better_auth 0.7.0 → 0.10.0

data/lib/better_auth/plugins/dub.rb

@@ -38,6 +38,14 @@ module BetterAuth
           openapi: {
             operationId: "dubLink",
             description: "Link a Dub OAuth account",
+            requestBody: OpenAPI.json_request_body(
+              OpenAPI.object_schema(
+                {
+                  callbackURL: {type: "string", description: "The URL to redirect to after linking"},
+                  callback_url: {type: "string", description: "The URL to redirect to after linking"}
+                }
+              )
+            ),
             responses: {
               "200" => OpenAPI.json_response(
                 "Authorization URL generated successfully for linking a Dub account",

data/lib/better_auth/plugins/generic_oauth.rb

@@ -220,6 +220,7 @@ module BetterAuth
           openapi: {
             operationId: "signInOAuth2",
             description: "Sign in with OAuth2",
+            requestBody: OpenAPI.json_request_body(generic_oauth_start_body_schema),
             responses: {
               "200" => OpenAPI.json_response("Sign in with OAuth2", generic_oauth_url_response_schema)
             }
@@ -242,6 +243,7 @@ module BetterAuth
           openapi: {
             operationId: "linkOAuth2",
             description: "Link an OAuth2 account to the current user session",
+            requestBody: OpenAPI.json_request_body(generic_oauth_start_body_schema),
             responses: {
               "200" => OpenAPI.json_response("Authorization URL generated successfully for linking an OAuth2 account", generic_oauth_url_response_schema)
             }
@@ -352,6 +354,28 @@ module BetterAuth
       )
     end
 
+    def generic_oauth_start_body_schema
+      OpenAPI.object_schema(
+        {
+          providerId: {type: "string", description: "OAuth provider ID"},
+          provider_id: {type: "string", description: "OAuth provider ID"},
+          callbackURL: {type: "string", description: "URL to redirect to after success"},
+          callback_url: {type: "string", description: "URL to redirect to after success"},
+          errorCallbackURL: {type: "string", description: "URL to redirect to after error"},
+          error_callback_url: {type: "string", description: "URL to redirect to after error"},
+          newUserCallbackURL: {type: "string", description: "URL to redirect to for new users"},
+          new_user_callback_url: {type: "string", description: "URL to redirect to for new users"},
+          requestSignUp: {type: "boolean", description: "Whether this request is a sign-up flow"},
+          request_sign_up: {type: "boolean", description: "Whether this request is a sign-up flow"},
+          scopes: {type: "array", items: {type: "string"}, description: "Additional OAuth scopes"},
+          disableRedirect: {type: "boolean", description: "Return the URL instead of redirecting"},
+          disable_redirect: {type: "boolean", description: "Return the URL instead of redirecting"},
+          additionalData: {type: "object", additionalProperties: true},
+          additional_data: {type: "object", additionalProperties: true}
+        }
+      )
+    end
+
     def generic_oauth_authorization_url(ctx, provider, body, link:)
       authorization_url = provider[:authorization_url] || generic_oauth_discovery(provider)["authorization_endpoint"]
       token_url = provider[:token_url] || generic_oauth_discovery(provider)["token_endpoint"]
@@ -487,14 +511,17 @@ module BetterAuth
         if verification
           cookie = ctx.context.create_auth_cookie("state")
           cookie_state = ctx.get_signed_cookie(cookie.name, ctx.context.secret)
-          if cookie_state && cookie_state != state
+          if ctx.request && cookie_state != state
+            Cookies.expire_cookie(ctx, cookie)
+            raise ctx.redirect(generic_oauth_error_url(generic_oauth_state_error_url(ctx), "state_mismatch"))
+          elsif !ctx.request && cookie_state && cookie_state != state
             Cookies.expire_cookie(ctx, cookie)
             raise ctx.redirect(generic_oauth_error_url(generic_oauth_state_error_url(ctx), "state_mismatch"))
           end
 
