Better Auth release notes, breaking changes, and upgrade notes.
The most comprehensive authentication framework for TypeScript StackPulse turns upstream changelogs into scannable summaries with risky changes, deprecations, migration notes, and source links.
This release introduces breaking changes to the OAuth device grant implementation, requiring migration to `oauthDeviceAuthorization()`. It also adds new features like disabling `displayName` and removes the `silenceWarnings` option.
affected
Users relying on the OAuth device grant functionality are affected by the breaking change.
action
Follow the migration steps to update your OAuth device grant implementation before upgrading.
release_signals
-Refactored OAuth device grant ownership to use `oauthDeviceAuthorization()` alongside `oauthProvider()` or `mcp()`. Migration requires replacing `deviceCodeGrant()` with `oauthDeviceAuthorization()` and updating the schema.
+Added option to disable `displayName` in the username plugin.
+Removed the `silenceWarnings` config option and startup warnings for well-known metadata endpoints.
migration_steps3 steps
01Replace `deviceCodeGrant()` with `oauthDeviceAuthorization()` alongside `oauthProvider()` or `mcp()`.
02Regenerate and apply the schema (`resource` column is replaced by `oauthClientId` and `resources`).
03Let any pending device codes expire or delete them before upgrading, as they cannot be exchanged through the new integration.
This release primarily focuses on bug fixes, including resolving duplicate session requests during Suspense retries and aligning CLI versions with installed packages.
affected
Users experiencing duplicate session requests or CLI version mismatches may be affected.
action
Update to v1.6.27 to resolve duplicate session requests and CLI version alignment issues.
This release introduces a new placeholder email utility and fixes numerous bugs across multiple packages. The most significant change is the switch to async secure storage access in `@better-auth/expo`, which requires migration steps for custom storage implementations.
affected
Users of `@better-auth/expo` need to update their storage implementations to handle async operations.
action
Update custom storage implementations in `@better-auth/expo` to handle async operations as described in the migration note.
release_signals
-Switched to async secure storage access in `@better-auth/expo` - `getCookie()` now returns a Promise and custom storage implementations must provide both sync and async `SecureStore` methods.
v1.6.26mediumfeatureAug 4, 2026
v1.6.26
This release primarily focuses on bug fixes, including improvements to session cleanup, OTP verification, and Redis storage operations. A new feature was added for creating stable, namespaced placeholder emails.
affected
Users relying on session cleanup, OTP verification, or Redis storage operations may be affected by bug fixes.
action
Update to v1.6.26 to benefit from bug fixes and the new placeholder email utility.
release_signals
+Added a utility for creating stable, namespaced placeholder emails on the reserved `placeholder.invalid` domain
This release introduces significant breaking changes, including database migrations for Microsoft account identifiers and MCP authorization alignment. It also adds new features like RP-initiated logout support and RFC 8628 device authorization grant.
affected
Users relying on Microsoft account identifiers, MCP authorization, or device authorization flows are affected.
action
Perform the necessary database migrations and updates as outlined in the release notes.
release_signals
-Added database indexes for device and user code lookups in the device authorization flow
-Changed Microsoft and `microsoftEntraId` accounts to use the stable `oid` claim as the account identifier instead of `sub`
v1.6.25mediumfeatureJul 23, 2026
v1.6.25
This release focuses on bug fixes, particularly addressing issues with Apple OAuth, Google One Tap, and internal adapter queries. It also resolves exposure issues with `$fetch` and `$store` on the Solid client.
affected
Users experiencing issues with Apple OAuth, Google One Tap, or Solid client functionality are affected.
This release introduces significant breaking changes, including the renaming of `Account.accountId` to `Account.providerAccountId` and the decoupling of SCIM provisioning from the organization plugin. New features include the addition of `ctx` to `verifyIdToken` and compound table indexes.
affected
Users relying on `Account.accountId`, SCIM provisioning, or experimental joins will be affected.
action
Review and apply the migration steps outlined in the Better Auth 1.7 upgrade guide.
release_signals
-Move joins to `advanced.database.joins`
-Rename `Account.accountId` to `Account.providerAccountId` and require `Account.issuer`
v1.6.24highfeaturesecurityJul 22, 2026
v1.6.24
This release introduces new features like request context support in `verifyIdToken` and GDPR compliance enhancements. It also includes numerous bug fixes across various packages, improving reliability and security.
affected
Developers using `verifyIdToken` or needing GDPR compliance for cookies are directly affected.
action
Update to v1.6.24 to benefit from new features and security fixes.
release_signals
!Fixed magic-link and email-OTP send endpoints to validate the `Origin` header on cookieless requests, preventing cross-origin abuse
!Fixed remote MCP auth 401 challenge headers being hidden from browser clients due to missing CORS exposure
+
v1.7.0-rc.1mediumfeatureprereleaseJul 2, 2026
v1.7.0-rc.1
This release candidate introduces Yandex as a new OAuth social provider and includes several bug fixes related to migration processes and Drizzle schema generation.
affected
Users implementing OAuth with Yandex or those migrating databases with required or unique columns are affected.
action
Update to this release candidate to benefit from the new features and fixes.
release_signals
+Added Yandex as a supported OAuth social provider
This release introduces significant breaking changes for CAPTCHA, MCP, OAuth provider, and two-factor authentication. Key updates include OIDC back-channel logout support, explicit modeling of protected resources, and PKCE enforcement.
affected
All users of MCP, OAuth provider, two-factor auth, and Electron integration are affected by breaking changes.
action
Review breaking changes carefully and follow migration steps before upgrading.
release_signals
-Renamed MCP route helper from `withMcpAuth` to `requireMcpAuth` and remote client from `createMcpAuthClient` to `createMcpResourceClient`
v1.7.0-beta.10mediumfeatureprereleaseJun 26, 2026
v1.7.0-beta.10
This release focuses on bug fixes and minor improvements across multiple packages, including fixes for rate limiting, OAuth state validation, and TypeScript inference errors. It also introduces a new `refreshTokenReuseInterval` option for OAuth provider and MCP packages.
affected
Developers using `better-auth` and its associated packages may benefit from bug fixes and new features, particularly those working with OAuth and Drizzle integrations.
action
Update to the latest beta version to take advantage of bug fixes and new features.
release_signals
+Added support for Drizzle Relations v2 via a new `@better-auth/drizzle-adapter/relations-v2` entry point.
