v1.8.0-beta.0 Release

better-auth

❗ Breaking Changes

• Changed the custom DeviceAuthorizationGrant interface for device-code approval (#11610)

Migration: Rename assertSessionRedemption to assertStandaloneUse, handle its new use argument, and remove uses of getVerificationContext, verificationOpenAPIProperties, and the interface's second type parameter.

• Fixed sign-up emails and OAuth session caching to run after database work completes (#11751)

Migration: Use a databaseHooks.user.create.before hook to reject sign-ups instead of throwing from sendVerificationEmail or onExistingUserSignUp, and account for logged cache-write failures no longer failing applicable sign-ins.

• Fixed concurrent device-code decisions so only the first approval or denial takes effect (#11772)

Migration: Replace checks for device_code_already_processed in /device/approve error types with checks for invalid_request.

• Fixed device-token polling to report expired_token immediately after a code expires (#11772)

Migration: Handle expired_token on the first poll after expiry rather than expecting an initial slow_down response.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

❗ Breaking Changes

• Moved OAuth device-code approval into the provider's sign-in and consent flow (#11610)

Migration: Update OAuth device verification pages to send users to /oauth2/authorize?user_code=<code> instead of approving codes through /device/approve or /device/deny, and apply the new deviceCode columns before deploying.

• Stopped recording consent for empty OAuth scopes (#11610)

Migration: Stop relying on consent records for the empty scope value; omit empty entries from requested and accepted scopes.

• Added interactionRequests for extensions that route additional approval flows through OAuth provider pages (#11610)

Migration: If your OAuth provider extension implements a custom approval flow, register it through interactionRequests and resume it through /oauth2/authorize.

• Fixed OAuth token revocation and introspection to handle unknown, mistyped, and invalid tokens consistently with RFC 7009 and RFC 7662 (#11796)

Migration: Update clients and tests for the changed revocation, introspection, userinfo, and refresh-token error responses; extension grants should use provider.requireActiveAccessToken if an unknown token must throw.

• Fixed OAuth endpoints to reject repeated form parameters and report malformed resources as invalid_target (#11746)

Migration: Send token, introspection, and revocation form parameters only once except for resource and audience, and update error handling for malformed resource values from invalid_request to invalid_target.

• Isolated pairwise sub values for newly registered native and loopback OAuth clients (#11650)

Migration: Add the sectorIdentifier column to oauthClient with npx auth@latest migrate, or generate and apply the schema with your ORM, before upgrading.

Features

• Added support for removing registered OAuth logout URIs with null (#9923)
• Added browser-based OpenID Connect front-channel logout for registered clients (#9923)
• Added OAuth token exchange for services requesting a scoped access token for another registered API (#11763)
• Added configurable acr and amr claims to OAuth ID tokens (#11787)
• Added authentication context claims to device-code ID tokens and their refreshes (#11788)
• Added extension-defined client registration fields with validation at registration and update (#11767)

Bug Fixes

• Fixed client metadata document registration when at least one declared grant is supported (#10731)
• Fixed device and CIBA polling so an invalid DPoP proof does not consume an approved request (#11826)

For detailed changes, see CHANGELOG

@better-auth/ciba ✨

Features

• Added CIBA support for user-approved backchannel authentication with polling or ping delivery (#11785)
• Added auth.api.completeCibaRequest so apps can approve or deny CIBA requests from server code (#11812)

Bug Fixes

• Fixed device and CIBA polling so an invalid DPoP proof does not consume an approved request (#11826)

For detailed changes, see CHANGELOG

@better-auth/cimd

Features

• Added validation and storage for extension-defined fields in client metadata documents (#11767)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@erikpr1994, @gustavovalverde, @shiminshen

Full changelog: v1.7.10...v1.8.0-beta.0