           parsed = JSON.parse(verification.fetch("value"))
           ctx.context.internal_adapter.delete_verification_value(verification.fetch("id"))
-          Cookies.expire_cookie(ctx, cookie) if cookie_state
+          Cookies.expire_cookie(ctx, cookie) if ctx.request || cookie_state
           return parsed
         end
       end
@@ -521,7 +548,7 @@ module BetterAuth
       uri = URI(user_info_url)
       request = Net::HTTP::Get.new(uri)
       request["authorization"] = "Bearer #{fetch_value(tokens, "accessToken")}"
-      response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") { |http| http.request(request) }
+      response = HTTPClient.request(uri, request)
       return nil unless response.is_a?(Net::HTTPSuccess)
 
       generic_oauth_normalize_user_info(JSON.parse(response.body))
@@ -615,7 +642,7 @@ module BetterAuth
       normalize_hash(provider[:discovery_headers] || provider[:discoveryHeaders]).each do |key, value|
         request[key.to_s.tr("_", "-")] = value.to_s
       end
-      response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") { |http| http.request(request) }
+      response = HTTPClient.request(uri, request)
       provider[:_discovery] = response.is_a?(Net::HTTPSuccess) ? JSON.parse(response.body) : {}
     rescue
       {}
@@ -649,7 +676,7 @@ module BetterAuth
         form_data[key] = value unless form_data.key?(key)
       end
       request.set_form_data(form_data)
-      response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") { |http| http.request(request) }
+      response = HTTPClient.request(uri, request)
       return nil unless response.is_a?(Net::HTTPSuccess)
 
       generic_oauth_normalize_tokens(JSON.parse(response.body))
@@ -714,7 +741,7 @@ module BetterAuth
       uri = URI(url)
       request = Net::HTTP::Get.new(uri)
       normalize_hash(headers).each { |key, value| request[key.to_s.tr("_", "-")] = value.to_s }
-      response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") { |http| http.request(request) }
+      response = HTTPClient.request(uri, request)
       return nil unless response.is_a?(Net::HTTPSuccess)
 
       JSON.parse(response.body)
@@ -790,7 +817,7 @@ module BetterAuth
       token_url_params = token_url_params.call(ctx) if token_url_params.respond_to?(:call)
       normalize_hash(token_url_params || {}).each { |key, value| form_data[key] = value }
       request.set_form_data(form_data.compact)
-      response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") { |http| http.request(request) }
+      response = HTTPClient.request(uri, request)
       raise APIError.new("BAD_REQUEST", message: GENERIC_OAUTH_ERROR_CODES["INVALID_OAUTH_CONFIG"]) unless response.is_a?(Net::HTTPSuccess)
 
       generic_oauth_normalize_tokens(JSON.parse(response.body))

data/lib/better_auth/plugins/have_i_been_pwned.rb

@@ -83,7 +83,7 @@ module BetterAuth
       request = Net::HTTP::Get.new(uri)
       request["Add-Padding"] = "true"
       request["User-Agent"] = "BetterAuth Password Checker"
-      response = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |http| http.request(request) }
+      response = HTTPClient.request(uri, request)
       unless response.is_a?(Net::HTTPSuccess)
         raise APIError.new("INTERNAL_SERVER_ERROR", message: "Failed to check password. Status: #{response.code}")
       end

data/lib/better_auth/plugins/jwt.rb

@@ -63,6 +63,7 @@ module BetterAuth
         schema: {
           jwks: {
             fields: {
+              id: {type: "string", required: true},
               publicKey: {type: "string", required: true},
               privateKey: {type: "string", required: true},
               createdAt: {type: "date", required: true},
@@ -279,9 +280,15 @@ module BetterAuth
       payload = if fetcher.respond_to?(:call)
         fetcher.call(url)
       else
-        uri = URI.parse(url.to_s)
-        response = Net::HTTP.get_response(uri)
-        response.is_a?(Net::HTTPSuccess) ? JSON.parse(response.body) : nil
+        cached = @jwt_remote_jwks_cache ||= {}
+        entry = cached[url.to_s]
+        if entry && entry[:expires_at] > Time.now
+          entry[:payload]
+        else
+          fetched = HTTPClient.get_json(url)
+          cached[url.to_s] = {payload: fetched, expires_at: Time.now + 300} if fetched
+          fetched
+        end
       end
       keys = fetch_value(payload, "keys")
       Array(keys).map { |entry| normalize_remote_jwk(entry) }

