OAuth Provider - Schema
OAuth Provider plugin adds following tables to database: oauthClient table for storing OAuth clients.
Better Auth · Plugins · all subjects
oauth-provider/schema
5 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
oauthClient table schema
The oauthClient table stores OAuth client applications with the following fields: id (string, primary key), clientId (string, unique), clientSecret (string, optional, optional for public clients using PKCE), disabled (boolean, optional), skipConsent (boolean, optional), enableEndSession (boolean, optional), subjectType (string, optional, 'pairwise' for unique unlinkable sub claims), scopes (string[], optional), userId (string, optional, foreign key to user.id), referenceId (string, optional), createdAt (Date, optional), updatedAt (Date, optional), name (string, optional), uri (string, optional), icon (string, optional), contacts (string[], optional), tos (string, optional), policy (string, optional), softwareId (string, optional), softwareVersion (string, optional), softwareStatement (string, optional), redirectUris (string[], required), postLogoutRedirectUris (string[], optional), tokenEndpointAuthMethod (string, optional, supports 'none', 'client_secret_basic', 'client_secret_post'), grantTypes (string[], optional, supports 'authorization_code', 'client_credentials', 'refresh_token'), responseTypes (string[], optional, supports 'code'), public (boolean, optional), type (string, optional, supports 'web', 'native', 'user-agent-based'), requirePKCE (boolean, optional), metadata (json, optional).
oauthRefreshToken table schema
The oauthRefreshToken table stores refresh tokens with the following fields: id (string, primary key), token (string, hashed/encrypted refresh token), clientId (string, foreign key to oauthClient.clientId), sessionId (string, optional, foreign key to session.id with onDelete set null, ID of the session used at issuance), userId (string, foreign key to user.id), referenceId (string, optional, ID of the consented reference), scopes (string[], granted scopes), revoked (Date, optional, timestamp when revoked), authTime (Date, optional, original authentication time preserved across token rotation for correct auth_time claim per OIDC Core 1.0 Section 12.2), createdAt (Date, timestamp when created), expiresAt (Date, timestamp when expires).
oauthAccessToken table schema
The oauthAccessToken table stores access tokens with the following fields: id (string, primary key), token (string, unique, hashed/encrypted access token), clientId (string, foreign key to oauthClient.clientId), sessionId (string, optional, foreign key to session.id with onDelete set null, ID of the session used at issuance), refreshId (string, optional, foreign key to oauthRefreshToken.id, ID of the refresh associated with token), userId (string, optional, foreign key to user.id), referenceId (string, optional, ID of the consented reference), scopes (string[], array of granted scopes), createdAt (Date, timestamp when created), expiresAt (Date, timestamp when expires).
oauthConsent table schema
The oauthConsent table stores user consent records with the following fields: id (string, primary key), userId (string, foreign key to user.id, ID of user who gave consent), clientId (string, foreign key to oauthClient.clientId, ID of OAuth client), referenceId (string, optional, ID of the consented reference), scopes (string[], array of scopes consented to), createdAt (Date, timestamp when consent was given), updatedAt (Date, timestamp when consent was last updated).