

v1.7.0

Blog post:Better Auth 1.7

better-auth

❗ Breaking Changes

• Moved database joins out of experimental into the stable advanced.database.joins option (#10359)

  Migration: Replace experimental: { joins: true } with advanced: { database: { joins: true } }. Drizzle and Prisma users should regenerate their schema (npx auth@latest generate) so it includes the required relations.

• Scoped account identity by trusted issuer, keying accounts on (issuer, accountId) (#10403)

  Migration: Accounts now require Account.issuer. Read provider identity from accountInfo.account.accountId, drop mapping.id from SSO configs, and give the microsoftEntraId helper a concrete tenant GUID. Apply the account-identity backfill in the 1.7 upgrade guide before deploying.

• Required captcha endpoint entries to match full auth paths, with wildcard support (#10004)

  Migration: Replace partial paths such as /sign-in with explicit wildcards like /sign-in/* or /sign-in/**.

• Moved the MCP plugin into its own @better-auth/mcp package built on the OAuth provider (#9992)

  Migration: Install @better-auth/mcp and @better-auth/cimd, add the now-required jwt() plugin, and move options nested under oidcConfig to flat mcp({ ... }) options. Rename withMcpAuth to requireMcpAuth and mcpHandler to createMcpProtectedRequestHandler. Regenerate the schema (npx auth migrate): oauthApplication becomes oauthClient, plus new oauthRefreshToken and oauthClientAssertion tables.

• Added OIDC back-channel logout so ending a session cuts off every connected app's API access (#9304)

  Migration: Introspecting an access token whose session has ended now returns { active: false }, and /oauth2/userinfo rejects it. Clients opt into notifications by registering backchannel_logout_uri. Run the schema migration for the new oauthClient and oauthAccessToken columns.

• Modeled OAuth protected resources explicitly, with per-resource TTLs, scopes, claims, and signing pins (#9648)

  Migration:validAudiences is removed: move each resource identifier into resources and link restricted clients through oauthClientResource. @better-auth/mcp now requires an explicit resource. Run npx @better-auth/cli generate and apply the migration before deploying.

• Decoupled SCIM provisioning from the organization plugin (#10390)

  Migration: SCIM configuration, client APIs, database schema, and the Group model are all replaced, and provisioning state cannot migrate in place. Follow the SCIM cutover in the 1.7 upgrade guide, including a full directory reprovision, before resuming traffic.

• Added OTP-only two-factor enablement with a discriminated enableTwoFactor response (#9057)

  Migration:enableTwoFactor now returns a method field ("otp" or "totp"); narrow on it before reading totpURI and backupCodes. Pass method: "otp" for OTP enrollment, which requires otpOptions.sendOTP.

• Resolved the auth origin from Host by default when using a dynamic baseURL (#9134)

  Migration: If your proxy exposes the public hostname only through x-forwarded-host, set advanced.trustedProxyHeaders: true. Deployments where the proxy rewrites Host (nginx default, Vercel, Cloudflare, Netlify) are unaffected.

• Added unique lookup indexes for the device authorization deviceCode and userCode columns (#10059)

  Migration: Resolve duplicate code values before applying the migration. MySQL and SQL Server installations must also convert both columns to bounded strings and clean up values longer than 191 characters.

• Enforced S256 PKCE in the Electron sign-in flow and hardened custom-scheme origin checks (#9645)

  Migration: Upgrade the @better-auth/electron client and server together and add your app's scheme to trustedOrigins. The code_challenge_method parameter and disableOriginOverride option are removed, and host-bearing custom-scheme entries now match that host exactly.

• Identified Microsoft Entra accounts by the stable oid claim (#10204)

  Migration: Migrate existing Microsoft account rows created from sub before upgrading. Tokens without a valid oid are rejected.

• Required a Google client ID before Google One Tap verifies ID tokens (#10036)

  Migration: Configure oneTap({ clientId }) or socialProviders.google.clientId.

• Removed the deprecated oidcProvider plugin (#10031)

  Migration: Move OIDC authorization-server integrations to @better-auth/oauth-provider.

• Rewrote the generic OAuth plugin as a first-class social provider with OAuth 2.1 defaults (#9069)

  Migration: Replace signIn.oauth2({ providerId }) with signIn.social({ provider }), oauth2.link() with linkSocial(), and drop genericOAuthClient(). Callbacks move to /api/auth/callback/:id, pkce now defaults to true, and issuer and requireIssuerValidation are removed in favor of OIDC discovery.

• Separated OAuth device grant ownership into oauthDeviceAuthorization() (#10746)

  Migration: The OAuth integration replaces the optional resource column with oauthClientId and resources, so regenerate and apply the schema. Let pending device codes expire before upgrading from an earlier 1.7 prerelease.

• Verified provider id_tokens with a single shared verifier (#9828)

  Migration: Custom UpstreamProvider implementations replace the removed verifyIdToken method with an idToken config carrying a JWKS source, issuer, and audience. PayPal client id_token sign-in now returns ID_TOKEN_NOT_SUPPORTED; its redirect flow is unchanged.

Features

• Added clientAssertion support to the Microsoft Entra ID social provider (#9898)
• Made the Auth instance directly fetchable (#9431)
• Added per-provider requireEmailVerification for social sign-in (#9929)
• Added a user.validateUserInfo gate for rejecting an identity before a user is created or linked (#9864)
• Added hydrateSession so useSession returns server-fetched data on the first render (#8733)
• Added compound table indexes to plugin database schemas (#10402)

... (truncated)

Changelog

Sourced from @​better-auth/oauth-provider's changelog.

1.7.0

Minor Changes

• #105775c45abc Thanks @​gustavovalverde! - OAuth clients now store applicationType and expose it as application_type in OAuth metadata. tokenEndpointAuthMethod alone determines authentication: "none" is public, and every other method is confidential. The legacy type and public fields are removed.

  OAuthClient no longer has a catch-all string index. Model custom wire extensions explicitly with a named intersection such as OAuthClient & YourExtensionMetadata; legacy type and public fields no longer type-check as unknown baggage.

  • Dynamic, administrative, and user-managed registrations default an omitted application_type to web. Client ID Metadata Documents preserve an omitted value as null.
  • Web redirects require HTTPS on a non-loopback host. Native redirects accept claimed HTTPS URLs, exact HTTP loopback hosts, or reverse-domain private-use schemes.
  • Registration resource options control resource links. mcp() contributes its protected resource by default, so standards-based clients no longer need a resources extension.
  • mcp() no longer enables unauthenticated Dynamic Client Registration. Compose mcp() with cimd() for Client ID Metadata Documents, or enable both DCR flags explicitly.

  This release requires a database migration. Add applicationType and nullable clientDiscoveryId; map old web and native values directly, map user-agent-based to NULL for manual reclassification, and never derive it from public. Set clientDiscoveryId only from known discovery provenance, never by inspecting an HTTPS client ID. Deduplicate existing (clientId, resourceId) links before adding the new compound unique index, then drop the legacy columns. Deployments with custom schema mappings must apply this backfill manually.

  Machine-to-machine scope authority is now stored separately in nullable oauthClient.clientCredentialsScopes. Missing, NULL, and empty values deny client_credentials token issuance. Only the administrative create and update endpoints expose client_credentials_scopes, and assigning a non-empty value requires clientPrivileges to approve the new configure-client-credentials-scopes action. DCR, CIMD, and user-managed registration cannot assign this field; CIMD refresh preserves an existing administrator-owned value. Remove clientCredentialGrantDefaultScopes, backfill every existing client to [], configure [] as the default for new rows, then explicitly assign every approved machine scope after auditing the client.

• #105775c45abc Thanks @​gustavovalverde! - Client ID Metadata Documents now follow shared-cache freshness rules and fail closed when freshness is ambiguous. The plugin prefers s-maxage over max-age and Expires, honors s-maxage=0, conditionally revalidates with ETag or Last-Modified, and treats invalid or duplicate freshness directives as immediately stale. Concurrent refreshes converge on one client-resource link instead of failing on its unique constraint.

  Shared OAuth metadata validation now rejects a blank client_name without trimming a valid display name. Native private-use redirects require the RFC 8252 single-slash form, such as com.example.app:/callback. Native HTTP redirects accept only exact localhost, 127.0.0.1, or [::1] hosts; other 127.0.0.0/8 addresses and localhost subdomains are rejected.

  CIMD now bounds metadata request amplification through metadataFetchPolicy: same-client fetches coalesce, per-client pacing and global/per-origin concurrency reject immediately, and rolling 60-second budgets cap unique-client sprays. HTTP no-store, private, and Vary: * behavior is unchanged and never feeds metadata or validators into the governor.

  Node.js deployments can import fetchClientMetadataResource from @better-auth/cimd/node. The transport resolves once, rejects any non-public DNS answer, pins the approved connection without using the global HTTPS pool, preserves Host and TLS certificate identity, and returns redirects and response bodies without buffering. Other runtimes remain responsible for providing an equivalent secure transport.

  Unknown draft-02 metadata members are now ignored and never persisted. Recognized secrets, privilege fields, and server controls remain fatal, while generic internal aliases and nonstandard client-credentials authority spellings are stripped.

• #9159cd8313b Thanks @​gustavovalverde! - Add @better-auth/cimd for Client ID Metadata Document draft-02. An exact HTTPS metadata-document URL becomes the OAuth client_id, and OAuth discovery advertises support when the plugin is installed. The explicit metadataProfile: "mcp-2026-07-28" mode applies the draft-00 metadata requirements pinned by MCP 2026-07-28.

  • Validate the complete shared OAuth client metadata schema. Generic draft-02 clients may omit client_name and redirect_uris and may use any grant supported by the OAuth Provider; the MCP profile requires client_id, client_name, and redirect_uris.
  • Reject client secrets, private JWK material, back-channel logout metadata, server-owned fields, unsafe metadata URLs, non-JSON responses, oversized documents, redirects, and private or reserved network targets. Loopback Client Identifier URLs are no longer supported.
  • Validate registered, discovered, and remotely fetched client JWKS through one public-asymmetric-key boundary. RFC 7517 JWK Sets must use { "keys": [...] }; replace the removed bare-array form jwks: [key] with jwks: { keys: [key] }. Empty, malformed, symmetric, private, and unsupported key sets fail before they can enter a provider-scoped cache. EC keys must use P-256, P-384, or P-521; OKP keys must use Ed25519. A declared alg must match the key type and curve. Existing OAuth client rows written through oauthToSchema are already normalized, so no database rewrite is required unless rows were written outside Better Auth.
  • Require fetchClientMetadataResource as the deployment-owned transport for both metadata documents and discovery-owned jwks_uri resources. It must resolve once, reject RFC 6890 special-use addresses, pin the approved address for the connection, and refuse redirects. isMetadataDocumentUrlAllowed remains available for additional application policy.
  • Cache only valid successful metadata with bounded storage, HTTP shared-cache freshness rules, ETag and Last-Modified conditional revalidation, and fail-closed refresh behavior. Cache-Control: private and Vary: * are noncacheable, and an unconditional 304 is rejected.
  • Persist oauthClient.clientDiscoveryId as nullable discovery provenance. Discovery IDs are globally unique, and an owned client fails closed when its matching discovery is unavailable. Only that discovery may refresh the client or provide transport for its metadata-owned resources, so managed and DCR HTTPS client IDs cannot be taken over.
  • Preserve custom model names, resource links, and administrator-controlled client flags when clients are created or refreshed. Refresh notifications now receive previousClient.