data/lib/better_auth/plugins/mcp/schema.rb

@@ -8,7 +8,7 @@ module BetterAuth
       def schema
         {
           oauthClient: {
-            modelName: "oauthClient",
+            model_name: "oauth_clients",
             fields: {
               clientId: {type: "string", unique: true, required: true},
               clientSecret: {type: "string", required: false},
@@ -17,7 +17,7 @@ module BetterAuth
               enableEndSession: {type: "boolean", required: false},
               clientSecretExpiresAt: {type: "number", required: false},
               scopes: {type: "string[]", required: false},
-              userId: {type: "string", required: false},
+              userId: {type: "string", required: false, references: {model: "user", field: "id"}},
               createdAt: {type: "date", required: true, default_value: -> { Time.now }},
               updatedAt: {type: "date", required: true, default_value: -> { Time.now }, on_update: -> { Time.now }},
               name: {type: "string", required: false},
@@ -45,9 +45,9 @@ module BetterAuth
           oauthRefreshToken: {
             fields: {
               token: {type: "string", required: true},
-              clientId: {type: "string", required: true},
-              sessionId: {type: "string", required: false},
-              userId: {type: "string", required: false},
+              clientId: {type: "string", required: true, references: {model: "oauthClient", field: "clientId"}},
+              sessionId: {type: "string", required: false, references: {model: "session", field: "id", on_delete: "set null"}},
+              userId: {type: "string", required: false, references: {model: "user", field: "id"}},
               referenceId: {type: "string", required: false},
               authTime: {type: "date", required: false},
               expiresAt: {type: "date", required: false},
@@ -57,27 +57,27 @@ module BetterAuth
             }
           },
           oauthAccessToken: {
-            modelName: "oauthAccessToken",
+            model_name: "oauth_access_tokens",
             fields: {
               token: {type: "string", unique: true, required: true},
               expiresAt: {type: "date", required: true},
-              clientId: {type: "string", required: true},
-              userId: {type: "string", required: false},
-              sessionId: {type: "string", required: false},
+              clientId: {type: "string", required: true, references: {model: "oauthClient", field: "clientId"}},
+              userId: {type: "string", required: false, references: {model: "user", field: "id"}},
+              sessionId: {type: "string", required: false, references: {model: "session", field: "id", on_delete: "set null"}},
               scopes: {type: "string[]", required: true},
               revoked: {type: "date", required: false},
               referenceId: {type: "string", required: false},
               authTime: {type: "date", required: false},
-              refreshId: {type: "string", required: false},
+              refreshId: {type: "string", required: false, references: {model: "oauthRefreshToken", field: "id"}},
               createdAt: {type: "date", required: true, default_value: -> { Time.now }},
               updatedAt: {type: "date", required: true, default_value: -> { Time.now }, on_update: -> { Time.now }}
             }
           },
           oauthConsent: {
-            modelName: "oauthConsent",
+            model_name: "oauth_consents",
             fields: {
-              clientId: {type: "string", required: true},
-              userId: {type: "string", required: false},
+              clientId: {type: "string", required: true, references: {model: "oauthClient", field: "clientId"}},
+              userId: {type: "string", required: false, references: {model: "user", field: "id"}},
               referenceId: {type: "string", required: false},
               scopes: {type: "string[]", required: true},
               createdAt: {type: "date", required: true, default_value: -> { Time.now }},

data/lib/better_auth/plugins/mcp.rb

@@ -144,6 +144,7 @@ module BetterAuth
         openapi: {
           operationId: operation_id,
           description: description,
+          requestBody: mcp_request_body_for(operation_id),
           responses: {
             "200" => OpenAPI.json_response(response_description, response_schema)
           }
@@ -151,6 +152,46 @@ module BetterAuth
       }
     end
 