+Added a `refreshTokenReuseInterval` option, defaulting to 30 seconds, for native/public clients to retry refresh token requests.
Users relying on magic link/email OTP sign-in, OAuth redirects, SCIM operations, Stripe organization subscriptions, or 2FA verification may be affected by fixes in this release.
action
Update to benefit from critical bug fixes related to authentication flows and subscription management.
This release focuses on bug fixes across multiple packages, including improvements to rate limits, session handling, OAuth validation, and security enhancements.
affected
Users relying on OAuth, SSO, or IP resolution features may be affected by these fixes.
action
Update to v1.6.21 to benefit from the latest bug fixes and security improvements.
release_signals
!Fixed client IP resolution to prevent `X-Forwarded-For` spoofing in multi-hop proxy chains
!Fixed SAML single logout to reject IdP SLO POST URLs that use non-http(s) schemes such as `javascript:` or `data:`
This release focuses on bug fixes, including improvements to account-linking logs, TypeScript inference errors, refresh cookie `Max-Age` behavior, and i18n fallback logic.
affected
Developers using `better-auth` and `@better-auth/i18n` may benefit from the bug fixes and improved TypeScript support.
action
Update to v1.6.20 to benefit from the bug fixes and improvements.
Beta release with breaking auth claim restrictions, new DCR and UserInfo features, and numerous OIDC bug fixes.
affected
Applications overriding standard OIDC claims in customIdTokenClaims will need migrations.
action
Audit custom claim usage and migrate protected claims to namespaced alternatives.
release_signals
-Restricted customIdTokenClaims, extension ID-token claims, and per-issuance idTokenClaims from overriding protected OIDC/JWT protocol claims
+Added support for confidential DCR clients to complete authorization-code flows without PKCE when clientRegistrationRequirePKCE: false is set
v1.7.0-beta.8mediumfeatureprereleaseJun 18, 2026
v1.7.0-beta.8
This release focuses on bug fixes for OAuth flows, including account creation rollbacks, redirect URI derivation, and scope preservation. It also introduces a new feature for the Google provider to control scope accumulation.
affected
Users relying on OAuth flows or multi-host deployments are affected by these fixes.
action
Update to ensure proper handling of OAuth scope persistence and redirect URIs.
release_signals
+Added includeGrantedScopes option to the Google provider to control scope accumulation across OAuth flows
This release introduces breaking changes to auth endpoint matching, OAuth protected resource modeling, and client authentication. It also adds new features like popup-based OAuth sign-in and DPoP token support.
affected
Users relying on partial path matching in captcha plugin, OAuth audience validation, or dynamic baseURL resolution will need to update their configurations.
action
Follow the detailed migration steps provided in the release notes for each breaking change.
release_signals
-Added wildcard endpoint matching to the captcha plugin, requiring full auth path matches instead of partial prefix matching
v1.6.19mediumfeatureJun 16, 2026
v1.6.19
Maintenance release focusing on bug fixes across multiple packages including device authorization, session cookies, and database adapters.
affected
Users may need to update their cookie handling if they were relying on silent drops near size limits.
action
Review cookie handling changes if your implementation deals with large session cookies.
release_signals
+Added support for pre-binding device codes to a specific user in the device authorization plugin
Added a placeholder email utility for generating temporary email addresses
migration_steps1 steps
01Update custom storage implementations in `@better-auth/expo` to provide both sync and async `SecureStore` methods and use `setItemAsync()` for awaited writes.
Moved the MCP plugin into its own package, @better-auth/mcp
-Introduced explicit OAuth protected resource modeling, replacing validAudiences with a resource-first configuration API
-Changed dynamic baseURL resolution to ignore x-forwarded-host by default
-Required a Google client ID to be configured for One Tap ID token audience validation
!Removed the deprecated oidcProvider plugin from better-auth/plugins
+Added support for pre-binding device codes to a specific user during the device authorization flow
+Added a popup-based OAuth sign-in flow as an alternative to full-page redirects
+Added DPoP (RFC 9449) sender-constrained access token support to the OAuth provider
+Enforced Cache-Control: no-store on all OAuth credential responses to prevent caching
+Added auth.api.consumePhoneNumberOTP for verifying and consuming phone OTP codes server-side
migration_steps5 steps
01Replace partial endpoint paths like /sign-in with explicit wildcards such as /sign-in/* or /sign-in/** in your captcha plugin configuration
02Install @better-auth/mcp, add the jwt() plugin, update imports from better-auth/plugins to @better-auth/mcp, rename withMcpAuth to requireMcpAuth and createMcpAuthClient to createMcpResourceClient
03Run npx auth migrate to apply schema changes (oauthApplication becomes oauthClient, with new oauthRefreshToken and oauthClientAssertion tables)
04Replace validAudiences with resources, link clients through oauthClientResource, then run npx @better-auth/cli generate and apply the migration to add oauthResource, oauthClientResource, and new jwks columns before deploying
05Configure oneTap({ clientId: 'your-google-client-id' }) or set socialProviders.google.clientId in your Better Auth config