better-auth 1.7.0-rc.3

v1.7.0-rc.3

on Node.js NPM

better-auth

❗ Breaking Changes

• Added database indexes for device and user code lookups in the device authorization flow (#10059)

Migration: MySQL and SQL Server users must convert device code and user code columns to bounded strings (max 191 characters) and resolve any oversized values before applying the migration.

• Changed Microsoft and microsoftEntraId accounts to use the stable oid claim as the account identifier instead of sub (#10204)

Migration: Migrate existing Microsoft account rows keyed by sub to oid before upgrading; tokens without a valid oid claim are rejected after the update.

Features

• Added RP-initiated logout support for Generic OAuth providers, redirecting users to their OpenID provider's logout endpoint on sign-out (#9368)
• Added RFC 8628 device authorization grant support to the OAuth provider, enabling device-flow token exchanges for registered OAuth clients (#10135)

Bug Fixes

• Enabled native database transactions in test instances for Postgres and MySQL databases.
• Fixed a deadlock during sign-up when JWT session caching and native transactions are both enabled on single-connection databases (#10622)
• Fixed TypeScript errors when composing One Tap, Electron, and Expo plugins with createAuthClient (#10505)

For detailed changes, see CHANGELOG

@better-auth/core

❗ Breaking Changes

• Changed Microsoft and microsoftEntraId accounts to use the stable oid claim as the account identifier instead of sub (#10204)

Migration: Migrate existing Microsoft account rows keyed by sub to oid before upgrading; tokens without a valid oid claim are rejected after the update.

Features

• Added RP-initiated logout support for Generic OAuth providers, redirecting users to their OpenID provider's logout endpoint on sign-out (#9368)

Bug Fixes

• Fixed TypeScript errors when composing One Tap, Electron, and Expo plugins with createAuthClient (#10505)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

❗ Breaking Changes

• Aligned MCP authorization with the 2026-07-28 specification, replacing legacy type/public client fields with applicationType and enforcing stricter redirect validation and scope controls (#10577)

Migration: Apply a database migration to add applicationType, nullable clientDiscoveryId, and clientCredentialsScopes columns; backfill applicationType from existing values and clientCredentialsScopes to [] for all clients; deduplicate (clientId, resourceId) pairs before applying the new unique index. Replace OAuthClient string-index accesses with OAuthClient & YourExtensionMetadata, and compose mcp() with cimd() explicitly if using Client ID Metadata Documents.

Features

• Added RFC 8628 device authorization grant support to the OAuth provider, enabling device-flow token exchanges for registered OAuth clients (#10135)

Bug Fixes

• Fixed MCP scope enforcement to return a 403 with an RFC 6750 insufficient_scope WWW-Authenticate challenge listing all missing scopes, allowing clients to request them in a single authorization request.

For detailed changes, see CHANGELOG

@better-auth/cimd

❗ Breaking Changes

• Aligned MCP authorization with the 2026-07-28 specification, replacing legacy type/public client fields with applicationType and enforcing stricter redirect validation and scope controls (#10577)

Migration: Apply a database migration to add applicationType, nullable clientDiscoveryId, and clientCredentialsScopes columns; backfill applicationType from existing values and clientCredentialsScopes to [] for all clients; deduplicate (clientId, resourceId) pairs before applying the new unique index. Replace OAuthClient string-index accesses with OAuthClient & YourExtensionMetadata, and compose mcp() with cimd() explicitly if using Client ID Metadata Documents.

Bug Fixes

• Fixed Client ID Metadata Document caching to follow shared-cache freshness rules, preferring s-maxage, honoring conditional revalidation, and treating ambiguous or duplicate freshness directives as immediately stale to prevent unique-constraint failures on concurrent refreshes.

For detailed changes, see CHANGELOG

@better-auth/mcp

❗ Breaking Changes

• Aligned MCP authorization with the 2026-07-28 specification, replacing legacy type/public client fields with applicationType and enforcing stricter redirect validation and scope controls (#10577)

Migration: Apply a database migration to add applicationType, nullable clientDiscoveryId, and clientCredentialsScopes columns; backfill applicationType from existing values and clientCredentialsScopes to [] for all clients; deduplicate (clientId, resourceId) pairs before applying the new unique index. Replace OAuthClient string-index accesses with OAuthClient & YourExtensionMetadata, and compose mcp() with cimd() explicitly if using Client ID Metadata Documents.

For detailed changes, see CHANGELOG

@better-auth/scim

Features

• Added SCIM Enterprise User extension attributes and classic user attributes with improved Microsoft Entra interoperability (#10620)
• Added a managed connection catalog for runtime SCIM tenant connection and credential management through server-only auth.api methods (#10592)

Bug Fixes

• Fixed Microsoft Entra interoperability by accepting case-insensitive string boolean values for the SCIM active field and primary sub-attributes of emails, phoneNumbers, addresses, roles, and entitlements at the HTTP ingress.
• Added managedConnections configuration to allow trusted server code to create, issue, rotate, and revoke SCIM tenant connections and bearer credentials through server-only auth.api methods without a code-defined connection.
• Fixed dynamic SCIM connection decommissioning to allow retaining a terminal connection binding by supplying the provisioning domain before the first authenticated request.

For detailed changes, see CHANGELOG

@better-auth/sso

Features

• Extended resolveUser to SAML sign-ins with a discriminated protocol field, and added guardProviderMutation to authorize SSO provider updates and deletions (#10621)

Bug Fixes

• Fixed SSO provider registration to allow reusing a SCIM connection ID, since SCIM connections no longer participate in the authentication provider namespace.
• Improved SAML security by verifying assertion signatures on the raw XML rather than a pre-parsed response, enforcing signing policy and size limits on SP metadata, and correcting wantAssertionsSigned to control assertion signing instead of response signing.

For detailed changes, see CHANGELOG

@better-auth/electron

Bug Fixes

• Fixed TypeScript errors when composing One Tap, Electron, and Expo plugins with createAuthClient (#10505)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed TypeScript errors when composing One Tap, Electron, and Expo plugins with createAuthClient (#10505)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed raw database instances (better-sqlite3, node:sqlite, bun:sqlite, mysql2, pg) passed directly as database to automatically receive native adapter transactions, matching the explicit { db }/{ dialect } config shapes and unblocking plugins like @better-auth/scim when using the quickstart configuration.

For detailed changes, see CHANGELOG

@better-auth/passkey

Features

• Added an optional createSession setting to passkey registration that signs the user in automatically on successful registration (#9873)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@brentmitchell25, @GautamBytes, @gustavovalverde

Full changelog: v1.7.0-rc.2...v1.7.0-rc.3