+    def mcp_request_body_for(operation_id)
+      schema = case operation_id
+      when "registerMcpClient", "legacyRegisterMcpClient"
+        OpenAPI.object_schema(
+          {
+            redirect_uris: {type: "array", items: {type: "string", format: "uri"}},
+            client_name: {type: "string"},
+            client_uri: {type: "string", format: "uri"},
+            logo_uri: {type: "string", format: "uri"},
+            grant_types: {type: "array", items: {type: "string"}},
+            response_types: {type: "array", items: {type: "string"}},
+            scope: {type: "string"},
+            contacts: {type: "array", items: {type: "string"}},
+            metadata: {type: "object", additionalProperties: true}
+          },
+          required: ["redirect_uris"]
+        )
+      when "mcpOAuthConsent"
+        OpenAPI.object_schema({consent_code: {type: "string"}, accept: {type: "boolean"}, scope: {type: "string"}, scopes: {type: "array", items: {type: "string"}}}, required: ["consent_code"])
+      when "mcpOAuthToken", "legacyMcpOAuthToken"
+        OpenAPI.object_schema(
+          {
+            grant_type: {type: "string", enum: [OAuthProtocol::AUTH_CODE_GRANT, OAuthProtocol::REFRESH_GRANT]},
+            code: {type: "string"},
+            redirect_uri: {type: "string", format: "uri"},
+            code_verifier: {type: "string"},
+            client_id: {type: "string"},
+            client_secret: {type: "string"},
+            refresh_token: {type: "string"},
+            scope: {type: "string"},
+            resource: {oneOf: [{type: "string"}, {type: "array", items: {type: "string"}}]}
+          },
+          required: ["grant_type"]
+        )
+      when "mcpOAuthIntrospect", "mcpOAuthRevoke"
+        OpenAPI.object_schema({token: {type: "string"}, token_type_hint: {type: "string", enum: ["access_token", "refresh_token"]}}, required: ["token"])
+      end
+      schema ? OpenAPI.json_request_body(schema) : nil
+    end
+
     def mcp_client_schema
       OpenAPI.object_schema(
         {

data/lib/better_auth/plugins/oauth_protocol.rb

@@ -29,6 +29,12 @@ module BetterAuth
         parse_scopes(value).join(" ")
       end
 
+      def request_body!(value)
+        return stringify_keys(value || {}) if value.nil? || value.is_a?(Hash)
+
+        raise APIError.new("BAD_REQUEST", message: "request body must be an object")
+      end
+
       def issuer(ctx)
         ctx.context.options.base_url.to_s.empty? ? origin_for(ctx.context.base_url) : ctx.context.options.base_url
       end
@@ -100,7 +106,7 @@ module BetterAuth
       end
 
       def create_client(ctx, model:, body:, owner_session: nil, default_auth_method: "client_secret_basic", store_client_secret: "plain", unauthenticated: false, default_scopes: nil, allowed_scopes: nil, prefix: {}, dynamic_registration: false, admin: false, pairwise_secret: nil, strip_client_metadata: false, reference_id: nil)
-        body = stringify_keys(body || {})
+        body = request_body!(body || {})
         requested_auth_method = body["token_endpoint_auth_method"] || default_auth_method
         validate_client_metadata_enums!(requested_auth_method, body)
         validate_admin_only_fields!(body, admin: admin)
@@ -116,6 +122,7 @@ module BetterAuth
         grant_types = Array(body["grant_types"] || [AUTH_CODE_GRANT]).map(&:to_s)
         response_types = Array(body["response_types"] || ["code"]).map(&:to_s)
         validate_client_registration!(auth_method, grant_types, response_types, body, unauthenticated: unauthenticated, dynamic_registration: dynamic_registration)
+        validate_redirect_scheme_for_client!(auth_method, body, redirects)
         validate_pairwise_client!(body, redirects, pairwise_secret)
 
         scopes = parse_scopes(body["scope"] || body["scopes"])
@@ -237,6 +244,20 @@ module BetterAuth
         end
       end
 
