new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

Better Auth · all subjects

authentication methods

14 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Built-in authentication methods

Better Auth provides built-in support for email and password authentication, and social providers including Google, GitHub, Apple, and more.

Client-side authentication requirement

Always invoke client methods from the client side. Do not call them from the server.

Sign out user method

Call authClient.signOut() to sign out a user. Optionally pass fetchOptions with onSuccess callback to redirect after sign out.

IdP-initiated SAML off by default in 1.7

Unsolicited logins started by the identity provider are now disabled by default. A login response is validated for `InResponseTo`, so it cannot be replayed against a request it was not issued for, and Single Logout requests are matched to their session by `SessionIndex`. Set `saml.allowIdpInitiated: true` to restore the old behavior.

SAML certificates can be a list in 1.7

Signing certificates now accept a single value or a list, which lets you rotate certificates without downtime. The management endpoints return the certificate as a list, or omit it when the certificates live inside an `idpMetadata` document. Update any code that reads the certificate from those endpoints to expect a list or its absence.

SAML configuration simplified in 1.7

The callback URL is derived automatically and service-provider metadata is generated for you. Remove the empty `spMetadata` and removed fields from the config. Register the ACS URL with the IdP as the base URL plus `/sso/saml2/sp/acs/:providerId`; with the default base path that is `https://yourapp.com/api/auth/sso/saml2/sp/acs/:providerId`. For SP-initiated logins, set the post-login redirect with `callbackURL` in `signIn.sso()`. The `callbackUrl` config field is optional but used as the post-login redirect for IdP-initiated logins, so keep it if you enable `allowIdpInitiated`. Error codes in the redirect change from short aliases to the full lowercased internal code, for example `saml_multiple_assertions`.

SCIM writes are safer in 1.7

SCIM user writes now honor the `active` attribute, and non-organization SCIM deletes only remove the global user when the SCIM account is their only identity. `PUT` and `PATCH` reject changing a user's email to one already used by another user. For an organization-scoped connection, `active: false` removes the user from that organization and revokes sessions only when it was their last membership. For an app-level static provider, it deactivates the global user through the admin plugin. Handle `409` conflicts if SCIM clients change emails.

SCIM connections scoped to organization in 1.7

SCIM connections now require `organizationId`, add a `providerKey` column, and drop the old `userId` column. The `defaultSCIM` option becomes `staticProviders` and `trustedDomains` is removed. Provider IDs are namespaced per organization and every connection is bound to an organization. Domain-based auto-linking now goes through `linkExistingUsers`, configured with `requireExistingOrgMembership`, a `shouldLinkUser` callback, or `true`. Rename `defaultSCIM` config to `staticProviders`.

SCIM gains durable group resources in 1.7

SCIM now manages groups with membership, roles, and lifecycle endpoints, backed by new `scimGroup`, `scimGroupMember`, `scimGroupRole`, and `scimGroupRoleGrant` tables. Run `generate` and `migrate` to add the SCIM group tables before using group provisioning.

Two-factor `enableTwoFactor` returns discriminated response

`enableTwoFactor` now accepts a `method` of `"otp"` or `"totp"` (default `"totp"`) and returns that method in the response. `totpURI` and backup codes are present only for `"totp"`. Update callers that read `totpURI` or backup codes to branch on the returned `method`.

Magic-link and email-OTP sign-in clear unproven linked accounts

Magic-link and email-OTP sign-in treat proven mailbox control as the source of truth for an account whose email had never been confirmed. Clearing an unproven password and revoking sessions already happened before; 1.7 broadens the cleanup to remove every account linked to that unconfirmed identity, including OAuth and social links, before signing the user in. If a user signed up but never confirmed their email, then first signs in through a magic link or email OTP, expect their prior password and any social links to be gone.

Client-side sign out

Client-side sign out with Better Auth uses authClient.signOut(). The method returns an object with data and error properties.

Server-side sign out

Server-side sign out with Better Auth uses auth.api.signOut() method which requires headers from Next.js. The call is: await auth.api.signOut({ headers: await headers() }). The method returns an object with success property.

emailVerification option configuration

The emailVerification option configures email verification with properties: sendVerificationEmail (function to send verification email), sendOnSignUp (send verification email after sign up; true always sends, false never sends, undefined follows requireEmailVerification behavior; default: undefined), sendOnSignIn (send verification email on sign in when email is not verified; default: false), autoSignInAfterVerification (auto sign in after email verification), and expiresIn (seconds the verification token is valid for; default: 3600).

Give your agent this brain