Not all sessions are revoked when deleting a user
[Stripe Plugin] Restoring Subscription throws a 400 error
authClient.subscription.restore
, I get the following error:
```
[Better Auth]: Error restoring subscription 41 | * Specifically for errors returned from Stripe's REST API.
42 | */
43 | export class StripeError extends Error {...adminRoles Not Working
admin({ adminRoles: ['SUPER_ADMIN'] })
. However, when peforming admin actions, e.g. auth.api.listUsers()
a user who has an active session with role: 'SUPER_ADMIN'
will get the error message [Error [APIError]: You are not allowed to list users]
. However, if I change the users role to admin
they can then call listUsers()
. It seems like the adminRoles
configuration is being ignored.haveIBeenPwned plugin throws on sign in
The password you entered has been compromised. Please choose a different password.
Seems to only happen when the password is shorter than the minimum set in the config, otherwise it throws the expected invalid email or password error...Undocumented method refetch of session
refetch
method of session
(and possibly other atoms) isn't documented in the official docs and isn't recognized by TypeScript.
Example:
```typescript...customSession with cookieCache enabled not returning Set-Cookie header for session_token
Issue with Account Login Failure When Using Prisma, Expo, and genericOAuth
Organization leaving
Trying standard next.js api route for auth (from docs) and getting #405 error [Bug?]
Logs are polluted with the "No IP address found for rate limiting" message
better-auth
version (1.3.4), I noticed that my logs became polluted with the No IP address found for rate limiting
message that comes from this place in the better-auth lib.
This change was introduced 2 weeks ago by this commit alongside the docs updates on how to configure rate limiting for Cloudflare....[Organization]: Setting Active organization with slug fails.
Calling authClient.signIn.social() causes unnecessary session refetch before redirect

Using trustDevice in `verifyTotp` does not working as expected
trust_device
cookie in the browser, but when I relog I again see twoFactorRedirect
defined in the await auth.api.signInEmail
response.passkey flow cancelled, no feedback.
Module '"better-auth/plugins"' has no exported member 'siwe'.
OIDC Provider UserInfo Endpoint Broken with JWT Plugin
useJWTPlugin: true
is enabled in the OIDC provider, the /oauth2/userinfo
endpoint becomes unusable because it tries to validate JWT access tokens against the database.
1. When useJWTPlugin: true, the token endpoint still generates database-stored access tokens (not JWTs).
2. The userinfo endpoint tries to look up these tokens in the database...TS error with emailOTP plugin after upgrading to 1.3.3. Init method type incompatibility
npx @better-auth/cli generate logs weird stuff on the console when run and fails
1.3.3
and for good measure I wanted to execute the cli comman generate
and noticed that is logging some code in the terminal (added a screenshot, because it's too much text) and throws a prisma error at me.
The error makes no sense to me. It says the URL must start with "file:", but the url actually does start with file: and the error logs are even showing the line where file: is set 🤨 Has anyone else encountered this issue?
``
PrismaClientInitializationError: error: Error validating datasource
db: the URL must start with the protocol
file:`....dotenvx run -f .env --
in front of the generate command. 🤦♂️
subpath imports of zod/v4 in 1.3.x breaks prod build when conflicting packages using v4 do not
Issue with Account Overwriting When Using EXPO