  OAuth Provider also exposes clientDiscovery for custom verified client-resolution plugins. A discovery may provide fetchClientMetadataResource, and its stable id is persisted as client provenance.

  Prerelease adopters must rename createCimdResolver or cimdClientDiscovery to createCimdClientDiscovery, ClientIdMetadataDocumentResult to CimdMetadataValidationResult, ValidateCimdMetadataOptions to CimdMetadataValidationOptions, isUrlClientId to isCimdClientIdUrlCandidate, and MetadataDocumentFetch to ClientMetadataResourceFetch. Rename refreshRate to metadataRevalidationInterval; there is no compatibility fallback. Numeric revalidation and minimumFetchInterval values are seconds.

  Lifecycle callbacks now receive named CimdClientCreatedEvent and CimdClientRefreshedEvent values. Read validated metadata from clientMetadataDocument instead of metadata, and the endpoint context from context instead of ctx. CimdOptions is now required because fetchClientMetadataResource is mandatory. Remove the prerelease allowFetch, fetchMetadataDocument, and allowLoopback options.

  When adopting CIMD, remove allowUnauthenticatedClientRegistration unless the authorization server deliberately supports Dynamic Client Registration as a separate fallback.

• #107466782647 Thanks @​gustavovalverde! - OAuth device grants now use oauthDeviceAuthorization() alongside oauthProvider() or mcp(). This single integration replaces both the standalone deviceCodeGrant() plugin and the shared-grant configuration. Standalone Device Authorization no longer accepts or stores RFC 8707 resources, and onDeviceAuthRequest receives only clientId and scope. The OAuth integration rejects resource indicators that are not absolute, fragment-free URIs.

  The OAuth integration replaces the optional resource column with oauthClientId and resources. Regenerate and apply the schema when using it. Before upgrading from an earlier 1.7 prerelease, let pending OAuth device codes expire or delete them because they cannot be exchanged through the new integration.

• #10156e3125e8 Thanks @​gustavovalverde! - The OIDC provider now honors the claims.userinfo authorization request parameter. A client can ask for individual standard claims, and the UserInfo endpoint returns the ones it can supply in addition to the scope-granted claims. The requested claims become part of the user's consent, and claims_parameter_supported is advertised in discovery.

  Authorization requests that use the claims parameter without requesting the openid scope are rejected.

... (truncated)

Commits

• ccd57c2 docs(changelog): align v1.7 release notes with final behavior (#10846)
• f577ec5 chore: exit pre-release mode for v1.7.0
• 69258d1 chore: sync main to next
• e84ec5e chore: release v1.6.30 (#10840)
• bc93b27 chore: release v1.7.0-rc.6 (#10772)
• 58c49eb chore: release v1.6.29 (#10809)
• 14975fb chore: sync main to next
• f451d1c fix(oauth-provider): complete RP-initiated logout flow (#10812)
• 801968e fix(oauth-provider): accept issuer audience for client assertions (#10811)
• 80799e6 chore: sync main to next
• Additional commits viewable in compare view

[Medformatik]

Superseded by #274, which upgrades the complete Better Auth package family to 1.7.1 and includes the required schema migration and application API changes.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[dependabot]

Bumps @better-auth/oauth-provider from 1.6.26 to 1.7.0.

Release notes

Sourced from @​better-auth/oauth-provider's releases.

v1.7.0

Blog post:Better Auth 1.7

better-auth

❗ Breaking Changes

• Moved database joins out of experimental into the stable advanced.database.joins option (#10359)

  Migration: Replace experimental: { joins: true } with advanced: { database: { joins: true } }. Drizzle and Prisma users should regenerate their schema (npx auth@latest generate) so it includes the required relations.

• Scoped account identity by trusted issuer, keying accounts on (issuer, accountId) (#10403)

  Migration: Accounts now require Account.issuer. Read provider identity from accountInfo.account.accountId, drop mapping.id from SSO configs, and give the microsoftEntraId helper a concrete tenant GUID. Apply the account-identity backfill in the 1.7 upgrade guide before deploying.

• Required captcha endpoint entries to match full auth paths, with wildcard support (#10004)

  Migration: Replace partial paths such as /sign-in with explicit wildcards like /sign-in/* or /sign-in/**.

• Moved the MCP plugin into its own @better-auth/mcp package built on the OAuth provider (#9992)

  Migration: Install @better-auth/mcp and @better-auth/cimd, add the now-required jwt() plugin, and move options nested under oidcConfig to flat mcp({ ... }) options. Rename withMcpAuth to requireMcpAuth and mcpHandler to createMcpProtectedRequestHandler. Regenerate the schema (npx auth migrate): oauthApplication becomes oauthClient, plus new oauthRefreshToken and oauthClientAssertion tables.

• Added OIDC back-channel logout so ending a session cuts off every connected app's API access (#9304)

  Migration: Introspecting an access token whose session has ended now returns { active: false }, and /oauth2/userinfo rejects it. Clients opt into notifications by registering backchannel_logout_uri. Run the schema migration for the new oauthClient and oauthAccessToken columns.

• Modeled OAuth protected resources explicitly, with per-resource TTLs, scopes, claims, and signing pins (#9648)

  Migration:validAudiences is removed: move each resource identifier into resources and link restricted clients through oauthClientResource. @better-auth/mcp now requires an explicit resource. Run npx @better-auth/cli generate and apply the migration before deploying.

• Decoupled SCIM provisioning from the organization plugin (#10390)

  Migration: SCIM configuration, client APIs, database schema, and the Group model are all replaced, and provisioning state cannot migrate in place. Follow the SCIM cutover in the 1.7 upgrade guide, including a full directory reprovision, before resuming traffic.

• Added OTP-only two-factor enablement with a discriminated enableTwoFactor response (#9057)

  Migration:enableTwoFactor now returns a method field ("otp" or "totp"); narrow on it before reading totpURI and backupCodes. Pass method: "otp" for OTP enrollment, which requires otpOptions.sendOTP.

• Resolved the auth origin from Host by default when using a dynamic baseURL (#9134)

  Migration: If your proxy exposes the public hostname only through x-forwarded-host, set advanced.trustedProxyHeaders: true. Deployments where the proxy rewrites Host (nginx default, Vercel, Cloudflare, Netlify) are unaffected.

• Added unique lookup indexes for the device authorization deviceCode and userCode columns (#10059)

  Migration: Resolve duplicate code values before applying the migration. MySQL and SQL Server installations must also convert both columns to bounded strings and clean up values longer than 191 characters.

• Enforced S256 PKCE in the Electron sign-in flow and hardened custom-scheme origin checks (#9645)

  Migration: Upgrade the @better-auth/electron client and server together and add your app's scheme to trustedOrigins. The code_challenge_method parameter and disableOriginOverride option are removed, and host-bearing custom-scheme entries now match that host exactly.

• Identified Microsoft Entra accounts by the stable oid claim (#10204)

  Migration: Migrate existing Microsoft account rows created from sub before upgrading. Tokens without a valid oid are rejected.

• Required a Google client ID before Google One Tap verifies ID tokens (#10036)

  Migration: Configure oneTap({ clientId }) or socialProviders.google.clientId.

• Removed the deprecated oidcProvider plugin (#10031)

  Migration: Move OIDC authorization-server integrations to @better-auth/oauth-provider.

• Rewrote the generic OAuth plugin as a first-class social provider with OAuth 2.1 defaults (#9069)

  Migration: Replace signIn.oauth2({ providerId }) with signIn.social({ provider }), oauth2.link() with linkSocial(), and drop genericOAuthClient(). Callbacks move to /api/auth/callback/:id, pkce now defaults to true, and issuer and requireIssuerValidation are removed in favor of OIDC discovery.

• Separated OAuth device grant ownership into oauthDeviceAuthorization() (#10746)

  Migration: The OAuth integration replaces the optional resource column with oauthClientId and resources, so regenerate and apply the schema. Let pending device codes expire before upgrading from an earlier 1.7 prerelease.

• Verified provider id_tokens with a single shared verifier (#9828)

  Migration: Custom UpstreamProvider implementations replace the removed verifyIdToken method with an idToken config carrying a JWKS source, issuer, and audience. PayPal client id_token sign-in now returns ID_TOKEN_NOT_SUPPORTED; its redirect flow is unchanged.

Features

• Added clientAssertion support to the Microsoft Entra ID social provider (#9898)
• Made the Auth instance directly fetchable (#9431)
• Added per-provider requireEmailVerification for social sign-in (#9929)
• Added a user.validateUserInfo gate for rejecting an identity before a user is created or linked (#9864)
• Added hydrateSession so useSession returns server-fetched data on the first render (#8733)
• Added compound table indexes to plugin database schemas (#10402)

... (truncated)

Changelog

Sourced from @​better-auth/oauth-provider's changelog.

1.7.0

Minor Changes

• #105775c45abc Thanks @​gustavovalverde! - OAuth clients now store applicationType and expose it as application_type in OAuth metadata. tokenEndpointAuthMethod alone determines authentication: "none" is public, and every other method is confidential. The legacy type and public fields are removed.

  OAuthClient no longer has a catch-all string index. Model custom wire extensions explicitly with a named intersection such as OAuthClient & YourExtensionMetadata; legacy type and public fields no longer type-check as unknown baggage.

  • Dynamic, administrative, and user-managed registrations default an omitted application_type to web. Client ID Metadata Documents preserve an omitted value as null.
  • Web redirects require HTTPS on a non-loopback host. Native redirects accept claimed HTTPS URLs, exact HTTP loopback hosts, or reverse-domain private-use schemes.
  • Registration resource options control resource links. mcp() contributes its protected resource by default, so standards-based clients no longer need a resources extension.
  • mcp() no longer enables unauthenticated Dynamic Client Registration. Compose mcp() with cimd() for Client ID Metadata Documents, or enable both DCR flags explicitly.

  This release requires a database migration. Add applicationType and nullable clientDiscoveryId; map old web and native values directly, map user-agent-based to NULL for manual reclassification, and never derive it from public. Set clientDiscoveryId only from known discovery provenance, never by inspecting an HTTPS client ID. Deduplicate existing (clientId, resourceId) links before adding the new compound unique index, then drop the legacy columns. Deployments with custom schema mappings must apply this backfill manually.

  Machine-to-machine scope authority is now stored separately in nullable oauthClient.clientCredentialsScopes. Missing, NULL, and empty values deny client_credentials token issuance. Only the administrative create and update endpoints expose client_credentials_scopes, and assigning a non-empty value requires clientPrivileges to approve the new configure-client-credentials-scopes action. DCR, CIMD, and user-managed registration cannot assign this field; CIMD refresh preserves an existing administrator-owned value. Remove clientCredentialGrantDefaultScopes, backfill every existing client to [], configure [] as the default for new rows, then explicitly assign every approved machine scope after auditing the client.

