Better Auth release notes, breaking changes, and upgrade notes.
The most comprehensive authentication framework for TypeScript StackPulse turns upstream changelogs into scannable summaries with risky changes, deprecations, migration notes, and source links.
This release introduces breaking changes to the OAuth device grant implementation, requiring migration to `oauthDeviceAuthorization()`. It also adds new features like disabling `displayName` and removes the `silenceWarnings` option.
affected
Users relying on the OAuth device grant functionality are affected by the breaking change.
action
Follow the migration steps to update your OAuth device grant implementation before upgrading.
release_signals
-Refactored OAuth device grant ownership to use `oauthDeviceAuthorization()` alongside `oauthProvider()` or `mcp()`. Migration requires replacing `deviceCodeGrant()` with `oauthDeviceAuthorization()` and updating the schema.
+Added option to disable `displayName` in the username plugin.
+Removed the `silenceWarnings` config option and startup warnings for well-known metadata endpoints.
migration_steps3 steps
01Replace `deviceCodeGrant()` with `oauthDeviceAuthorization()` alongside `oauthProvider()` or `mcp()`.
02Regenerate and apply the schema (`resource` column is replaced by `oauthClientId` and `resources`).
03Let any pending device codes expire or delete them before upgrading, as they cannot be exchanged through the new integration.
This release introduces a new placeholder email utility and fixes numerous bugs across multiple packages. The most significant change is the switch to async secure storage access in `@better-auth/expo`, which requires migration steps for custom storage implementations.
affected
Users of `@better-auth/expo` need to update their storage implementations to handle async operations.
action
Update custom storage implementations in `@better-auth/expo` to handle async operations as described in the migration note.
release_signals
-Switched to async secure storage access in `@better-auth/expo` - `getCookie()` now returns a Promise and custom storage implementations must provide both sync and async `SecureStore` methods.
This release introduces significant breaking changes, including database migrations for Microsoft account identifiers and MCP authorization alignment. It also adds new features like RP-initiated logout support and RFC 8628 device authorization grant.
affected
Users relying on Microsoft account identifiers, MCP authorization, or device authorization flows are affected.
action
Perform the necessary database migrations and updates as outlined in the release notes.
release_signals
-Added database indexes for device and user code lookups in the device authorization flow
-Changed Microsoft and `microsoftEntraId` accounts to use the stable `oid` claim as the account identifier instead of `sub`
This release introduces significant breaking changes, including the renaming of `Account.accountId` to `Account.providerAccountId` and the decoupling of SCIM provisioning from the organization plugin. New features include the addition of `ctx` to `verifyIdToken` and compound table indexes.
affected
Users relying on `Account.accountId`, SCIM provisioning, or experimental joins will be affected.
action
Review and apply the migration steps outlined in the Better Auth 1.7 upgrade guide.
release_signals
-Move joins to `advanced.database.joins`
-Rename `Account.accountId` to `Account.providerAccountId` and require `Account.issuer`
This release introduces significant breaking changes for CAPTCHA, MCP, OAuth provider, and two-factor authentication. Key updates include OIDC back-channel logout support, explicit modeling of protected resources, and PKCE enforcement.
affected
All users of MCP, OAuth provider, two-factor auth, and Electron integration are affected by breaking changes.
action
Review breaking changes carefully and follow migration steps before upgrading.
release_signals
-Renamed MCP route helper from `withMcpAuth` to `requireMcpAuth` and remote client from `createMcpAuthClient` to `createMcpResourceClient`
This release introduces breaking changes to auth endpoint matching, OAuth protected resource modeling, and client authentication. It also adds new features like popup-based OAuth sign-in and DPoP token support.
affected
Users relying on partial path matching in captcha plugin, OAuth audience validation, or dynamic baseURL resolution will need to update their configurations.
action
Follow the detailed migration steps provided in the release notes for each breaking change.
release_signals
-Added wildcard endpoint matching to the captcha plugin, requiring full auth path matches instead of partial prefix matching
+
Added a placeholder email utility for generating temporary email addresses
migration_steps1 steps
01Update custom storage implementations in `@better-auth/expo` to provide both sync and async `SecureStore` methods and use `setItemAsync()` for awaited writes.
Moved the MCP plugin into its own package, @better-auth/mcp
-Introduced explicit OAuth protected resource modeling, replacing validAudiences with a resource-first configuration API
-Changed dynamic baseURL resolution to ignore x-forwarded-host by default
-Required a Google client ID to be configured for One Tap ID token audience validation
!Removed the deprecated oidcProvider plugin from better-auth/plugins
+Added support for pre-binding device codes to a specific user during the device authorization flow
+Added a popup-based OAuth sign-in flow as an alternative to full-page redirects
+Added DPoP (RFC 9449) sender-constrained access token support to the OAuth provider
+Enforced Cache-Control: no-store on all OAuth credential responses to prevent caching
+Added auth.api.consumePhoneNumberOTP for verifying and consuming phone OTP codes server-side
migration_steps5 steps
01Replace partial endpoint paths like /sign-in with explicit wildcards such as /sign-in/* or /sign-in/** in your captcha plugin configuration
02Install @better-auth/mcp, add the jwt() plugin, update imports from better-auth/plugins to @better-auth/mcp, rename withMcpAuth to requireMcpAuth and createMcpAuthClient to createMcpResourceClient
03Run npx auth migrate to apply schema changes (oauthApplication becomes oauthClient, with new oauthRefreshToken and oauthClientAssertion tables)
04Replace validAudiences with resources, link clients through oauthClientResource, then run npx @better-auth/cli generate and apply the migration to add oauthResource, oauthClientResource, and new jwks columns before deploying
05Configure oneTap({ clientId: 'your-google-client-id' }) or set socialProviders.google.clientId in your Better Auth config