All of the changes made will be available here.

Jan 15, 2026

v1.4.13

Jan 15, 2026

🚀 Features

---

• core: Add version in AuthContext –
• integrations: Support both react and solid flavors of tanstack-start –
• mcp: Add setup_auth tool –
• organization: Allow rejecting expired invites and filter pending invitations –
• scim: Add Microsoft Entra ID SCIM Compatibility –

🐞 Bug Fixes

---

• Should return dates for expiration fields –
• Preserve attributes when expiring cookies –
• expo: Fix cookie-based OAuth state with expo-authorization-proxy –
• organization: Infer endpoints when dynamic ac and teams enabled –
• stripe: Add generic return type to getSchema for proper field inference –

    View changes on GitHub

Jan 13, 2026

v1.4.12

Jan 13, 2026

🚀 Features

---

• oauth: Add custom authorizationEndpoint option –

🐞 Bug Fixes

---

• anonymous: Define delete-anonymous-user path method –
• client: Add refetch to useSession for all clients –
• core: Remove dual module warning –
• session: Prevent duplicate tokens in active sessions list –

    View changes on GitHub

Jan 12, 2026

v1.4.11

Jan 12, 2026

🚀 Features

---

• Add auth.api.verifyPassword –
• anonymous: Delete anonymous user endpoint –
• generic-oauth: Add Gumroad login support –
• saml: Reject SAML responses containing multiple assertions –
• stripe: Enhance stripe plugin with organization customer support –

🐞 Bug Fixes

---

• Filter null values from dynamic trusted origins –
• Call hooks on change-email-verification flow –
• Clean up expired rate-limit entries on memory storage –
• Set Location header on redirected responses –
• anonymous:
  • Prevent Convex cleanup from deleting fresh sessions –
• api-key:
  • Remove strict length pre-check in verifyApiKey –
  • Remove double stringify/parse of metadata field –
  • Log key verification errors –
• core:
  • Detect dual module error –
  • Separate CSRF and origin checks –
• docs:
  • Correct tos and policy types in oauth-provider –
• email-otp:
  • Call afterEmailVerification hook on verification –
• email-verification:
  • Sending email verification of another user fails with EMAIL_ALREADY_VERIFIED –
• mcp:
  • Restore ctx.query from cookie in OAuth flow –
• one-tap:
  • Respect user dismiss actions in prompt retry logic –
• open-api:
  • Correctly infer type for ZodDefault fields –
• organization:
  • Use opts pattern to enable hook injection –
• passkey:
  • Add error logs during client verification error –
• prisma-adapter:
  • Lift eq AND conditions to root so update detects unique where field –
• stripe:
  • Improve error handling and subscriptionSuccess route –
  • Pass metadata to subscription object in upgrade method –
  • Prevent duplicate subscription creation when a subscription already exists –
• two-factor:
  • Prisma issue –
  • Add missing POST endpoints to client pathMethods –

    View changes on GitHub

Dec 31, 2025

v1.4.10

Dec 31, 2025

🚀 Features

---

• Support form data for email sign-in/sign-up and fallback to checking fetch Metadata for first login –
• expo:
  • Add webBrowserOptions to openAuthSessionAsync –
• saml:
  • Add XML parser hardening with configurable size limits –
• stripe:
  • Flexible subscription cancellation and termination management –
  • Handle customer.subscription.created webhook event –
  • Add disableRedirect option for subscription and billing –

🐞 Bug Fixes

---

• Correct accountLinking default to true –
• Add supportsArrays to memory and mongodb adapters –
• Sync updateSession changes to secondary storage and active-sessions list –
• admin:
  • Custom role type inference –
  • UserId check in /has-permission –
• anonymous:
  • Missing path breaks anonymous hooks –
• api:
  • Chain plugin onRequest hooks properly –
• client:
  • Prevent duplicate signal processing in atom listeners –
  • Apply rate limit focus refetch regardless of session state –
• expo:
  • Improve parseSetCookieHeader –
• oauth-provider:
  • Support jwksPath –
  • Only session db store currently supported –
• oauth-proxy:
  • Point provider requests to production and fix cookie handling in non-HTTPS environments –
• organization:
  • Remove unnecessary type re-export –
• passkey:
  • Use data.id instead of challengeId in deleteVerificationValue –
• stripe:
  • Add 'subscription/restore' to pathMethods –
  • Prevent trial abuse by checking all user subscriptions –