• #105775c45abc Thanks @​gustavovalverde! - Client ID Metadata Documents now follow shared-cache freshness rules and fail closed when freshness is ambiguous. The plugin prefers s-maxage over max-age and Expires, honors s-maxage=0, conditionally revalidates with ETag or Last-Modified, and treats invalid or duplicate freshness directives as immediately stale. Concurrent refreshes converge on one client-resource link instead of failing on its unique constraint.

  Shared OAuth metadata validation now rejects a blank client_name without trimming a valid display name. Native private-use redirects require the RFC 8252 single-slash form, such as com.example.app:/callback. Native HTTP redirects accept only exact localhost, 127.0.0.1, or [::1] hosts; other 127.0.0.0/8 addresses and localhost subdomains are rejected.

  CIMD now bounds metadata request amplification through metadataFetchPolicy: same-client fetches coalesce, per-client pacing and global/per-origin concurrency reject immediately, and rolling 60-second budgets cap unique-client sprays. HTTP no-store, private, and Vary: * behavior is unchanged and never feeds metadata or validators into the governor.

  Node.js deployments can import fetchClientMetadataResource from @better-auth/cimd/node. The transport resolves once, rejects any non-public DNS answer, pins the approved connection without using the global HTTPS pool, preserves Host and TLS certificate identity, and returns redirects and response bodies without buffering. Other runtimes remain responsible for providing an equivalent secure transport.

  Unknown draft-02 metadata members are now ignored and never persisted. Recognized secrets, privilege fields, and server controls remain fatal, while generic internal aliases and nonstandard client-credentials authority spellings are stripped.

• #9159cd8313b Thanks @​gustavovalverde! - Add @better-auth/cimd for Client ID Metadata Document draft-02. An exact HTTPS metadata-document URL becomes the OAuth client_id, and OAuth discovery advertises support when the plugin is installed. The explicit metadataProfile: "mcp-2026-07-28" mode applies the draft-00 metadata requirements pinned by MCP 2026-07-28.

  • Validate the complete shared OAuth client metadata schema. Generic draft-02 clients may omit client_name and redirect_uris and may use any grant supported by the OAuth Provider; the MCP profile requires client_id, client_name, and redirect_uris.
  • Reject client secrets, private JWK material, back-channel logout metadata, server-owned fields, unsafe metadata URLs, non-JSON responses, oversized documents, redirects, and private or reserved network targets. Loopback Client Identifier URLs are no longer supported.
  • Validate registered, discovered, and remotely fetched client JWKS through one public-asymmetric-key boundary. RFC 7517 JWK Sets must use { "keys": [...] }; replace the removed bare-array form jwks: [key] with jwks: { keys: [key] }. Empty, malformed, symmetric, private, and unsupported key sets fail before they can enter a provider-scoped cache. EC keys must use P-256, P-384, or P-521; OKP keys must use Ed25519. A declared alg must match the key type and curve. Existing OAuth client rows written through oauthToSchema are already normalized, so no database rewrite is required unless rows were written outside Better Auth.
  • Require fetchClientMetadataResource as the deployment-owned transport for both metadata documents and discovery-owned jwks_uri resources. It must resolve once, reject RFC 6890 special-use addresses, pin the approved address for the connection, and refuse redirects. isMetadataDocumentUrlAllowed remains available for additional application policy.
  • Cache only valid successful metadata with bounded storage, HTTP shared-cache freshness rules, ETag and Last-Modified conditional revalidation, and fail-closed refresh behavior. Cache-Control: private and Vary: * are noncacheable, and an unconditional 304 is rejected.
  • Persist oauthClient.clientDiscoveryId as nullable discovery provenance. Discovery IDs are globally unique, and an owned client fails closed when its matching discovery is unavailable. Only that discovery may refresh the client or provide transport for its metadata-owned resources, so managed and DCR HTTPS client IDs cannot be taken over.
  • Preserve custom model names, resource links, and administrator-controlled client flags when clients are created or refreshed. Refresh notifications now receive previousClient.

  OAuth Provider also exposes clientDiscovery for custom verified client-resolution plugins. A discovery may provide fetchClientMetadataResource, and its stable id is persisted as client provenance.

  Prerelease adopters must rename createCimdResolver or cimdClientDiscovery to createCimdClientDiscovery, ClientIdMetadataDocumentResult to CimdMetadataValidationResult, ValidateCimdMetadataOptions to CimdMetadataValidationOptions, isUrlClientId to isCimdClientIdUrlCandidate, and MetadataDocumentFetch to ClientMetadataResourceFetch. Rename refreshRate to metadataRevalidationInterval; there is no compatibility fallback. Numeric revalidation and minimumFetchInterval values are seconds.

  Lifecycle callbacks now receive named CimdClientCreatedEvent and CimdClientRefreshedEvent values. Read validated metadata from clientMetadataDocument instead of metadata, and the endpoint context from context instead of ctx. CimdOptions is now required because fetchClientMetadataResource is mandatory. Remove the prerelease allowFetch, fetchMetadataDocument, and allowLoopback options.

  When adopting CIMD, remove allowUnauthenticatedClientRegistration unless the authorization server deliberately supports Dynamic Client Registration as a separate fallback.

• #107466782647 Thanks @​gustavovalverde! - OAuth device grants now use oauthDeviceAuthorization() alongside oauthProvider() or mcp(). This single integration replaces both the standalone deviceCodeGrant() plugin and the shared-grant configuration. Standalone Device Authorization no longer accepts or stores RFC 8707 resources, and onDeviceAuthRequest receives only clientId and scope. The OAuth integration rejects resource indicators that are not absolute, fragment-free URIs.

  The OAuth integration replaces the optional resource column with oauthClientId and resources. Regenerate and apply the schema when using it. Before upgrading from an earlier 1.7 prerelease, let pending OAuth device codes expire or delete them because they cannot be exchanged through the new integration.

• #10156e3125e8 Thanks @​gustavovalverde! - The OIDC provider now honors the claims.userinfo authorization request parameter. A client can ask for individual standard claims, and the UserInfo endpoint returns the ones it can supply in addition to the scope-granted claims. The requested claims become part of the user's consent, and claims_parameter_supported is advertised in discovery.

  Authorization requests that use the claims parameter without requesting the openid scope are rejected.

... (truncated)

Commits

• ccd57c2 docs(changelog): align v1.7 release notes with final behavior (#10846)
• f577ec5 chore: exit pre-release mode for v1.7.0
• 69258d1 chore: sync main to next
• e84ec5e chore: release v1.6.30 (#10840)
• bc93b27 chore: release v1.7.0-rc.6 (#10772)
• 58c49eb chore: release v1.6.29 (#10809)
• 14975fb chore: sync main to next
• f451d1c fix(oauth-provider): complete RP-initiated logout flow (#10812)
• 801968e fix(oauth-provider): accept issuer audience for client assertions (#10811)
• 80799e6 chore: sync main to next
• Additional commits viewable in compare view

[Medformatik]

Superseded by #274, which upgrades the complete Better Auth package family to 1.7.1 and includes the required schema migration and application API changes.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[dependabot]

Bumps @better-auth/oauth-provider from 1.6.26 to 1.7.0.

Release notes

Sourced from @​better-auth/oauth-provider's releases.

v1.7.0

Blog post:Better Auth 1.7

better-auth

❗ Breaking Changes

• Moved database joins out of experimental into the stable advanced.database.joins option (#10359)

  Migration: Replace experimental: { joins: true } with advanced: { database: { joins: true } }. Drizzle and Prisma users should regenerate their schema (npx auth@latest generate) so it includes the required relations.

• Scoped account identity by trusted issuer, keying accounts on (issuer, accountId) (#10403)

  Migration: Accounts now require Account.issuer. Read provider identity from accountInfo.account.accountId, drop mapping.id from SSO configs, and give the microsoftEntraId helper a concrete tenant GUID. Apply the account-identity backfill in the 1.7 upgrade guide before deploying.

• Required captcha endpoint entries to match full auth paths, with wildcard support (#10004)

  Migration: Replace partial paths such as /sign-in with explicit wildcards like /sign-in/* or /sign-in/**.

• Moved the MCP plugin into its own @better-auth/mcp package built on the OAuth provider (#9992)

  Migration: Install @better-auth/mcp and @better-auth/cimd, add the now-required jwt() plugin, and move options nested under oidcConfig to flat mcp({ ... }) options. Rename withMcpAuth to requireMcpAuth and mcpHandler to createMcpProtectedRequestHandler. Regenerate the schema (npx auth migrate): oauthApplication becomes oauthClient, plus new oauthRefreshToken and oauthClientAssertion tables.

• Added OIDC back-channel logout so ending a session cuts off every connected app's API access (#9304)

  Migration: Introspecting an access token whose session has ended now returns { active: false }, and /oauth2/userinfo rejects it. Clients opt into notifications by registering backchannel_logout_uri. Run the schema migration for the new oauthClient and oauthAccessToken columns.

• Modeled OAuth protected resources explicitly, with per-resource TTLs, scopes, claims, and signing pins (#9648)

  Migration:validAudiences is removed: move each resource identifier into resources and link restricted clients through oauthClientResource. @better-auth/mcp now requires an explicit resource. Run npx @better-auth/cli generate and apply the migration before deploying.

• Decoupled SCIM provisioning from the organization plugin (#10390)

  Migration: SCIM configuration, client APIs, database schema, and the Group model are all replaced, and provisioning state cannot migrate in place. Follow the SCIM cutover in the 1.7 upgrade guide, including a full directory reprovision, before resuming traffic.

• Added OTP-only two-factor enablement with a discriminated enableTwoFactor response (#9057)

  Migration:enableTwoFactor now returns a method field ("otp" or "totp"); narrow on it before reading totpURI and backupCodes. Pass method: "otp" for OTP enrollment, which requires otpOptions.sendOTP.

• Resolved the auth origin from Host by default when using a dynamic baseURL (#9134)

  Migration: If your proxy exposes the public hostname only through x-forwarded-host, set advanced.trustedProxyHeaders: true. Deployments where the proxy rewrites Host (nginx default, Vercel, Cloudflare, Netlify) are unaffected.

• Added unique lookup indexes for the device authorization deviceCode and userCode columns (#10059)

  Migration: Resolve duplicate code values before applying the migration. MySQL and SQL Server installations must also convert both columns to bounded strings and clean up values longer than 191 characters.

• Enforced S256 PKCE in the Electron sign-in flow and hardened custom-scheme origin checks (#9645)

  Migration: Upgrade the @better-auth/electron client and server together and add your app's scheme to trustedOrigins. The code_challenge_method parameter and disableOriginOverride option are removed, and host-bearing custom-scheme entries now match that host exactly.

• Identified Microsoft Entra accounts by the stable oid claim (#10204)

  Migration: Migrate existing Microsoft account rows created from sub before upgrading. Tokens without a valid oid are rejected.

