Better Auth · Authentication · all subjects

email & password

7 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Magic link tokens are single-use with atomic consumption

Magic link verify now prevents race conditions where two concurrent requests could mint two sessions from the same token. The handler consumes the verification row atomically via internalAdapter.consumeVerificationValue. Tokens are single-use. The allowedAttempts option is retained for backward compatibility but no longer multiplies successful redemptions. Second-redeem error code changed from ATTEMPTS_EXCEEDED to INVALID_TOKEN.

Device authorization flow requires verified ownership at approval time

Pending device codes are now bound to the user at the verification page via GET /device which claims the pending row for the calling session. POST /device/approve and POST /device/deny require the calling session to match the claimed owner. Previously any authenticated user could approve or deny another user's pending code by knowing the user_code. Custom verification pages must be served to an authenticated session.

Bearer plugin session merging handles duplicate cookie names

The bearer plugin now produces a single entry per cookie name when merging its session token into the request Cookie header. Previously if the request already had a stale session cookie, the merged header could carry two entries for the same name, which would surface to downstream code that picks the first occurrence.

Email OTP sign-in excluded from default captcha settings

Email OTP sign-in no longer fails with missing-captcha-token error under default captcha settings. To intentionally require captcha on email OTP sign-in, add /sign-in/email-otp to captcha({ endpoints }).

Session cookie preference for secure over non-secure variant

getSessionCookie now prefers the __Secure- cookie when both it and a non-secure cookie are present, preventing the non-secure cookie from shadowing the current session cookie.

Expired magic-link and OAuth authorization code error codes

Expired magic-link tokens redirect to ?error=INVALID_TOKEN (was EXPIRED_TOKEN). OIDC, MCP, and @better-auth/oauth-provider /token endpoints return error_description: "invalid code" for expired codes (was "code expired"). OAuth error value stays invalid_grant.

Cookie values with special characters are percent-encoded

Cookie values containing characters outside bare cookie-octet range (semicolon, quote, backslash) are now percent-encoded into the Cookie header. Previously they were dropped on re-serialization, breaking flows storing structured values in cookies.

Give your agent this brain