    View changes on GitHub

Dec 23, 2025

v1.4.9

Dec 23, 2025

🚀 Features

---

• Add ctx.isTrustedDomain helper –
• Drizzle pg supports JSON –
• Add Refresh Token Support to Kick OAuth Provider –
• Add additionalFields option in verification table schema –
• Add patreon social provider –
• Add a global backgroundTasks config option to defer actions like sending email and updates to run after response is sent –
• admin:
  • Prevent impersonating admins by default [breaking] –
  • Add support role with permissions for user updates and enforce role change validation –
• expo:
  • Last-login-method client plugin –
• multi-session:
  • Allow to infer additional fields –
  • Allow to infer additional fields " –
• oauth-provider:
  • An oauth 2.1 compliant plugin –
• oauth-proxy:
  • Add expirty timestamp for encrypted tokens –
• one-time-token:
  • Support setting session cookie on ott verify –
• organization:
  • Allow invited users to see organization name –
• phone-number:
  • Add password length validation for reset functionality –
• saml:
  • Assertion timestamp validation with per-provider clock skew –
  • Validate SAML crypto algorithms during initial phase –
  • Enforce one-time use of SAML assertions –
  • Reject deprecated SAML signature and digest algorithms –
  • Reject deprecated SAML signature and digest algorithms –
• sso:
  • Use domain verified flag to trust providers automatically –
  • Add InResponseTo validation –
  • Add OIDC discovery –
  • Add URL normalization and validation to all discovery URLs –

🐞 Bug Fixes

---

• Add helper types to exports –
• Avoid throwing on client side –
• Export organization plugin types –
• Pathname should be normalized when basePath is set to root –
• Prematurely deleting active sessions in secondary storage –
• Make sure non-chunked session data cookie is cleared –
• Array field handling across adapters and schema generation –
• StoreStateStrategy default to database if provided –
• Should always remove 2FA verification token after successful verification –
• Prevent stateless refresh with database configured –
• Revert token masking in listSessions route –
• Compatible with openapi 3.1 –
• Properly merge updated data in account cookie –
• Preserve = padding in parsed cookies –
• Unify SSO/OAuth account linking and add domain-based org assignment to all sign-in flows –
• Respect BETTER_AUTH_TRUSTED_ORIGINS env variable –
• Delete verifications with hooks –
• Respect IP headers in dev/test environments –
• Trusted origins resolving –
• Update-user breaking during stateless auth –
• Export necessary adapter types –
• Use operator in list members where clause –
• Don't set state query param if state is not provided –
• Correct wildcard pattern matching for trustedOrigins –
• adapter:
  • Add logger creation in adapter factory –
  • Allow run internal adapter outside context –
  • Apply customTransformInput to where clause values –
• admin:
  • Clear admin session cookie on stopImpersonating –
• api-key:
  • Check metadata is enabled for api key update endpoint –
  • Prevent id update error with MongoDB adapter –
• auth:
  • Respect trustedOrigins when baseURL is inferred –
• cli:
  • secret generates empty –
  • Deduplicate drizzle schema relationships –
  • Cmd info --json unexpected exit with 1 –
  • Cmd info --json unexpected exit with 1 –
• client:
  • Set session data on refreshManager –
• cognito:
  • Use %20 encoding for scopes instead of + –
• core:
  • Allow returning null in getUserInfo in provider options –
• db:
  • Correctly unwrap validator result in schema parsing –
• deps:
  • Update dependency next to v16.0.7 [security] –
  • Update dependency @react-email/components to v1 –
• expo:
  • Add missing matcher paths –
• generic-oauth:
  • Ensure encryptOAuthTokens is respected in account linking flow –
• kysely:
  • Wrong affected row count in updateMany & deleteMany –
• line:
  • Enforce nonce –
• magic-link:
  • Handle query params in errorCallbackUrl –
• oidc:
  • Compatibility with exact-optional-property –
• openapi:
  • Mark /get-session response as nullable –
• organization:
  • Validate role existence in inviteMember endpoint –
  • Allow internal organization creation when disabled for client –
• passkey:
  • Use deleteVerificationByIdentifier instead of deleteVerificationValue –
• prisma:
  • Use findFirst instead of findMany for findOne –
• prisma-adapter:
  • Extract id to root level for delete operations –
• saml:
  • Enforce trusted provider check –
  • Remove signature validation bypass –
• sso:
  • Safely parse provider configs on registration –
  • Deprecate trustEmailVerified –
  • Enforce domain verification in assignOrganizationByDomain –
• stripe:
  • Update subscriptionId to use Stripe id –
• username:
  • Await username validator –

🏎 Performance

---

• Add index on organizations slug field –

    View changes on GitHub

Dec 14, 2025

v1.4.7

Dec 14, 2025

🚀 Features

---

• admin:
  • Add support role with permissions for user updates and enforce role change validation –
• one-time-token:
  • Support setting session cookie on ott verify –
• phone-number:
  • Add password length validation for reset functionality –
• saml:
  • Assertion timestamp validation with per-provider clock skew –
• sso:
  • Add InResponseTo validation –
  • Add OIDC discovery –
  • Add URL normalization and validation to all discovery URLs –

🐞 Bug Fixes

---

• Prevent stateless refresh with database configured –
• api-key: Check metadata is enabled for api key update endpoint –
• line: Enforce nonce –
• saml: Remove signature validation bypass –

🏎 Performance

---

• Add index on organizations slug field –

    View changes on GitHub