• Required a Google client ID before Google One Tap verifies ID tokens (#10036)

  Migration: Configure oneTap({ clientId }) or socialProviders.google.clientId.

• Removed the deprecated oidcProvider plugin (#10031)

  Migration: Move OIDC authorization-server integrations to @better-auth/oauth-provider.

• Rewrote the generic OAuth plugin as a first-class social provider with OAuth 2.1 defaults (#9069)

  Migration: Replace signIn.oauth2({ providerId }) with signIn.social({ provider }), oauth2.link() with linkSocial(), and drop genericOAuthClient(). Callbacks move to /api/auth/callback/:id, pkce now defaults to true, and issuer and requireIssuerValidation are removed in favor of OIDC discovery.

• Separated OAuth device grant ownership into oauthDeviceAuthorization() (#10746)

  Migration: The OAuth integration replaces the optional resource column with oauthClientId and resources, so regenerate and apply the schema. Let pending device codes expire before upgrading from an earlier 1.7 prerelease.

• Verified provider id_tokens with a single shared verifier (#9828)

  Migration: Custom UpstreamProvider implementations replace the removed verifyIdToken method with an idToken config carrying a JWKS source, issuer, and audience. PayPal client id_token sign-in now returns ID_TOKEN_NOT_SUPPORTED; its redirect flow is unchanged.

Features

• Added clientAssertion support to the Microsoft Entra ID social provider (#9898)
• Made the Auth instance directly fetchable (#9431)
• Added per-provider requireEmailVerification for social sign-in (#9929)
• Added a user.validateUserInfo gate for rejecting an identity before a user is created or linked (#9864)
• Added hydrateSession so useSession returns server-fetched data on the first render (#8733)
• Added compound table indexes to plugin database schemas (#10402)

... (truncated)

Changelog

Sourced from @​better-auth/oauth-provider's changelog.

1.7.0

Minor Changes

• #105775c45abc Thanks @​gustavovalverde! - OAuth clients now store applicationType and expose it as application_type in OAuth metadata. tokenEndpointAuthMethod alone determines authentication: "none" is public, and every other method is confidential. The legacy type and public fields are removed.

  OAuthClient no longer has a catch-all string index. Model custom wire extensions explicitly with a named intersection such as OAuthClient & YourExtensionMetadata; legacy type and public fields no longer type-check as unknown baggage.

  • Dynamic, administrative, and user-managed registrations default an omitted application_type to web. Client ID Metadata Documents preserve an omitted value as null.
  • Web redirects require HTTPS on a non-loopback host. Native redirects accept claimed HTTPS URLs, exact HTTP loopback hosts, or reverse-domain private-use schemes.
  • Registration resource options control resource links. mcp() contributes its protected resource by default, so standards-based clients no longer need a resources extension.
  • mcp() no longer enables unauthenticated Dynamic Client Registration. Compose mcp() with cimd() for Client ID Metadata Documents, or enable both DCR flags explicitly.

  This release requires a database migration. Add applicationType and nullable clientDiscoveryId; map old web and native values directly, map user-agent-based to NULL for manual reclassification, and never derive it from public. Set clientDiscoveryId only from known discovery provenance, never by inspecting an HTTPS client ID. Deduplicate existing (clientId, resourceId) links before adding the new compound unique index, then drop the legacy columns. Deployments with custom schema mappings must apply this backfill manually.

  Machine-to-machine scope authority is now stored separately in nullable oauthClient.clientCredentialsScopes. Missing, NULL, and empty values deny client_credentials token issuance. Only the administrative create and update endpoints expose client_credentials_scopes, and assigning a non-empty value requires clientPrivileges to approve the new configure-client-credentials-scopes action. DCR, CIMD, and user-managed registration cannot assign this field; CIMD refresh preserves an existing administrator-owned value. Remove clientCredentialGrantDefaultScopes, backfill every existing client to [], configure [] as the default for new rows, then explicitly assign every approved machine scope after auditing the client.

• #105775c45abc Thanks @​gustavovalverde! - Client ID Metadata Documents now follow shared-cache freshness rules and fail closed when freshness is ambiguous. The plugin prefers s-maxage over max-age and Expires, honors s-maxage=0, conditionally revalidates with ETag or Last-Modified, and treats invalid or duplicate freshness directives as immediately stale. Concurrent refreshes converge on one client-resource link instead of failing on its unique constraint.

  Shared OAuth metadata validation now rejects a blank client_name without trimming a valid display name. Native private-use redirects require the RFC 8252 single-slash form, such as com.example.app:/callback. Native HTTP redirects accept only exact localhost, 127.0.0.1, or [::1] hosts; other 127.0.0.0/8 addresses and localhost subdomains are rejected.

  CIMD now bounds metadata request amplification through metadataFetchPolicy: same-client fetches coalesce, per-client pacing and global/per-origin concurrency reject immediately, and rolling 60-second budgets cap unique-client sprays. HTTP no-store, private, and Vary: * behavior is unchanged and never feeds metadata or validators into the governor.

  Node.js deployments can import fetchClientMetadataResource from @better-auth/cimd/node. The transport resolves once, rejects any non-public DNS answer, pins the approved connection without using the global HTTPS pool, preserves Host and TLS certificate identity, and returns redirects and response bodies without buffering. Other runtimes remain responsible for providing an equivalent secure transport.

  Unknown draft-02 metadata members are now ignored and never persisted. Recognized secrets, privilege fields, and server controls remain fatal, while generic internal aliases and nonstandard client-credentials authority spellings are stripped.

• #9159cd8313b Thanks @​gustavovalverde! - Add @better-auth/cimd for Client ID Metadata Document draft-02. An exact HTTPS metadata-document URL becomes the OAuth client_id, and OAuth discovery advertises support when the plugin is installed. The explicit metadataProfile: "mcp-2026-07-28" mode applies the draft-00 metadata requirements pinned by MCP 2026-07-28.

  • Validate the complete shared OAuth client metadata schema. Generic draft-02 clients may omit client_name and redirect_uris and may use any grant supported by the OAuth Provider; the MCP profile requires client_id, client_name, and redirect_uris.
  • Reject client secrets, private JWK material, back-channel logout metadata, server-owned fields, unsafe metadata URLs, non-JSON responses, oversized documents, redirects, and private or reserved network targets. Loopback Client Identifier URLs are no longer supported.
  • Validate registered, discovered, and remotely fetched client JWKS through one public-asymmetric-key boundary. RFC 7517 JWK Sets must use { "keys": [...] }; replace the removed bare-array form jwks: [key] with jwks: { keys: [key] }. Empty, malformed, symmetric, private, and unsupported key sets fail before they can enter a provider-scoped cache. EC keys must use P-256, P-384, or P-521; OKP keys must use Ed25519. A declared alg must match the key type and curve. Existing OAuth client rows written through oauthToSchema are already normalized, so no database rewrite is required unless rows were written outside Better Auth.
  • Require fetchClientMetadataResource as the deployment-owned transport for both metadata documents and discovery-owned jwks_uri resources. It must resolve once, reject RFC 6890 special-use addresses, pin the approved address for the connection, and refuse redirects. isMetadataDocumentUrlAllowed remains available for additional application policy.
  • Cache only valid successful metadata with bounded storage, HTTP shared-cache freshness rules, ETag and Last-Modified conditional revalidation, and fail-closed refresh behavior. Cache-Control: private and Vary: * are noncacheable, and an unconditional 304 is rejected.
  • Persist oauthClient.clientDiscoveryId as nullable discovery provenance. Discovery IDs are globally unique, and an owned client fails closed when its matching discovery is unavailable. Only that discovery may refresh the client or provide transport for its metadata-owned resources, so managed and DCR HTTPS client IDs cannot be taken over.
  • Preserve custom model names, resource links, and administrator-controlled client flags when clients are created or refreshed. Refresh notifications now receive previousClient.

  OAuth Provider also exposes clientDiscovery for custom verified client-resolution plugins. A discovery may provide fetchClientMetadataResource, and its stable id is persisted as client provenance.

  Prerelease adopters must rename createCimdResolver or cimdClientDiscovery to createCimdClientDiscovery, ClientIdMetadataDocumentResult to CimdMetadataValidationResult, ValidateCimdMetadataOptions to CimdMetadataValidationOptions, isUrlClientId to isCimdClientIdUrlCandidate, and MetadataDocumentFetch to ClientMetadataResourceFetch. Rename refreshRate to metadataRevalidationInterval; there is no compatibility fallback. Numeric revalidation and minimumFetchInterval values are seconds.

  Lifecycle callbacks now receive named CimdClientCreatedEvent and CimdClientRefreshedEvent values. Read validated metadata from clientMetadataDocument instead of metadata, and the endpoint context from context instead of ctx. CimdOptions is now required because fetchClientMetadataResource is mandatory. Remove the prerelease allowFetch, fetchMetadataDocument, and allowLoopback options.

  When adopting CIMD, remove allowUnauthenticatedClientRegistration unless the authorization server deliberately supports Dynamic Client Registration as a separate fallback.

• #107466782647 Thanks @​gustavovalverde! - OAuth device grants now use oauthDeviceAuthorization() alongside oauthProvider() or mcp(). This single integration replaces both the standalone deviceCodeGrant() plugin and the shared-grant configuration. Standalone Device Authorization no longer accepts or stores RFC 8707 resources, and onDeviceAuthRequest receives only clientId and scope. The OAuth integration rejects resource indicators that are not absolute, fragment-free URIs.

  The OAuth integration replaces the optional resource column with oauthClientId and resources. Regenerate and apply the schema when using it. Before upgrading from an earlier 1.7 prerelease, let pending OAuth device codes expire or delete them because they cannot be exchanged through the new integration.

• #10156e3125e8 Thanks @​gustavovalverde! - The OIDC provider now honors the claims.userinfo authorization request parameter. A client can ask for individual standard claims, and the UserInfo endpoint returns the ones it can supply in addition to the scope-granted claims. The requested claims become part of the user's consent, and claims_parameter_supported is advertised in discovery.

  Authorization requests that use the claims parameter without requesting the openid scope are rejected.

... (truncated)

Commits

• ccd57c2 docs(changelog): align v1.7 release notes with final behavior (#10846)
• f577ec5 chore: exit pre-release mode for v1.7.0
• 69258d1 chore: sync main to next
• e84ec5e chore: release v1.6.30 (#10840)
• bc93b27 chore: release v1.7.0-rc.6 (#10772)
• 58c49eb chore: release v1.6.29 (#10809)
• 14975fb chore: sync main to next
• f451d1c fix(oauth-provider): complete RP-initiated logout flow (#10812)
• 801968e fix(oauth-provider): accept issuer audience for client assertions (#10811)
• 80799e6 chore: sync main to next
• Additional commits viewable in compare view

[Medformatik]

Superseded by #274, which upgrades the complete Better Auth package family to 1.7.1 and includes the required schema migration and application API changes.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[dependabot]

Bumps @better-auth/oauth-provider from 1.6.26 to 1.7.0.