+      def validate_redirect_scheme_for_client!(auth_method, body, redirects)
+        return if auth_method == "none" && body["type"] != "web"
+
+        redirects.each do |value|
+          uri = URI.parse(value.to_s)
+          next if uri.scheme == "https"
+          next if uri.scheme == "http" && loopback_host?(uri.hostname || uri.host)
+
+          raise APIError.new("BAD_REQUEST", message: "redirect_uris is invalid")
+        end
+      rescue URI::InvalidURIError
+        raise APIError.new("BAD_REQUEST", message: "redirect_uris is invalid")
+      end
+
       def validate_pairwise_client!(body, redirects, pairwise_secret)
         subject_type = body["subject_type"] || body["subjectType"]
         return unless subject_type == "pairwise"
@@ -266,7 +287,11 @@ module BetterAuth
       end
 
       def client_metadata(body, strip_unknown: false)
-        metadata = stringify_keys(body["metadata"] || {})
+        raw_metadata = body["metadata"]
+        unless raw_metadata.nil? || raw_metadata.is_a?(Hash)
+          raise APIError.new("BAD_REQUEST", message: "metadata must be an object")
+        end
+        metadata = stringify_keys(raw_metadata || {})
         metadata = metadata.slice("software_id", "software_version", "software_statement", "tos_uri", "policy_uri") if strip_unknown
         metadata["software_id"] = body["software_id"] if body["software_id"]
         metadata["software_version"] = body["software_version"] if body["software_version"]
@@ -313,15 +338,23 @@ module BetterAuth
         ctx.context.adapter.find_one(model: model, where: [{field: "clientId", value: client_id.to_s}])
       end
 
-      def authenticate_client!(ctx, model, store_client_secret: "plain", prefix: {})
-        body = stringify_keys(ctx.body || {})
+      def authenticate_client!(ctx, model, store_client_secret: "plain", prefix: {}, require_confidential: false)
+        body = request_body!(ctx.body || {})
         client_id = body["client_id"]
         client_secret = strip_prefix(body["client_secret"], prefix, :client_secret) || body["client_secret"]
 
         authorization = ctx.headers["authorization"]
-        if authorization.to_s.start_with?("Basic ") && client_id.to_s.empty?
-          decoded = Base64.decode64(authorization.delete_prefix("Basic "))
+        auth_method_used = client_secret.to_s.empty? ? nil : "client_secret_post"
+        if authorization.to_s.start_with?("Basic ")
+          decoded = Base64.strict_decode64(authorization.delete_prefix("Basic "))
+          unless decoded.include?(":")
+            raise APIError.new("BAD_REQUEST", message: "invalid authorization header format", body: {error: "invalid_client", error_description: "invalid authorization header format"})
+          end
           client_id, client_secret = decoded.split(":", 2)
+          if client_id.to_s.empty? || client_secret.to_s.empty?
+            raise APIError.new("BAD_REQUEST", message: "invalid authorization header format", body: {error: "invalid_client", error_description: "invalid authorization header format"})
+          end
+          auth_method_used = "client_secret_basic"
         end
 
         client = find_client(ctx, model, client_id)
@@ -332,20 +365,34 @@ module BetterAuth
 
         method = client_data["tokenEndpointAuthMethod"] || "client_secret_basic"
         if method == "none"
+          raise APIError.new("UNAUTHORIZED", message: "invalid_client") if require_confidential
           raise APIError.new("UNAUTHORIZED", message: "invalid_client") unless client_secret.to_s.empty?
           return client
         end
+        expected_method = (method == "client_secret_post") ? "client_secret_post" : "client_secret_basic"
+        raise APIError.new("UNAUTHORIZED", message: "invalid_client") unless auth_method_used == expected_method
+        if client_secret_expired?(client_data["clientSecretExpiresAt"])
+          raise APIError.new("UNAUTHORIZED", message: "invalid_client")
+        end
         if method != "none" && !verify_client_secret(ctx, stringify_keys(client)["clientSecret"], client_secret, store_client_secret)
           raise APIError.new("UNAUTHORIZED", message: "invalid_client")
         end
 
