better-auth 1.8.0-beta.8

v1.8.0-beta.8

on Node.js NPM

Important

Action required

• If you set an Authorization entry in authorizationHeaders or pass authorization in headers to the @better-auth/core/oauth2 token request functions, remove it and set the header from customizeRequest with tokenEndpointAuth method custom, which must also set every credential the provider requires. (#12416)

• feat(oauth)!: bind client-submitted ID tokens to a server-issued nonce (#11823)

  Apps where clients sign in or link accounts with a provider ID token (for example from a native Google or Apple SDK) can now bind each token to one request. Set requireIssuedIdTokenNonce: true on a social provider. Clients then fetch a single-use nonce with authClient.idToken.nonce({ provider }), pass it to the provider's SDK, and send it with the ID token to signIn.social or linkSocial. A request without an issued nonce, or reusing one, is rejected with 400 INVALID_ID_TOKEN_NONCE. The option is off by default, and providers without it behave as before.

  One change applies to every provider that uses built-in verification: an opaque (non-JWT) token, such as a Facebook Graph access token, is now rejected when the request also sends a nonce, because the token cannot carry one. A custom verifyIdToken must compare the nonce to the token's claim itself. Opaque tokens sent without a nonce are still accepted.

  Expired verification rows are now also deleted when a single-use value, such as a magic link, an OTP, or an issued nonce, is used. Before, cleanup ran only when a value was looked up. verification.disableCleanup turns off both.

• If you call /one-tap/callback or auth.api.oneTapCallback yourself, call POST /one-tap/nonce first, pass the nonce to google.accounts.id.initialize({ nonce }), and send it as nonce in the callback body; if you set the client nonce option or a nonce in additionalOptions, remove it. (#11823)

• If you use the built-in Kysely adapter, run npx auth@latest migrate; if you use Prisma or Drizzle, run npx auth@latest generate and apply the migration before deploying, to add the expiresAt column to oauthClient. MongoDB needs no migration. (#11802)