Release notes

Sourced from @​better-auth/oauth-provider's releases.

v1.7.0

Blog post:Better Auth 1.7

better-auth

❗ Breaking Changes

• Moved database joins out of experimental into the stable advanced.database.joins option (#10359)

  Migration: Replace experimental: { joins: true } with advanced: { database: { joins: true } }. Drizzle and Prisma users should regenerate their schema (npx auth@latest generate) so it includes the required relations.

• Scoped account identity by trusted issuer, keying accounts on (issuer, accountId) (#10403)

  Migration: Accounts now require Account.issuer. Read provider identity from accountInfo.account.accountId, drop mapping.id from SSO configs, and give the microsoftEntraId helper a concrete tenant GUID. Apply the account-identity backfill in the 1.7 upgrade guide before deploying.

• Required captcha endpoint entries to match full auth paths, with wildcard support (#10004)

  Migration: Replace partial paths such as /sign-in with explicit wildcards like /sign-in/* or /sign-in/**.

• Moved the MCP plugin into its own @better-auth/mcp package built on the OAuth provider (#9992)

  Migration: Install @better-auth/mcp and @better-auth/cimd, add the now-required jwt() plugin, and move options nested under oidcConfig to flat mcp({ ... }) options. Rename withMcpAuth to requireMcpAuth and mcpHandler to createMcpProtectedRequestHandler. Regenerate the schema (npx auth migrate): oauthApplication becomes oauthClient, plus new oauthRefreshToken and oauthClientAssertion tables.

• Added OIDC back-channel logout so ending a session cuts off every connected app's API access (#9304)

  Migration: Introspecting an access token whose session has ended now returns { active: false }, and /oauth2/userinfo rejects it. Clients opt into notifications by registering backchannel_logout_uri. Run the schema migration for the new oauthClient and oauthAccessToken columns.

• Modeled OAuth protected resources explicitly, with per-resource TTLs, scopes, claims, and signing pins (#9648)

  Migration:validAudiences is removed: move each resource identifier into resources and link restricted clients through oauthClientResource. @better-auth/mcp now requires an explicit resource. Run npx @better-auth/cli generate and apply the migration before deploying.

• Decoupled SCIM provisioning from the organization plugin (#10390)

  Migration: SCIM configuration, client APIs, database schema, and the Group model are all replaced, and provisioning state cannot migrate in place. Follow the SCIM cutover in the 1.7 upgrade guide, including a full directory reprovision, before resuming traffic.

• Added OTP-only two-factor enablement with a discriminated enableTwoFactor response (#9057)

  Migration:enableTwoFactor now returns a method field ("otp" or "totp"); narrow on it before reading totpURI and backupCodes. Pass method: "otp" for OTP enrollment, which requires otpOptions.sendOTP.

• Resolved the auth origin from Host by default when using a dynamic baseURL (#9134)

  Migration: If your proxy exposes the public hostname only through x-forwarded-host, set advanced.trustedProxyHeaders: true. Deployments where the proxy rewrites Host (nginx default, Vercel, Cloudflare, Netlify) are unaffected.

• Added unique lookup indexes for the device authorization deviceCode and userCode columns (#10059)

  Migration: Resolve duplicate code values before applying the migration. MySQL and SQL Server installations must also convert both columns to bounded strings and clean up values longer than 191 characters.

• Enforced S256 PKCE in the Electron sign-in flow and hardened custom-scheme origin checks (#9645)

  Migration: Upgrade the @better-auth/electron client and server together and add your app's scheme to trustedOrigins. The code_challenge_method parameter and disableOriginOverride option are removed, and host-bearing custom-scheme entries now match that host exactly.

• Identified Microsoft Entra accounts by the stable oid claim (#10204)

  Migration: Migrate existing Microsoft account rows created from sub before upgrading. Tokens without a valid oid are rejected.

• Required a Google client ID before Google One Tap verifies ID tokens (#10036)

  Migration: Configure oneTap({ clientId }) or socialProviders.google.clientId.

• Removed the deprecated oidcProvider plugin (#10031)

  Migration: Move OIDC authorization-server integrations to @better-auth/oauth-provider.

• Rewrote the generic OAuth plugin as a first-class social provider with OAuth 2.1 defaults (#9069)

  Migration: Replace signIn.oauth2({ providerId }) with signIn.social({ provider }), oauth2.link() with linkSocial(), and drop genericOAuthClient(). Callbacks move to /api/auth/callback/:id, pkce now defaults to true, and issuer and requireIssuerValidation are removed in favor of OIDC discovery.

• Separated OAuth device grant ownership into oauthDeviceAuthorization() (#10746)

  Migration: The OAuth integration replaces the optional resource column with oauthClientId and resources, so regenerate and apply the schema. Let pending device codes expire before upgrading from an earlier 1.7 prerelease.

• Verified provider id_tokens with a single shared verifier (#9828)

  Migration: Custom UpstreamProvider implementations replace the removed verifyIdToken method with an idToken config carrying a JWKS source, issuer, and audience. PayPal client id_token sign-in now returns ID_TOKEN_NOT_SUPPORTED; its redirect flow is unchanged.

Features

• Added clientAssertion support to the Microsoft Entra ID social provider (#9898)
• Made the Auth instance directly fetchable (#9431)
• Added per-provider requireEmailVerification for social sign-in (#9929)
• Added a user.validateUserInfo gate for rejecting an identity before a user is created or linked (#9864)
• Added hydrateSession so useSession returns server-fetched data on the first render (#8733)
• Added compound table indexes to plugin database schemas (#10402)

... (truncated)

Changelog

Sourced from @​better-auth/oauth-provider's changelog.

1.7.0

Minor Changes

• #105775c45abc Thanks @​gustavovalverde! - OAuth clients now store applicationType and expose it as application_type in OAuth metadata. tokenEndpointAuthMethod alone determines authentication: "none" is public, and every other method is confidential. The legacy type and public fields are removed.

  OAuthClient no longer has a catch-all string index. Model custom wire extensions explicitly with a named intersection such as OAuthClient & YourExtensionMetadata; legacy type and public fields no longer type-check as unknown baggage.

  • Dynamic, administrative, and user-managed registrations default an omitted application_type to web. Client ID Metadata Documents preserve an omitted value as null.
  • Web redirects require HTTPS on a non-loopback host. Native redirects accept claimed HTTPS URLs, exact HTTP loopback hosts, or reverse-domain private-use schemes.
  • Registration resource options control resource links. mcp() contributes its protected resource by default, so standards-based clients no longer need a resources extension.
  • mcp() no longer enables unauthenticated Dynamic Client Registration. Compose mcp() with cimd() for Client ID Metadata Documents, or enable both DCR flags explicitly.

  This release requires a database migration. Add applicationType and nullable clientDiscoveryId; map old web and native values directly, map user-agent-based to NULL for manual reclassification, and never derive it from public. Set clientDiscoveryId only from known discovery provenance, never by inspecting an HTTPS client ID. Deduplicate existing (clientId, resourceId) links before adding the new compound unique index, then drop the legacy columns. Deployments with custom schema mappings must apply this backfill manually.

  Machine-to-machine scope authority is now stored separately in nullable oauthClient.clientCredentialsScopes. Missing, NULL, and empty values deny client_credentials token issuance. Only the administrative create and update endpoints expose client_credentials_scopes, and assigning a non-empty value requires clientPrivileges to approve the new configure-client-credentials-scopes action. DCR, CIMD, and user-managed registration cannot assign this field; CIMD refresh preserves an existing administrator-owned value. Remove clientCredentialGrantDefaultScopes, backfill every existing client to [], configure [] as the default for new rows, then explicitly assign every approved machine scope after auditing the client.

• #105775c45abc Thanks @​gustavovalverde! - Client ID Metadata Documents now follow shared-cache freshness rules and fail closed when freshness is ambiguous. The plugin prefers s-maxage over max-age and Expires, honors s-maxage=0, conditionally revalidates with ETag or Last-Modified, and treats invalid or duplicate freshness directives as immediately stale. Concurrent refreshes converge on one client-resource link instead of failing on its unique constraint.

  Shared OAuth metadata validation now rejects a blank client_name without trimming a valid display name. Native private-use redirects require the RFC 8252 single-slash form, such as com.example.app:/callback. Native HTTP redirects accept only exact localhost, 127.0.0.1, or [::1] hosts; other 127.0.0.0/8 addresses and localhost subdomains are rejected.

  CIMD now bounds metadata request amplification through metadataFetchPolicy: same-client fetches coalesce, per-client pacing and global/per-origin concurrency reject immediately, and rolling 60-second budgets cap unique-client sprays. HTTP no-store, private, and Vary: * behavior is unchanged and never feeds metadata or validators into the governor.

  Node.js deployments can import fetchClientMetadataResource from @better-auth/cimd/node. The transport resolves once, rejects any non-public DNS answer, pins the approved connection without using the global HTTPS pool, preserves Host and TLS certificate identity, and returns redirects and response bodies without buffering. Other runtimes remain responsible for providing an equivalent secure transport.

  Unknown draft-02 metadata members are now ignored and never persisted. Recognized secrets, privilege fields, and server controls remain fatal, while generic internal aliases and nonstandard client-credentials authority spellings are stripped.

• #9159cd8313b Thanks @​gustavovalverde! - Add @better-auth/cimd for Client ID Metadata Document draft-02. An exact HTTPS metadata-document URL becomes the OAuth client_id, and OAuth discovery advertises support when the plugin is installed. The explicit metadataProfile: "mcp-2026-07-28" mode applies the draft-00 metadata requirements pinned by MCP 2026-07-28.

  • Validate the complete shared OAuth client metadata schema. Generic draft-02 clients may omit client_name and redirect_uris and may use any grant supported by the OAuth Provider; the MCP profile requires client_id, client_name, and redirect_uris.
  • Reject client secrets, private JWK material, back-channel logout metadata, server-owned fields, unsafe metadata URLs, non-JSON responses, oversized documents, redirects, and private or reserved network targets. Loopback Client Identifier URLs are no longer supported.
  • Validate registered, discovered, and remotely fetched client JWKS through one public-asymmetric-key boundary. RFC 7517 JWK Sets must use { "keys": [...] }; replace the removed bare-array form jwks: [key] with jwks: { keys: [key] }. Empty, malformed, symmetric, private, and unsupported key sets fail before they can enter a provider-scoped cache. EC keys must use P-256, P-384, or P-521; OKP keys must use Ed25519. A declared alg must match the key type and curve. Existing OAuth client rows written through oauthToSchema are already normalized, so no database rewrite is required unless rows were written outside Better Auth.
  • Require fetchClientMetadataResource as the deployment-owned transport for both metadata documents and discovery-owned jwks_uri resources. It must resolve once, reject RFC 6890 special-use addresses, pin the approved address for the connection, and refuse redirects. isMetadataDocumentUrlAllowed remains available for additional application policy.
  • Cache only valid successful metadata with bounded storage, HTTP shared-cache freshness rules, ETag and Last-Modified conditional revalidation, and fail-closed refresh behavior. Cache-Control: private and Vary: * are noncacheable, and an unconditional 304 is rejected.
  • Persist oauthClient.clientDiscoveryId as nullable discovery provenance. Discovery IDs are globally unique, and an owned client fails closed when its matching discovery is unavailable. Only that discovery may refresh the client or provide transport for its metadata-owned resources, so managed and DCR HTTPS client IDs cannot be taken over.
  • Preserve custom model names, resource links, and administrator-controlled client flags when clients are created or refreshed. Refresh notifications now receive previousClient.