-        client
+        client.merge("__providedClientSecret" => client_secret)
       rescue ArgumentError
-        raise APIError.new("UNAUTHORIZED", message: "invalid_client")
+        raise APIError.new("BAD_REQUEST", message: "invalid authorization header format", body: {error: "invalid_client", error_description: "invalid authorization header format"})
       end
 
-      def store_code(store, code:, client_id:, redirect_uri:, session:, scopes:, code_challenge: nil, code_challenge_method: nil, nonce: nil, reference_id: nil, auth_time: nil, expires_in: 600)
-        store[:codes][code] = {
+      def client_secret_expired?(value)
+        return false if value.nil? || value.to_i == 0
+
+        seconds = timestamp_seconds(value)
+        seconds && seconds <= Time.now.to_i
+      end
+
+      def store_code(store, code:, client_id:, redirect_uri:, session:, scopes:, code_challenge: nil, code_challenge_method: nil, nonce: nil, reference_id: nil, auth_time: nil, expires_in: 600, store_tokens: "hashed")
+        stored_code = get_stored_token(store_tokens, code, "authorization_code")
+        store[:codes][stored_code] = {
           client_id: client_id,
           redirect_uri: redirect_uri,
           session: session,
@@ -359,8 +406,9 @@ module BetterAuth
         }
       end
 
-      def consume_code!(store, code, client_id:, redirect_uri:, code_verifier: nil)
-        data = store[:codes].delete(code.to_s)
+      def consume_code!(store, code, client_id:, redirect_uri:, code_verifier: nil, store_tokens: "hashed")
+        stored_code = get_stored_token(store_tokens, code.to_s, "authorization_code")
+        data = store[:codes].delete(stored_code) || store[:codes].delete(code.to_s)
         raise APIError.new("BAD_REQUEST", message: "invalid_grant") unless data
         raise APIError.new("BAD_REQUEST", message: "invalid_grant") if data[:expires_at] <= Time.now
         raise APIError.new("BAD_REQUEST", message: "invalid_grant") unless data[:client_id] == client_id.to_s
@@ -396,6 +444,7 @@ module BetterAuth
 
       def pkce_required?(client, scopes)
         data = stringify_keys(client)
+        return true if data["public"] || data["tokenEndpointAuthMethod"] == "none" || ["native", "user-agent-based"].include?(data["type"])
         return true if parse_scopes(scopes).include?("offline_access")
         require_pkce = client_require_pkce(data)
         return require_pkce unless require_pkce.nil?
@@ -403,7 +452,7 @@ module BetterAuth
         true
       end
 
