@better-auth/core 1.7.0-beta.1 → 1.7.0-beta.10

package/dist/social-providers/index.mjs

@@ -7,7 +7,7 @@ import { facebook } from "./facebook.mjs";
 import { figma } from "./figma.mjs";
 import { github } from "./github.mjs";
 import { gitlab } from "./gitlab.mjs";
-import { getGooglePublicKey, google } from "./google.mjs";
+import { getGooglePublicKey, google, isGoogleHostedDomainAllowed, verifyGoogleIdToken } from "./google.mjs";
 import { huggingface } from "./huggingface.mjs";
 import { kakao } from "./kakao.mjs";
 import { kick } from "./kick.mjs";
@@ -75,4 +75,4 @@ const socialProviders = {
 const socialProviderList = Object.keys(socialProviders);
 const SocialProviderListEnum = z.enum(socialProviderList).or(z.string());
 //#endregion
-export { SocialProviderListEnum, apple, atlassian, cognito, discord, dropbox, facebook, figma, getApplePublicKey, getCognitoPublicKey, getGooglePublicKey, getMicrosoftPublicKey, github, gitlab, google, huggingface, kakao, kick, line, linear, linkedin, microsoft, naver, notion, paybin, paypal, polar, railway, reddit, roblox, salesforce, slack, socialProviderList, socialProviders, spotify, tiktok, twitch, twitter, vercel, vk, wechat, zoom };
+export { SocialProviderListEnum, apple, atlassian, cognito, discord, dropbox, facebook, figma, getApplePublicKey, getCognitoPublicKey, getGooglePublicKey, getMicrosoftPublicKey, github, gitlab, google, huggingface, isGoogleHostedDomainAllowed, kakao, kick, line, linear, linkedin, microsoft, naver, notion, paybin, paypal, polar, railway, reddit, roblox, salesforce, slack, socialProviderList, socialProviders, spotify, tiktok, twitch, twitter, vercel, verifyGoogleIdToken, vk, wechat, zoom };

package/dist/social-providers/kakao.d.mts

@@ -96,7 +96,8 @@ declare const kakao: (options: KakaoOptions) => {
   createAuthorizationURL({
     state,
     scopes,
-    redirectURI
+    redirectURI,
+    additionalParams
   }: {
     state: string;
     codeVerifier: string;
@@ -104,6 +105,8 @@ declare const kakao: (options: KakaoOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
+    additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
   validateAuthorizationCode: ({
     code,
@@ -116,6 +119,7 @@ declare const kakao: (options: KakaoOptions) => {
   }) => Promise<OAuth2Tokens>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;

package/dist/social-providers/kakao.mjs

@@ -8,7 +8,7 @@ const kakao = (options) => {
 	return {
 		id: "kakao",
 		name: "Kakao",
-		createAuthorizationURL({ state, scopes, redirectURI }) {
+		createAuthorizationURL({ state, scopes, redirectURI, additionalParams }) {
 			const _scopes = options.disableDefaultScope ? [] : [
 				"account_email",
 				"profile_image",
@@ -22,7 +22,8 @@ const kakao = (options) => {
 				authorizationEndpoint: "https://kauth.kakao.com/oauth/authorize",
 				scopes: _scopes,
 				state,
-				redirectURI
+				redirectURI,
+				additionalParams
 			});
 		},
 		validateAuthorizationCode: async ({ code, redirectURI }) => {

package/dist/social-providers/kick.d.mts

@@ -28,7 +28,8 @@ declare const kick: (options: KickOptions) => {
     state,
     scopes,
     redirectURI,
-    codeVerifier
+    codeVerifier,
+    additionalParams
   }: {
     state: string;
     codeVerifier: string;
@@ -36,6 +37,8 @@ declare const kick: (options: KickOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
+    additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
   validateAuthorizationCode({
     code,
@@ -49,6 +52,7 @@ declare const kick: (options: KickOptions) => {
   }): Promise<OAuth2Tokens>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;