  OAuth Provider also exposes clientDiscovery for custom verified client-resolution plugins. A discovery may provide fetchClientMetadataResource, and its stable id is persisted as client provenance.

  Prerelease adopters must rename createCimdResolver or cimdClientDiscovery to createCimdClientDiscovery, ClientIdMetadataDocumentResult to CimdMetadataValidationResult, ValidateCimdMetadataOptions to CimdMetadataValidationOptions, isUrlClientId to isCimdClientIdUrlCandidate, and MetadataDocumentFetch to ClientMetadataResourceFetch. Rename refreshRate to metadataRevalidationInterval; there is no compatibility fallback. Numeric revalidation and minimumFetchInterval values are seconds.

  Lifecycle callbacks now receive named CimdClientCreatedEvent and CimdClientRefreshedEvent values. Read validated metadata from clientMetadataDocument instead of metadata, and the endpoint context from context instead of ctx. CimdOptions is now required because fetchClientMetadataResource is mandatory. Remove the prerelease allowFetch, fetchMetadataDocument, and allowLoopback options.

  When adopting CIMD, remove allowUnauthenticatedClientRegistration unless the authorization server deliberately supports Dynamic Client Registration as a separate fallback.

• #107466782647 Thanks @​gustavovalverde! - OAuth device grants now use oauthDeviceAuthorization() alongside oauthProvider() or mcp(). This single integration replaces both the standalone deviceCodeGrant() plugin and the shared-grant configuration. Standalone Device Authorization no longer accepts or stores RFC 8707 resources, and onDeviceAuthRequest receives only clientId and scope. The OAuth integration rejects resource indicators that are not absolute, fragment-free URIs.

  The OAuth integration replaces the optional resource column with oauthClientId and resources. Regenerate and apply the schema when using it. Before upgrading from an earlier 1.7 prerelease, let pending OAuth device codes expire or delete them because they cannot be exchanged through the new integration.

• #10156e3125e8 Thanks @​gustavovalverde! - The OIDC provider now honors the claims.userinfo authorization request parameter. A client can ask for individual standard claims, and the UserInfo endpoint returns the ones it can supply in addition to the scope-granted claims. The requested claims become part of the user's consent, and claims_parameter_supported is advertised in discovery.

  Authorization requests that use the claims parameter without requesting the openid scope are rejected.

... (truncated)

Commits

• ccd57c2 docs(changelog): align v1.7 release notes with final behavior (#10846)
• f577ec5 chore: exit pre-release mode for v1.7.0
• 69258d1 chore: sync main to next
• e84ec5e chore: release v1.6.30 (#10840)
• bc93b27 chore: release v1.7.0-rc.6 (#10772)
• 58c49eb chore: release v1.6.29 (#10809)
• 14975fb chore: sync main to next
• f451d1c fix(oauth-provider): complete RP-initiated logout flow (#10812)
• 801968e fix(oauth-provider): accept issuer audience for client assertions (#10811)
• 80799e6 chore: sync main to next
• Additional commits viewable in compare view

[Medformatik]

Superseded by #274, which upgrades the complete Better Auth package family to 1.7.1 and includes the required schema migration and application API changes.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[dependabot]

Bumps @better-auth/oauth-provider from 1.6.26 to 1.7.0.

Release notes

Sourced from @​better-auth/oauth-provider's releases.

v1.7.0

Blog post:Better Auth 1.7

better-auth

❗ Breaking Changes

• Moved database joins out of experimental into the stable advanced.database.joins option (#10359)

  Migration: Replace experimental: { joins: true } with advanced: { database: { joins: true } }. Drizzle and Prisma users should regenerate their schema (npx auth@latest generate) so it includes the required relations.

• Scoped account identity by trusted issuer, keying accounts on (issuer, accountId) (#10403)

  Migration: Accounts now require Account.issuer. Read provider identity from accountInfo.account.accountId, drop mapping.id from SSO configs, and give the microsoftEntraId helper a concrete tenant GUID. Apply the account-identity backfill in the 1.7 upgrade guide before deploying.

• Required captcha endpoint entries to match full auth paths, with wildcard support (#10004)

  Migration: Replace partial paths such as /sign-in with explicit wildcards like /sign-in/* or /sign-in/**.

• Moved the MCP plugin into its own @better-auth/mcp package built on the OAuth provider (#9992)

  Migration: Install @better-auth/mcp and @better-auth/cimd, add the now-required jwt() plugin, and move options nested under oidcConfig to flat mcp({ ... }) options. Rename withMcpAuth to requireMcpAuth and mcpHandler to createMcpProtectedRequestHandler. Regenerate the schema (npx auth migrate): oauthApplication becomes oauthClient, plus new oauthRefreshToken and oauthClientAssertion tables.

• Added OIDC back-channel logout so ending a session cuts off every connected app's API access (#9304)

  Migration: Introspecting an access token whose session has ended now returns { active: false }, and /oauth2/userinfo rejects it. Clients opt into notifications by registering backchannel_logout_uri. Run the schema migration for the new oauthClient and oauthAccessToken columns.

• Modeled OAuth protected resources explicitly, with per-resource TTLs, scopes, claims, and signing pins (#9648)

  Migration:validAudiences is removed: move each resource identifier into resources and link restricted clients through oauthClientResource. @better-auth/mcp now requires an explicit resource. Run npx @better-auth/cli generate and apply the migration before deploying.

• Decoupled SCIM provisioning from the organization plugin (#10390)

  Migration: SCIM configuration, client APIs, database schema, and the Group model are all replaced, and provisioning state cannot migrate in place. Follow the SCIM cutover in the 1.7 upgrade guide, including a full directory reprovision, before resuming traffic.

• Added OTP-only two-factor enablement with a discriminated enableTwoFactor response (#9057)

  Migration:enableTwoFactor now returns a method field ("otp" or "totp"); narrow on it before reading totpURI and backupCodes. Pass method: "otp" for OTP enrollment, which requires otpOptions.sendOTP.

• Resolved the auth origin from Host by default when using a dynamic baseURL (#9134)

  Migration: If your proxy exposes the public hostname only through x-forwarded-host, set advanced.trustedProxyHeaders: true. Deployments where the proxy rewrites Host (nginx default, Vercel, Cloudflare, Netlify) are unaffected.

• Added unique lookup indexes for the device authorization deviceCode and userCode columns (#10059)

  Migration: Resolve duplicate code values before applying the migration. MySQL and SQL Server installations must also convert both columns to bounded strings and clean up values longer than 191 characters.

• Enforced S256 PKCE in the Electron sign-in flow and hardened custom-scheme origin checks (#9645)

  Migration: Upgrade the @better-auth/electron client and server together and add your app's scheme to trustedOrigins. The code_challenge_method parameter and disableOriginOverride option are removed, and host-bearing custom-scheme entries now match that host exactly.

• Identified Microsoft Entra accounts by the stable oid claim (#10204)

  Migration: Migrate existing Microsoft account rows created from sub before upgrading. Tokens without a valid oid are rejected.

• Required a Google client ID before Google One Tap verifies ID tokens (#10036)

  Migration: Configure oneTap({ clientId }) or socialProviders.google.clientId.

• Removed the deprecated oidcProvider plugin (#10031)

  Migration: Move OIDC authorization-server integrations to @better-auth/oauth-provider.

• Rewrote the generic OAuth plugin as a first-class social provider with OAuth 2.1 defaults (#9069)

  Migration: Replace signIn.oauth2({ providerId }) with signIn.social({ provider }), oauth2.link() with linkSocial(), and drop genericOAuthClient(). Callbacks move to /api/auth/callback/:id, pkce now defaults to true, and issuer and requireIssuerValidation are removed in favor of OIDC discovery.

• Separated OAuth device grant ownership into oauthDeviceAuthorization() (#10746)

  Migration: The OAuth integration replaces the optional resource column with oauthClientId and resources, so regenerate and apply the schema. Let pending device codes expire before upgrading from an earlier 1.7 prerelease.

• Verified provider id_tokens with a single shared verifier (#9828)

  Migration: Custom UpstreamProvider implementations replace the removed verifyIdToken method with an idToken config carrying a JWKS source, issuer, and audience. PayPal client id_token sign-in now returns ID_TOKEN_NOT_SUPPORTED; its redirect flow is unchanged.

Features

• Added clientAssertion support to the Microsoft Entra ID social provider (#9898)
• Made the Auth instance directly fetchable (#9431)
• Added per-provider requireEmailVerification for social sign-in (#9929)
• Added a user.validateUserInfo gate for rejecting an identity before a user is created or linked (#9864)
• Added hydrateSession so useSession returns server-fetched data on the first render (#8733)
• Added compound table indexes to plugin database schemas (#10402)

... (truncated)

Changelog

Sourced from @​better-auth/oauth-provider's changelog.

1.7.0

Minor Changes

• #105775c45abc Thanks @​gustavovalverde! - OAuth clients now store applicationType and expose it as application_type in OAuth metadata. tokenEndpointAuthMethod alone determines authentication: "none" is public, and every other method is confidential. The legacy type and public fields are removed.

  OAuthClient no longer has a catch-all string index. Model custom wire extensions explicitly with a named intersection such as OAuthClient & YourExtensionMetadata; legacy type and public fields no longer type-check as unknown baggage.

  • Dynamic, administrative, and user-managed registrations default an omitted application_type to web. Client ID Metadata Documents preserve an omitted value as null.
  • Web redirects require HTTPS on a non-loopback host. Native redirects accept claimed HTTPS URLs, exact HTTP loopback hosts, or reverse-domain private-use schemes.
  • Registration resource options control resource links. mcp() contributes its protected resource by default, so standards-based clients no longer need a resources extension.
  • mcp() no longer enables unauthenticated Dynamic Client Registration. Compose mcp() with cimd() for Client ID Metadata Documents, or enable both DCR flags explicitly.

  This release requires a database migration. Add applicationType and nullable clientDiscoveryId; map old web and native values directly, map user-agent-based to NULL for manual reclassification, and never derive it from public. Set clientDiscoveryId only from known discovery provenance, never by inspecting an HTTPS client ID. Deduplicate existing (clientId, resourceId) links before adding the new compound unique index, then drop the legacy columns. Deployments with custom schema mappings must apply this backfill manually.

