Better Auth — Auth, Developer Tools product updates and releases, tracked on megachangelog.
Better Auth v1.7.7 addresses a critical Magic Link account-takeover vulnerability and multiple security issues including OAuth/SAML sign-in bugs and missing JSON headers in error responses. Magic Link requires a server upgrade with verification storage coordination, but no database migration is needed.
Better Auth v1.7.6 adds support for customizable banned user messages and Vercel BotID captcha provider for authentication. This release fixes critical bugs including React hydration mismatches, password length validation, overlapping auth query requests, model identity issues across multiple adapters, and OAuth social account linking.
This release adds database schema name support for direct PostgreSQL connections and includes multiple bug fixes across better-auth packages, including improvements to server-side logging, database migrations, index validation, and adapter initialization.
Fixed database option type inference for projects that do not use Cloudflare Workers, improving compatibility for diverse deployment environments.
Enhanced error diagnostics for Cloudflare Turnstile verification to help developers troubleshoot and resolve integration issues more effectively.
This release adds experimental OpenTelemetry instrumentation controls, Vitest 5 support for testing utilities, and fixes critical bugs including Metro bundling issues, multibyte session storage in Expo, and stale session data problems during concurrent updates.
You can now disable OpenTelemetry span creation for individual auth instances, providing more granular control over observability and tracing behavior.
Restored 1.6 account core schema to avoid disruptive backfills for existing users, added Cloudflare as a built-in social provider with PKCE support, enabled schema validation by default with clearer error messaging, and fixed numerous OAuth provider integrations and edge cases across multiple packages.
Bug fix release addressing user ban expiration handling, client type compatibility, session data validation, database migration issues, and URL validation improvements across multiple packages including core auth, OAuth provider, and database adapters.
Multiple bug fixes across core authentication, SCIM provisioning, SSO integration, CIMD caching, database adapters, and OAuth provider functionality. Bundled dependencies updated to latest compatible releases with no breaking changes to existing projects.
Better Auth 1.7 introduces significant breaking changes including account scoping by issuer, restructured MCP as a separate package with OAuth foundation, OAuth provider back-channel logout support, and configuration changes for joins and identity handling. Account-related APIs require schema regeneration and manual migration of existing account identities before deployment.
Fixed concurrent cold-start requests that could lose authentication context due to async storage race conditions, and improved SSO domain verification to require verified provider domains and prevent unauthorized organization assignment via social sign-in.
Bug fix release addressing TypeScript compatibility issues, session handling, OAuth provider token validation, logout flows, and PostgreSQL schema exports across multiple packages in the Better Auth ecosystem.
Optimized deleteSessions to run deletes in parallel instead of sequentially, improving performance when removing multiple sessions.
Fixed duplicate session requests during React Suspense retries and restored client plugin declaration compatibility for downstream TypeScript consumers across better-auth, electron, and expo packages.
Release candidate 5 for v1.7.0 includes breaking OAuth device grant refactoring, new username plugin options, bug fixes across OAuth provider and SCIM, and CLI package alignment improvements.
This release fixes duplicate session requests during Suspense retries, corrects auth endpoint types in the SCIM package for better-call alignment, and resolves CLI version mismatches with installed packages.
This release includes numerous bug fixes across authentication flows including PKCE and Apple OAuth, session handling improvements, email OTP security enhancements, and a breaking change for Better Auth Expo that switches to async secure storage to prevent iOS Keychain crashes. Also introduces a placeholder email utility and fixes performance issues in Next.js integration.
This release includes multiple bug fixes across session management, OTP authentication, JWT handling, OAuth proxy, and database operations, along with performance improvements for Next.js applications and utilities for placeholder email generation.
Release candidate with breaking changes to Microsoft account identifiers, addition of RFC 8628 device authorization grant support, RP-initiated logout for OAuth providers, and database indexing improvements. Includes bug fixes for TypeScript composition, JWT session caching deadlocks, and SCIM/SSO enhancements.
This release fixes Apple OAuth PKCE code challenge not being sent during authorization, Google One Tap incorrectly creating users when sign-up was disabled, Solid client missing $fetch and $store exposure, and internal adapter queries being routed to wrong tables when model names were remapped.
Release candidate with major refactoring of account identity scoping by issuer, database joins configuration migration, and SCIM decoupling from organizations. Multiple breaking changes require config updates and database migrations, along with numerous bug fixes and new features.
This release adds request context support to ID token verification, GDPR compliance options for login tracking, and fixes numerous bugs including session caching, type definitions, database migrations, and security issues across multiple packages.
This release adds Yandex as a supported OAuth social provider and fixes critical issues with auth migrations, row counting in database adapters, and string default value escaping in Drizzle schema generation.
Release includes Yandex OAuth provider support, fixes for row counting in D1 and postgres-js adapters, fixes for organization subscription actions in Stripe integration, and fixes for string default value escaping in Drizzle schema generation.
Major breaking changes include refactored MCP package structure, OIDC back-channel logout support for session revocation across relying parties, explicit OAuth resource modeling with stricter scoping, and enhanced two-factor authentication with OTP method selection. Database schema changes require migration via npx auth migrate.
This beta release includes numerous bug fixes across authentication modules, dependency updates for jose, nanostores, and crypto packages, and new features including Drizzle Relations v2 support and refreshTokenReuseInterval options for better token handling in OAuth and MCP providers.
24 more changes from Better Auth. Sign up to read the whole changelog.
Sign up freeGitHub or email — no card needed.