package/dist/social-providers/kick.mjs

@@ -7,7 +7,7 @@ const kick = (options) => {
 	return {
 		id: "kick",
 		name: "Kick",
-		createAuthorizationURL({ state, scopes, redirectURI, codeVerifier }) {
+		createAuthorizationURL({ state, scopes, redirectURI, codeVerifier, additionalParams }) {
 			const _scopes = options.disableDefaultScope ? [] : ["user:read"];
 			if (options.scope) _scopes.push(...options.scope);
 			if (scopes) _scopes.push(...scopes);
@@ -18,7 +18,8 @@ const kick = (options) => {
 				authorizationEndpoint: "https://id.kick.com/oauth/authorize",
 				scopes: _scopes,
 				codeVerifier,
-				state
+				state,
+				additionalParams
 			});
 		},
 		async validateAuthorizationCode({ code, redirectURI, codeVerifier }) {

package/dist/social-providers/line.d.mts

@@ -38,7 +38,8 @@ declare const line: (options: LineOptions) => {
     scopes,
     codeVerifier,
     redirectURI,
-    loginHint
+    loginHint,
+    additionalParams
   }: {
     state: string;
     codeVerifier: string;
@@ -46,6 +47,8 @@ declare const line: (options: LineOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
+    additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
   validateAuthorizationCode: ({
     code,
@@ -58,8 +61,11 @@ declare const line: (options: LineOptions) => {
     deviceId?: string | undefined;
   }) => Promise<OAuth2Tokens>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
-  verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+  idToken: {
+    verify: (token: string, nonce: string | undefined) => Promise<boolean>;
+  };
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;

package/dist/social-providers/line.mjs

@@ -21,7 +21,7 @@ const line = (options) => {
 	return {
 		id: "line",
 		name: "LINE",
-		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, loginHint }) {
+		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, loginHint, additionalParams }) {
 			const _scopes = options.disableDefaultScope ? [] : [
 				"openid",
 				"profile",
@@ -37,7 +37,8 @@ const line = (options) => {
 				state,
 				codeVerifier,
 				redirectURI,
-				loginHint
+				loginHint,
+				additionalParams
 			});
 		},
 		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
@@ -59,9 +60,7 @@ const line = (options) => {
 				tokenEndpoint
 			});
 		},
-		async verifyIdToken(token, nonce) {
-			if (options.disableIdTokenSignIn) return false;
-			if (options.verifyIdToken) return options.verifyIdToken(token, nonce);
+		idToken: { verify: async (token, nonce) => {
 			const body = new URLSearchParams();
 			body.set("id_token", token);
 			body.set("client_id", options.clientId);
@@ -75,7 +74,7 @@ const line = (options) => {
 			if (data.aud !== options.clientId) return false;
 			if (data.nonce && data.nonce !== nonce) return false;
 			return true;
-		},
+		} },
 		async getUserInfo(token) {
 			if (options.getUserInfo) return options.getUserInfo(token);
 			let profile = null;

package/dist/social-providers/linear.d.mts

@@ -24,7 +24,8 @@ declare const linear: (options: LinearOptions) => {
     state,
     scopes,
     loginHint,
-    redirectURI
+    redirectURI,
+    additionalParams
   }: {
     state: string;
     codeVerifier: string;
@@ -32,6 +33,8 @@ declare const linear: (options: LinearOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
+    additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
   validateAuthorizationCode: ({
     code,
@@ -44,6 +47,7 @@ declare const linear: (options: LinearOptions) => {
   }) => Promise<OAuth2Tokens>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;