  Machine-to-machine scope authority is now stored separately in nullable oauthClient.clientCredentialsScopes. Missing, NULL, and empty values deny client_credentials token issuance. Only the administrative create and update endpoints expose client_credentials_scopes, and assigning a non-empty value requires clientPrivileges to approve the new configure-client-credentials-scopes action. DCR, CIMD, and user-managed registration cannot assign this field; CIMD refresh preserves an existing administrator-owned value. Remove clientCredentialGrantDefaultScopes, backfill every existing client to [], configure [] as the default for new rows, then explicitly assign every approved machine scope after auditing the client.

• #105775c45abc Thanks @​gustavovalverde! - Client ID Metadata Documents now follow shared-cache freshness rules and fail closed when freshness is ambiguous. The plugin prefers s-maxage over max-age and Expires, honors s-maxage=0, conditionally revalidates with ETag or Last-Modified, and treats invalid or duplicate freshness directives as immediately stale. Concurrent refreshes converge on one client-resource link instead of failing on its unique constraint.

  Shared OAuth metadata validation now rejects a blank client_name without trimming a valid display name. Native private-use redirects require the RFC 8252 single-slash form, such as com.example.app:/callback. Native HTTP redirects accept only exact localhost, 127.0.0.1, or [::1] hosts; other 127.0.0.0/8 addresses and localhost subdomains are rejected.

  CIMD now bounds metadata request amplification through metadataFetchPolicy: same-client fetches coalesce, per-client pacing and global/per-origin concurrency reject immediately, and rolling 60-second budgets cap unique-client sprays. HTTP no-store, private, and Vary: * behavior is unchanged and never feeds metadata or validators into the governor.

  Node.js deployments can import fetchClientMetadataResource from @better-auth/cimd/node. The transport resolves once, rejects any non-public DNS answer, pins the approved connection without using the global HTTPS pool, preserves Host and TLS certificate identity, and returns redirects and response bodies without buffering. Other runtimes remain responsible for providing an equivalent secure transport.

  Unknown draft-02 metadata members are now ignored and never persisted. Recognized secrets, privilege fields, and server controls remain fatal, while generic internal aliases and nonstandard client-credentials authority spellings are stripped.

• #9159cd8313b Thanks @​gustavovalverde! - Add @better-auth/cimd for Client ID Metadata Document draft-02. An exact HTTPS metadata-document URL becomes the OAuth client_id, and OAuth discovery advertises support when the plugin is installed. The explicit metadataProfile: "mcp-2026-07-28" mode applies the draft-00 metadata requirements pinned by MCP 2026-07-28.

  • Validate the complete shared OAuth client metadata schema. Generic draft-02 clients may omit client_name and redirect_uris and may use any grant supported by the OAuth Provider; the MCP profile requires client_id, client_name, and redirect_uris.
  • Reject client secrets, private JWK material, back-channel logout metadata, server-owned fields, unsafe metadata URLs, non-JSON responses, oversized documents, redirects, and private or reserved network targets. Loopback Client Identifier URLs are no longer supported.
  • Validate registered, discovered, and remotely fetched client JWKS through one public-asymmetric-key boundary. RFC 7517 JWK Sets must use { "keys": [...] }; replace the removed bare-array form jwks: [key] with jwks: { keys: [key] }. Empty, malformed, symmetric, private, and unsupported key sets fail before they can enter a provider-scoped cache. EC keys must use P-256, P-384, or P-521; OKP keys must use Ed25519. A declared alg must match the key type and curve. Existing OAuth client rows written through oauthToSchema are already normalized, so no database rewrite is required unless rows were written outside Better Auth.
  • Require fetchClientMetadataResource as the deployment-owned transport for both metadata documents and discovery-owned jwks_uri resources. It must resolve once, reject RFC 6890 special-use addresses, pin the approved address for the connection, and refuse redirects. isMetadataDocumentUrlAllowed remains available for additional application policy.
  • Cache only valid successful metadata with bounded storage, HTTP shared-cache freshness rules, ETag and Last-Modified conditional revalidation, and fail-closed refresh behavior. Cache-Control: private and Vary: * are noncacheable, and an unconditional 304 is rejected.
  • Persist oauthClient.clientDiscoveryId as nullable discovery provenance. Discovery IDs are globally unique, and an owned client fails closed when its matching discovery is unavailable. Only that discovery may refresh the client or provide transport for its metadata-owned resources, so managed and DCR HTTPS client IDs cannot be taken over.
  • Preserve custom model names, resource links, and administrator-controlled client flags when clients are created or refreshed. Refresh notifications now receive previousClient.

  OAuth Provider also exposes clientDiscovery for custom verified client-resolution plugins. A discovery may provide fetchClientMetadataResource, and its stable id is persisted as client provenance.

  Prerelease adopters must rename createCimdResolver or cimdClientDiscovery to createCimdClientDiscovery, ClientIdMetadataDocumentResult to CimdMetadataValidationResult, ValidateCimdMetadataOptions to CimdMetadataValidationOptions, isUrlClientId to isCimdClientIdUrlCandidate, and MetadataDocumentFetch to ClientMetadataResourceFetch. Rename refreshRate to metadataRevalidationInterval; there is no compatibility fallback. Numeric revalidation and minimumFetchInterval values are seconds.

  Lifecycle callbacks now receive named CimdClientCreatedEvent and CimdClientRefreshedEvent values. Read validated metadata from clientMetadataDocument instead of metadata, and the endpoint context from context instead of ctx. CimdOptions is now required because fetchClientMetadataResource is mandatory. Remove the prerelease allowFetch, fetchMetadataDocument, and allowLoopback options.

  When adopting CIMD, remove allowUnauthenticatedClientRegistration unless the authorization server deliberately supports Dynamic Client Registration as a separate fallback.

• #107466782647 Thanks @​gustavovalverde! - OAuth device grants now use oauthDeviceAuthorization() alongside oauthProvider() or mcp(). This single integration replaces both the standalone deviceCodeGrant() plugin and the shared-grant configuration. Standalone Device Authorization no longer accepts or stores RFC 8707 resources, and onDeviceAuthRequest receives only clientId and scope. The OAuth integration rejects resource indicators that are not absolute, fragment-free URIs.

  The OAuth integration replaces the optional resource column with oauthClientId and resources. Regenerate and apply the schema when using it. Before upgrading from an earlier 1.7 prerelease, let pending OAuth device codes expire or delete them because they cannot be exchanged through the new integration.

• #10156e3125e8 Thanks @​gustavovalverde! - The OIDC provider now honors the claims.userinfo authorization request parameter. A client can ask for individual standard claims, and the UserInfo endpoint returns the ones it can supply in addition to the scope-granted claims. The requested claims become part of the user's consent, and claims_parameter_supported is advertised in discovery.

  Authorization requests that use the claims parameter without requesting the openid scope are rejected.

... (truncated)

Commits

• ccd57c2 docs(changelog): align v1.7 release notes with final behavior (#10846)
• f577ec5 chore: exit pre-release mode for v1.7.0
• 69258d1 chore: sync main to next
• e84ec5e chore: release v1.6.30 (#10840)
• bc93b27 chore: release v1.7.0-rc.6 (#10772)
• 58c49eb chore: release v1.6.29 (#10809)
• 14975fb chore: sync main to next
• f451d1c fix(oauth-provider): complete RP-initiated logout flow (#10812)
• 801968e fix(oauth-provider): accept issuer audience for client assertions (#10811)
• 80799e6 chore: sync main to next
• Additional commits viewable in compare view

[Medformatik]

Superseded by #274, which upgrades the complete Better Auth package family to 1.7.1 and includes the required schema migration and application API changes.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[dependabot]

Bumps @better-auth/oauth-provider from 1.6.26 to 1.7.0.

Release notes

Sourced from @​better-auth/oauth-provider's releases.

v1.7.0

Blog post:Better Auth 1.7

better-auth

❗ Breaking Changes

• Moved database joins out of experimental into the stable advanced.database.joins option (#10359)

  Migration: Replace experimental: { joins: true } with advanced: { database: { joins: true } }. Drizzle and Prisma users should regenerate their schema (npx auth@latest generate) so it includes the required relations.

• Scoped account identity by trusted issuer, keying accounts on (issuer, accountId) (#10403)

  Migration: Accounts now require Account.issuer. Read provider identity from accountInfo.account.accountId, drop mapping.id from SSO configs, and give the microsoftEntraId helper a concrete tenant GUID. Apply the account-identity backfill in the 1.7 upgrade guide before deploying.

• Required captcha endpoint entries to match full auth paths, with wildcard support (#10004)

  Migration: Replace partial paths such as /sign-in with explicit wildcards like /sign-in/* or /sign-in/**.

• Moved the MCP plugin into its own @better-auth/mcp package built on the OAuth provider (#9992)

  Migration: Install @better-auth/mcp and @better-auth/cimd, add the now-required jwt() plugin, and move options nested under oidcConfig to flat mcp({ ... }) options. Rename withMcpAuth to requireMcpAuth and mcpHandler to createMcpProtectedRequestHandler. Regenerate the schema (npx auth migrate): oauthApplication becomes oauthClient, plus new oauthRefreshToken and oauthClientAssertion tables.

• Added OIDC back-channel logout so ending a session cuts off every connected app's API access (#9304)

  Migration: Introspecting an access token whose session has ended now returns { active: false }, and /oauth2/userinfo rejects it. Clients opt into notifications by registering backchannel_logout_uri. Run the schema migration for the new oauthClient and oauthAccessToken columns.

• Modeled OAuth protected resources explicitly, with per-resource TTLs, scopes, claims, and signing pins (#9648)

  Migration:validAudiences is removed: move each resource identifier into resources and link restricted clients through oauthClientResource. @better-auth/mcp now requires an explicit resource. Run npx @better-auth/cli generate and apply the migration before deploying.

• Decoupled SCIM provisioning from the organization plugin (#10390)

  Migration: SCIM configuration, client APIs, database schema, and the Group model are all replaced, and provisioning state cannot migrate in place. Follow the SCIM cutover in the 1.7 upgrade guide, including a full directory reprovision, before resuming traffic.

• Added OTP-only two-factor enablement with a discriminated enableTwoFactor response (#9057)

  Migration:enableTwoFactor now returns a method field ("otp" or "totp"); narrow on it before reading totpURI and backupCodes. Pass method: "otp" for OTP enrollment, which requires otpOptions.sendOTP.

• Resolved the auth origin from Host by default when using a dynamic baseURL (#9134)

  Migration: If your proxy exposes the public hostname only through x-forwarded-host, set advanced.trustedProxyHeaders: true. Deployments where the proxy rewrites Host (nginx default, Vercel, Cloudflare, Netlify) are unaffected.

• Added unique lookup indexes for the device authorization deviceCode and userCode columns (#10059)

  Migration: Resolve duplicate code values before applying the migration. MySQL and SQL Server installations must also convert both columns to bounded strings and clean up values longer than 191 characters.

• Enforced S256 PKCE in the Electron sign-in flow and hardened custom-scheme origin checks (#9645)

  Migration: Upgrade the @better-auth/electron client and server together and add your app's scheme to trustedOrigins. The code_challenge_method parameter and disableOriginOverride option are removed, and host-bearing custom-scheme entries now match that host exactly.