-      def issue_tokens(ctx, store, model:, client:, session:, scopes:, include_refresh: false, issuer: nil, jwt_audience: nil, access_token_expires_in: 3600, refresh_token_expires_in: 2_592_000, id_token_expires_in: 3600, id_token_signer: nil, prefix: {}, audience: nil, grant_type: nil, custom_token_response_fields: nil, custom_access_token_claims: nil, custom_id_token_claims: nil, jwt_access_token: false, use_jwt_plugin: false, pairwise_secret: nil, nonce: nil, auth_time: nil, reference_id: nil, filter_id_token_claims_by_scope: false)
+      def issue_tokens(ctx, store, model:, client:, session:, scopes:, include_refresh: false, issuer: nil, jwt_audience: nil, access_token_expires_in: 3600, refresh_token_expires_in: 2_592_000, id_token_expires_in: 3600, id_token_signer: nil, prefix: {}, audience: nil, grant_type: nil, custom_token_response_fields: nil, custom_access_token_claims: nil, custom_id_token_claims: nil, jwt_access_token: false, use_jwt_plugin: false, pairwise_secret: nil, nonce: nil, auth_time: nil, reference_id: nil, filter_id_token_claims_by_scope: false, store_tokens: "hashed")
         data = stringify_keys(session || {})
         user = stringify_keys(data["user"] || data[:user] || {})
         session_data = stringify_keys(data["session"] || data[:session] || {})
@@ -424,7 +473,7 @@ module BetterAuth
         refresh_record = nil
         if refresh_token_value
           refresh_record = {
-            "token" => refresh_token_value,
+            "token" => store_token_value(store_tokens, refresh_token_value, "refresh_token"),
             "clientId" => client_data["clientId"],
             "sessionId" => session_data["id"],
             "userId" => user["id"],
@@ -440,13 +489,13 @@ module BetterAuth
             "issuedAt" => Time.now
           }
           created_refresh = schema_model?(ctx, "oauthRefreshToken") ? ctx.context.adapter.create(model: "oauthRefreshToken", data: refresh_record) : nil
-          refresh_record = refresh_record.merge("id" => stringify_keys(created_refresh || {})["id"], "user" => user, "session" => session_data, "client" => client_data, "scope" => scope)
+          refresh_record = refresh_record.merge("id" => stringify_keys(created_refresh || {})["id"], "token" => refresh_token_value, "user" => user, "session" => session_data, "client" => client_data, "scope" => scope)
           store[:refresh_tokens][refresh_token_value] = refresh_record
           store[:refresh_tokens][refresh_token] = refresh_record
         end
         unless jwt_access_token && audience
           record = {
-            "token" => access_token_value,
+            "token" => store_token_value(store_tokens, access_token_value, "access_token"),
             "expiresAt" => expires_at,
             "clientId" => client_data["clientId"],
             "userId" => user["id"],
@@ -464,7 +513,7 @@ module BetterAuth
           created_access = ctx.context.adapter.create(model: model, data: record)
           created = stringify_keys(created_access || {})
           record = record.merge("id" => created["id"]) if created["id"]
-          stored_record = record.merge("user" => user, "session" => session_data, "client" => client_data)
+          stored_record = record.merge("token" => access_token_value, "user" => user, "session" => session_data, "client" => client_data)
           store[:tokens][access_token_value] = stored_record
           store[:tokens][access_token] = stored_record
         end
@@ -478,7 +527,8 @@ module BetterAuth
         }
         response[:audience] = audience if audience
         response[:refresh_token] = refresh_token if refresh_token
-        response[:id_token] = id_token(user.merge("id" => subject), client_data["clientId"], issuer || issuer(ctx), jwt_audience || client_data["clientId"], ctx: ctx, signer: id_token_signer, session_id: session_data["id"], include_sid: !!client_data["enableEndSession"], nonce: nonce, auth_time: token_auth_time, custom_claims: custom_id_token_claims, scopes: parse_scopes(scope), client: client_data, filter_claims_by_scope: filter_id_token_claims_by_scope, expires_in: id_token_expires_in, use_jwt_plugin: use_jwt_plugin) if parse_scopes(scope).include?("openid")
+        id_token_client_data = client_data.merge("clientSecret" => client_data["__providedClientSecret"] || client_data["clientSecret"])
+        response[:id_token] = id_token(user.merge("id" => subject), client_data["clientId"], issuer || issuer(ctx), jwt_audience || client_data["clientId"], ctx: ctx, signer: id_token_signer, session_id: session_data["id"], include_sid: !!client_data["enableEndSession"], nonce: nonce, auth_time: token_auth_time, custom_claims: custom_id_token_claims, scopes: parse_scopes(scope), client: id_token_client_data, filter_claims_by_scope: filter_id_token_claims_by_scope, expires_in: id_token_expires_in, use_jwt_plugin: use_jwt_plugin) if parse_scopes(scope).include?("openid")
         if custom_token_response_fields.respond_to?(:call)
           extra = custom_token_response_fields.call({grant_type: grant_type, user: user.empty? ? nil : user, scopes: parse_scopes(scope), metadata: stringify_keys(client_data["metadata"] || {})})
           response.merge!(stringify_keys(extra).reject { |key, _value| standard_token_response_field?(key) }.transform_keys(&:to_sym)) if extra.is_a?(Hash)
@@ -486,7 +536,7 @@ module BetterAuth
         response
       end
 