package/dist/social-providers/linear.mjs

@@ -8,7 +8,7 @@ const linear = (options) => {
 	return {
 		id: "linear",
 		name: "Linear",
-		createAuthorizationURL({ state, scopes, loginHint, redirectURI }) {
+		createAuthorizationURL({ state, scopes, loginHint, redirectURI, additionalParams }) {
 			const _scopes = options.disableDefaultScope ? [] : ["read"];
 			if (options.scope) _scopes.push(...options.scope);
 			if (scopes) _scopes.push(...scopes);
@@ -19,7 +19,8 @@ const linear = (options) => {
 				scopes: _scopes,
 				state,
 				redirectURI,
-				loginHint
+				loginHint,
+				additionalParams
 			});
 		},
 		validateAuthorizationCode: async ({ code, redirectURI }) => {

package/dist/social-providers/linkedin.d.mts

@@ -10,8 +10,8 @@ interface LinkedInProfile {
     country: string;
     language: string;
   };
-  email: string;
-  email_verified: boolean;
+  email?: string;
+  email_verified?: boolean;
 }
 interface LinkedInOptions extends ProviderOptions<LinkedInProfile> {
   clientId: string;
@@ -23,7 +23,8 @@ declare const linkedin: (options: LinkedInOptions) => {
     state,
     scopes,
     redirectURI,
-    loginHint
+    loginHint,
+    additionalParams
   }: {
     state: string;
     codeVerifier: string;
@@ -31,6 +32,8 @@ declare const linkedin: (options: LinkedInOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
+    additionalParams?: Record<string, string> | undefined;
   }) => Promise<URL>;
   validateAuthorizationCode: ({
     code,
@@ -43,6 +46,7 @@ declare const linkedin: (options: LinkedInOptions) => {
   }) => Promise<OAuth2Tokens>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;

package/dist/social-providers/linkedin.mjs

@@ -9,7 +9,7 @@ const linkedin = (options) => {
 	return {
 		id: "linkedin",
 		name: "Linkedin",
-		createAuthorizationURL: async ({ state, scopes, redirectURI, loginHint }) => {
+		createAuthorizationURL: async ({ state, scopes, redirectURI, loginHint, additionalParams }) => {
 			const _scopes = options.disableDefaultScope ? [] : [
 				"profile",
 				"email",
@@ -24,7 +24,8 @@ const linkedin = (options) => {
 				scopes: _scopes,
 				state,
 				loginHint,
-				redirectURI
+				redirectURI,
+				additionalParams
 			});
 		},
 		validateAuthorizationCode: async ({ code, redirectURI }) => {
@@ -59,7 +60,7 @@ const linkedin = (options) => {
 					id: profile.sub,
 					name: profile.name,
 					email: profile.email,
-					emailVerified: profile.email_verified || false,
+					emailVerified: profile.email_verified ?? false,
 					image: profile.picture,
 					...userMap
 				},