• Identified Microsoft Entra accounts by the stable oid claim (#10204)

  Migration: Migrate existing Microsoft account rows created from sub before upgrading. Tokens without a valid oid are rejected.

• Required a Google client ID before Google One Tap verifies ID tokens (#10036)

  Migration: Configure oneTap({ clientId }) or socialProviders.google.clientId.

• Removed the deprecated oidcProvider plugin (#10031)

  Migration: Move OIDC authorization-server integrations to @better-auth/oauth-provider.

• Rewrote the generic OAuth plugin as a first-class social provider with OAuth 2.1 defaults (#9069)

  Migration: Replace signIn.oauth2({ providerId }) with signIn.social({ provider }), oauth2.link() with linkSocial(), and drop genericOAuthClient(). Callbacks move to /api/auth/callback/:id, pkce now defaults to true, and issuer and requireIssuerValidation are removed in favor of OIDC discovery.

• Separated OAuth device grant ownership into oauthDeviceAuthorization() (#10746)

  Migration: The OAuth integration replaces the optional resource column with oauthClientId and resources, so regenerate and apply the schema. Let pending device codes expire before upgrading from an earlier 1.7 prerelease.

• Verified provider id_tokens with a single shared verifier (#9828)

  Migration: Custom UpstreamProvider implementations replace the removed verifyIdToken method with an idToken config carrying a JWKS source, issuer, and audience. PayPal client id_token sign-in now returns ID_TOKEN_NOT_SUPPORTED; its redirect flow is unchanged.

Features

• Added clientAssertion support to the Microsoft Entra ID social provider (#9898)
• Made the Auth instance directly fetchable (#9431)
• Added per-provider requireEmailVerification for social sign-in (#9929)
• Added a user.validateUserInfo gate for rejecting an identity before a user is created or linked (#9864)
• Added hydrateSession so useSession returns server-fetched data on the first render (#8733)
• Added compound table indexes to plugin database schemas (#10402)

... (truncated)

Changelog

Sourced from @​better-auth/oauth-provider's changelog.

1.7.0

Minor Changes

• #105775c45abc Thanks @​gustavovalverde! - OAuth clients now store applicationType and expose it as application_type in OAuth metadata. tokenEndpointAuthMethod alone determines authentication: "none" is public, and every other method is confidential. The legacy type and public fields are removed.

  OAuthClient no longer has a catch-all string index. Model custom wire extensions explicitly with a named intersection such as OAuthClient & YourExtensionMetadata; legacy type and public fields no longer type-check as unknown baggage.

  • Dynamic, administrative, and user-managed registrations default an omitted application_type to web. Client ID Metadata Documents preserve an omitted value as null.
  • Web redirects require HTTPS on a non-loopback host. Native redirects accept claimed HTTPS URLs, exact HTTP loopback hosts, or reverse-domain private-use schemes.
  • Registration resource options control resource links. mcp() contributes its protected resource by default, so standards-based clients no longer need a resources extension.
  • mcp() no longer enables unauthenticated Dynamic Client Registration. Compose mcp() with cimd() for Client ID Metadata Documents, or enable both DCR flags explicitly.

  This release requires a database migration. Add applicationType and nullable clientDiscoveryId; map old web and native values directly, map user-agent-based to NULL for manual reclassification, and never derive it from public. Set clientDiscoveryId only from known discovery provenance, never by inspecting an HTTPS client ID. Deduplicate existing (clientId, resourceId) links before adding the new compound unique index, then drop the legacy columns. Deployments with custom schema mappings must apply this backfill manually.

  Machine-to-machine scope authority is now stored separately in nullable oauthClient.clientCredentialsScopes. Missing, NULL, and empty values deny client_credentials token issuance. Only the administrative create and update endpoints expose client_credentials_scopes, and assigning a non-empty value requires clientPrivileges to approve the new configure-client-credentials-scopes action. DCR, CIMD, and user-managed registration cannot assign this field; CIMD refresh preserves an existing administrator-owned value. Remove clientCredentialGrantDefaultScopes, backfill every existing client to [], configure [] as the default for new rows, then explicitly assign every approved machine scope after auditing the client.

• #105775c45abc Thanks @​gustavovalverde! - Client ID Metadata Documents now follow shared-cache freshness rules and fail closed when freshness is ambiguous. The plugin prefers s-maxage over max-age and Expires, honors s-maxage=0, conditionally revalidates with ETag or Last-Modified, and treats invalid or duplicate freshness directives as immediately stale. Concurrent refreshes converge on one client-resource link instead of failing on its unique constraint.

  Shared OAuth metadata validation now rejects a blank client_name without trimming a valid display name. Native private-use redirects require the RFC 8252 single-slash form, such as com.example.app:/callback. Native HTTP redirects accept only exact localhost, 127.0.0.1, or [::1] hosts; other 127.0.0.0/8 addresses and localhost subdomains are rejected.

  CIMD now bounds metadata request amplification through metadataFetchPolicy: same-client fetches coalesce, per-client pacing and global/per-origin concurrency reject immediately, and rolling 60-second budgets cap unique-client sprays. HTTP no-store, private, and Vary: * behavior is unchanged and never feeds metadata or validators into the governor.

  Node.js deployments can import fetchClientMetadataResource from @better-auth/cimd/node. The transport resolves once, rejects any non-public DNS answer, pins the approved connection without using the global HTTPS pool, preserves Host and TLS certificate identity, and returns redirects and response bodies without buffering. Other runtimes remain responsible for providing an equivalent secure transport.

  Unknown draft-02 metadata members are now ignored and never persisted. Recognized secrets, privilege fields, and server controls remain fatal, while generic internal aliases and nonstandard client-credentials authority spellings are stripped.

• #9159cd8313b Thanks @​gustavovalverde! - Add @better-auth/cimd for Client ID Metadata Document draft-02. An exact HTTPS metadata-document URL becomes the OAuth client_id, and OAuth discovery advertises support when the plugin is installed. The explicit metadataProfile: "mcp-2026-07-28" mode applies the draft-00 metadata requirements pinned by MCP 2026-07-28.

  • Validate the complete shared OAuth client metadata schema. Generic draft-02 clients may omit client_name and redirect_uris and may use any grant supported by the OAuth Provider; the MCP profile requires client_id, client_name, and redirect_uris.
  • Reject client secrets, private JWK material, back-channel logout metadata, server-owned fields, unsafe metadata URLs, non-JSON responses, oversized documents, redirects, and private or reserved network targets. Loopback Client Identifier URLs are no longer supported.
  • Validate registered, discovered, and remotely fetched client JWKS through one public-asymmetric-key boundary. RFC 7517 JWK Sets must use { "keys": [...] }; replace the removed bare-array form jwks: [key] with jwks: { keys: [key] }. Empty, malformed, symmetric, private, and unsupported key sets fail before they can enter a provider-scoped cache. EC keys must use P-256, P-384, or P-521; OKP keys must use Ed25519. A declared alg must match the key type and curve. Existing OAuth client rows written through oauthToSchema are already normalized, so no database rewrite is required unless rows were written outside Better Auth.
  • Require fetchClientMetadataResource as the deployment-owned transport for both metadata documents and discovery-owned jwks_uri resources. It must resolve once, reject RFC 6890 special-use addresses, pin the approved address for the connection, and refuse redirects. isMetadataDocumentUrlAllowed remains available for additional application policy.
  • Cache only valid successful metadata with bounded storage, HTTP shared-cache freshness rules, ETag and Last-Modified conditional revalidation, and fail-closed refresh behavior. Cache-Control: private and Vary: * are noncacheable, and an unconditional 304 is rejected.
  • Persist oauthClient.clientDiscoveryId as nullable discovery provenance. Discovery IDs are globally unique, and an owned client fails closed when its matching discovery is unavailable. Only that discovery may refresh the client or provide transport for its metadata-owned resources, so managed and DCR HTTPS client IDs cannot be taken over.
  • Preserve custom model names, resource links, and administrator-controlled client flags when clients are created or refreshed. Refresh notifications now receive previousClient.

  OAuth Provider also exposes clientDiscovery for custom verified client-resolution plugins. A discovery may provide fetchClientMetadataResource, and its stable id is persisted as client provenance.

  Prerelease adopters must rename createCimdResolver or cimdClientDiscovery to createCimdClientDiscovery, ClientIdMetadataDocumentResult to CimdMetadataValidationResult, ValidateCimdMetadataOptions to CimdMetadataValidationOptions, isUrlClientId to isCimdClientIdUrlCandidate, and MetadataDocumentFetch to ClientMetadataResourceFetch. Rename refreshRate to metadataRevalidationInterval; there is no compatibility fallback. Numeric revalidation and minimumFetchInterval values are seconds.

  Lifecycle callbacks now receive named CimdClientCreatedEvent and CimdClientRefreshedEvent values. Read validated metadata from clientMetadataDocument instead of metadata, and the endpoint context from context instead of ctx. CimdOptions is now required because fetchClientMetadataResource is mandatory. Remove the prerelease allowFetch, fetchMetadataDocument, and allowLoopback options.

  When adopting CIMD, remove allowUnauthenticatedClientRegistration unless the authorization server deliberately supports Dynamic Client Registration as a separate fallback.

• #107466782647 Thanks @​gustavovalverde! - OAuth device grants now use oauthDeviceAuthorization() alongside oauthProvider() or mcp(). This single integration replaces both the standalone deviceCodeGrant() plugin and the shared-grant configuration. Standalone Device Authorization no longer accepts or stores RFC 8707 resources, and onDeviceAuthRequest receives only clientId and scope. The OAuth integration rejects resource indicators that are not absolute, fragment-free URIs.

  The OAuth integration replaces the optional resource column with oauthClientId and resources. Regenerate and apply the schema when using it. Before upgrading from an earlier 1.7 prerelease, let pending OAuth device codes expire or delete them because they cannot be exchanged through the new integration.

• #10156e3125e8 Thanks @​gustavovalverde! - The OIDC provider now honors the claims.userinfo authorization request parameter. A client can ask for individual standard claims, and the UserInfo endpoint returns the ones it can supply in addition to the scope-granted claims. The requested claims become part of the user's consent, and claims_parameter_supported is advertised in discovery.

  Authorization requests that use the claims parameter without requesting the openid scope are rejected.

... (truncated)

Commits

• ccd57c2 docs(changelog): align v1.7 release notes with final behavior (#10846)
• f577ec5 chore: exit pre-release mode for v1.7.0
• 69258d1 chore: sync main to next
• e84ec5e chore: release v1.6.30 (#10840)
• bc93b27 chore: release v1.7.0-rc.6 (#10772)
• 58c49eb chore: release v1.6.29 (#10809)
• 14975fb chore: sync main to next
• f451d1c fix(oauth-provider): complete RP-initiated logout flow (#10812)
• 801968e fix(oauth-provider): accept issuer audience for client assertions (#10811)
• 80799e6 chore: sync main to next
• Additional commits viewable in compare view

[Medformatik]

Superseded by #274, which upgrades the complete Better Auth package family to 1.7.1 and includes the required schema migration and application API changes.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.