Better Auth 1.7.0 Release Candidate is ready for testing

[gustavovalverde]

The Better Auth 1.7.0 release candidate is ready.

Please test it in a development or staging project and share feedback here before we publish 1.7.0 as stable.

Links:

• Release candidate: v1.7.0-rc.1
• Release notes: https://better-auth.com/blog/1-7-rc
• Upgrade guide: https://better-auth.com/docs/guides/1-7-upgrade-guide

This discussion is the main place for 1.7.0 RC feedback. We will use it to keep release feedback in one place, track blockers, and decide what must change before the stable release.

What to test

Please test the parts of Better Auth your project uses, especially:

• OAuth and OpenID Connect provider flows
• Social login, generic OAuth, Google One Tap, and SSO
• MCP integrations
• SAML and SCIM
• Two-factor authentication, magic links, and email OTP
• Custom adapters, secondary storage, and rate-limit storage
• Apps deployed behind a proxy or custom server

What's in 1.7

We use 4 labels for the release notes and upgrade guide:

• Breaking: you may need to change code, config, data, or database schema.
• Behavior: the result may change, but most projects do not need a migration.
• New: a new feature, provider, or setup is available.
• Deprecation: an old API or package path is removed or replaced.

If a safer check changes runtime behavior, it is marked Behavior. If it needs code, config, data, or schema changes, it is marked Breaking.

Important changes

Breaking

• OAuth provider resources replace validAudiences.
• DPoP changes token verification and adds schema changes.
• Back-channel logout can revoke session-bound tokens.
• Generic OAuth now uses the social-provider path.
• Google One Tap now requires a Google client ID.
• The old oidcProvider plugin is removed.
• MCP moves to @better-auth/mcp.
• SAML config and defaults changed, and SAML now requires Node 20 or newer.
• SCIM ownership becomes permanent and needs cleanup for old personal SCIM connections.
• Forwarded proxy headers are not trusted by default.
• Two-factor account lockout adds schema fields.
• Custom adapters and storage need atomic methods.
• Captcha rules now match full paths.
• Electron login requires S256 PKCE.

Behavior

• max_age is enforced.
• Granted scopes are preserved across logins.
• Provider profile sync respects input: false.
• Google hosted-domain checks apply to One Tap.
• SSO verifies every listed domain.
• SAML validates audience, destination, and bearer recipient.
• SAML Single Logout accepts only http and https URLs.
• SCIM honors active, scopes deletes to the SCIM account, and rejects duplicate-email updates.
• Server-side OAuth requests refuse redirects.
• Magic-link and email-OTP sign-in can clear unproven credentials.
• Two-factor challenges cap wrong codes.

New

• Refresh-token retries for native and public clients.
• OAuth provider extension surface.
• Client ID Metadata Documents.
• Self-service registration for machine clients.
• Per-request login options for providers.
• Certificate and signed-assertion login.
• SCIM groups.
• OpenID SSO on Cloudflare Workers.
• Public-key session verification, hydrateSession, i18n, and create-admin.

How to share feedback

Please reply here with:

• Better Auth version
• Runtime: Node, Bun, Deno, Cloudflare Workers, or another runtime
• Framework
• Database adapter
• Plugins you use
• The flow you tested
• What broke, what was unclear, or what blocked the upgrade

If the issue is a bug, a small reproduction is the most useful thing you can share. If you open a GitHub issue, please link to it here as well.

If you found a security issue, please do not post the details publicly in this discussion. Use the project’s private security reporting path instead.

Thank you for testing the release candidate and helping us make this feature release stable.

[codler]

How to use hydrateSession? Seems useSession still make a request. Im using 1.7.0-rc.5

[jlian]

Tested 1.7.0-rc.4 on Cloudflare Workers with D1/Kysely, React/Vite, and the anonymous, bearer, passkey, GitHub, Apple, and Google flows.

The new passkey registration hooks worked well for us. With registration.requireSession: false, sessionless signup works 🥳. Existing anonymous session resolves to the same user and can be upgraded inside afterVerification. With createSession, user/passkey/session persistence is transactional, and a cancelled ceremony leaves no rows behind. This is much better for passkeys-first sign up and we no longer need to do the old anonymous user workaround. Thank you!

Not sure if this is a bug. The anonymous plugin's after-hook matcher includes /passkey/verify-authentication, but not /passkey/verify-registration. That means onLinkAccount and anonymous cleanup never run when passkey registration creates the new session. Is this by design? Would it make sense to add /passkey/verify-registration to that matcher?

A few API/documentation details we noticed:

• In afterVerification({ ctx, context, ... }), context is the opaque caller-provided context string. The adapter is at ctx.context.internalAdapter.
• afterVerification also runs for ordinary add-passkey ceremonies on registered accounts, so custom upgrade logic must explicitly check session.user.isAnonymous.
• Native verify-registration with createSession returns the session/user plus set-auth-token, which worked well. Anonymous sign-in does not include expiresAt, so we need a follow-up get-session to restore authoritative expiry. Is that intentional?

And lastly, is there any estimate on when 1.7 will release?