-      def refresh_tokens(ctx, store, model:, client:, refresh_token:, scopes: nil, issuer: nil, access_token_expires_in: 3600, refresh_token_expires_in: 2_592_000, id_token_expires_in: 3600, id_token_signer: nil, prefix: {}, audience: nil, custom_token_response_fields: nil, custom_access_token_claims: nil, custom_id_token_claims: nil, jwt_access_token: false, use_jwt_plugin: false, pairwise_secret: nil, filter_id_token_claims_by_scope: false)
+      def refresh_tokens(ctx, store, model:, client:, refresh_token:, scopes: nil, issuer: nil, access_token_expires_in: 3600, refresh_token_expires_in: 2_592_000, id_token_expires_in: 3600, id_token_signer: nil, prefix: {}, audience: nil, custom_token_response_fields: nil, custom_access_token_claims: nil, custom_id_token_claims: nil, jwt_access_token: false, use_jwt_plugin: false, pairwise_secret: nil, filter_id_token_claims_by_scope: false, store_tokens: "hashed")
         refresh_token_value = strip_prefix(refresh_token, prefix, :refresh_token)
         data = refresh_token_value ? store[:refresh_tokens][refresh_token_value] : nil
         raise APIError.new("BAD_REQUEST", message: "invalid_grant") unless data
@@ -532,7 +582,8 @@ module BetterAuth
           id_token_expires_in: id_token_expires_in,
           auth_time: data["authTime"],
           reference_id: data["referenceId"],
-          filter_id_token_claims_by_scope: filter_id_token_claims_by_scope
+          filter_id_token_claims_by_scope: filter_id_token_claims_by_scope,
+          store_tokens: store_tokens
         )
       end
 
@@ -757,6 +808,11 @@ module BetterAuth
       end
 
       def id_token_hs256_key(ctx, client_id, client_secret = nil)
+        oauth_provider = ctx&.context&.options&.plugins&.find { |plugin| plugin.id == "oauth-provider" }
+        if oauth_provider&.options&.fetch(:store_client_secret, nil).to_s == "hashed"
+          label = client_id.to_s.empty? ? "better-auth" : client_id.to_s
+          return OpenSSL::HMAC.hexdigest("SHA256", ctx.context.secret.to_s, "oidc.id_token.#{label}")
+        end
         return client_secret.to_s unless client_secret.to_s.empty?
 
         label = client_id.to_s.empty? ? "better-auth" : client_id.to_s
@@ -857,10 +913,29 @@ module BetterAuth
         secret
       end
 
+      def store_token_value(storage_method, token, type)
+        case storage_method
+        when "hashed", :hashed
+          Crypto.sha256(token.to_s, encoding: :base64url)
+        else
+          mode = normalize_secret_storage_mode(storage_method)
+          return mode[:hash].call(token.to_s, type) if mode.is_a?(Hash) && mode[:hash].respond_to?(:call)
+
+          raise Error, "storeToken: unsupported storageMethod type '#{storage_method}'"
+        end
+      end
+
+      def get_stored_token(storage_method, token, type)
+        store_token_value(storage_method, token, type)
+      end
+
       def verify_client_secret(ctx, stored_secret, provided_secret, mode)
         mode = normalize_secret_storage_mode(mode)
         return Crypto.constant_time_compare(Crypto.sha256(provided_secret, encoding: :base64url), stored_secret.to_s) if mode == "hashed"
-        return Crypto.constant_time_compare(Crypto.symmetric_decrypt(key: ctx.context.secret_config, data: stored_secret).to_s, provided_secret.to_s) if mode == "encrypted"
+        if mode == "encrypted"
+          decrypted = Crypto.symmetric_decrypt(key: ctx.context.secret_config, data: stored_secret)
+          return Crypto.constant_time_compare(decrypted.to_s, provided_secret.to_s)
+        end
 
         if mode.is_a?(Hash)
           return Crypto.constant_time_compare(mode[:hash].call(provided_secret).to_s, stored_secret.to_s) if mode[:hash].respond_to?(:call)
@@ -868,6 +943,8 @@ module BetterAuth
         end
 
         Crypto.constant_time_compare(stored_secret.to_s, provided_secret.to_s)
+      rescue Error, ArgumentError
+        false
       end
 
       def normalize_secret_storage_mode(mode)