package/dist/social-providers/microsoft-entra-id.d.mts

@@ -1,4 +1,7 @@
+import { ClientAssertionGetter } from "../oauth2/client-assertion.mjs";
 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import * as jose from "jose";
+
 //#region src/social-providers/microsoft-entra-id.d.ts
 /**
  * @see [Microsoft Identity Platform - Optional claims reference](https://learn.microsoft.com/en-us/entra/identity-platform/optional-claims-reference)
@@ -25,7 +28,7 @@ interface MicrosoftEntraIDProfile extends Record<string, any> {
   /** The primary username that represents the user */
   preferred_username: string;
   /** User's email address */
-  email: string;
+  email?: string;
   /** Human-readable value that identifies the subject of the token */
   name: string;
   /** Matches the parameter included in the original authorize request */
@@ -104,26 +107,34 @@ interface MicrosoftEntraIDProfile extends Record<string, any> {
   given_name: string;
 }
 interface MicrosoftOptions extends ProviderOptions<MicrosoftEntraIDProfile> {
-  clientId: string;
+  clientId: string | string[];
   /**
    * The tenant ID of the Microsoft account
    * @default "common"
    */
-  tenantId?: string | undefined;
+  tenantId?: string;
   /**
    * The authentication authority URL. Use the default "https://login.microsoftonline.com" for standard Entra ID or "https://<tenant-id>.ciamlogin.com" for CIAM scenarios.
    * @default "https://login.microsoftonline.com"
    */
-  authority?: string | undefined;
+  authority?: string;
+  /**
+   * Function that returns a JWT client assertion for token endpoint authentication.
+   *
+   * Use this instead of `clientSecret` when your Microsoft Entra ID app is
+   * configured for client authentication with assertions (private_key_jwt or
+   * workload identity federation).
+   */
+  clientAssertion?: ClientAssertionGetter;
   /**
    * The size of the profile photo
    * @default 48
    */
-  profilePhotoSize?: (48 | 64 | 96 | 120 | 240 | 360 | 432 | 504 | 648) | undefined;
+  profilePhotoSize?: 48 | 64 | 96 | 120 | 240 | 360 | 432 | 504 | 648;
   /**
    * Disable profile photo
    */
-  disableProfilePhoto?: boolean | undefined;
+  disableProfilePhoto?: boolean;
 }
 declare const microsoft: (options: MicrosoftOptions) => {
   id: "microsoft";
@@ -135,6 +146,8 @@ declare const microsoft: (options: MicrosoftOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
+    additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
   validateAuthorizationCode({
     code,
@@ -146,8 +159,29 @@ declare const microsoft: (options: MicrosoftOptions) => {
     codeVerifier?: string | undefined;
     deviceId?: string | undefined;
   }): Promise<OAuth2Tokens>;
-  verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+  idToken: {
+    jwks: (header: jose.JWTHeaderParameters) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
+    audience: string | string[];
+    maxTokenAge: string;
+    /**
+     * Issuer varies per tenant for multi-tenant endpoints, so only validate it for
+     * specific tenants.
+     * @see https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols#endpoints
+     */
+    issuer: string | undefined;
+    /**
+     * The multi-tenant endpoints (common/organizations/consumers) skip the
+     * issuer check above because the issuer varies per tenant, and the
+     * organizations and consumers JWKS sets overlap. Enforce the tenant
+     * binding explicitly so a token from a disallowed account class cannot
+     * pass: the issuer must name the token's own tenant, and the account
+     * class must match the configured restriction.
+     * @see https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference
+     */
+    verifyClaims: (claims: Record<string, unknown>) => boolean;
+  };
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;

package/dist/social-providers/microsoft-entra-id.mjs

@@ -1,21 +1,39 @@
+import { APIError, BetterAuthError } from "../error/index.mjs";
 import { logger } from "../env/logger.mjs";
-import { APIError } from "../error/index.mjs";
+import { getPrimaryClientId } from "../oauth2/utils.mjs";
 import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
 import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
 import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
-import { decodeJwt, decodeProtectedHeader, importJWK, jwtVerify } from "jose";
 import { base64 } from "@better-auth/utils/base64";
+import { decodeJwt, importJWK } from "jose";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/social-providers/microsoft-entra-id.ts
+/**
+* Microsoft's fixed tenant id for personal (consumer) Microsoft accounts. Every
+* personal-account token carries it as the `tid` claim, so it distinguishes the
+* consumer account class from work/school tenants.
+* @see https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference
+*/
+const MICROSOFT_CONSUMER_TENANT_ID = "9188040d-6c67-4c5b-b112-36a304b66dad";
 const microsoft = (options) => {
 	const tenant = options.tenantId || "common";
-	const authority = options.authority || "https://login.microsoftonline.com";
+	let authority = options.authority || "https://login.microsoftonline.com";
+	while (authority.endsWith("/")) authority = authority.slice(0, -1);
 	const authorizationEndpoint = `${authority}/${tenant}/oauth2/v2.0/authorize`;
 	const tokenEndpoint = `${authority}/${tenant}/oauth2/v2.0/token`;
+	if (options.clientSecret && options.clientAssertion) throw new BetterAuthError("Microsoft Entra ID clientAssertion cannot be combined with clientSecret");
+	const tokenEndpointAuth = options.clientAssertion ? {
+		method: "private_key_jwt",
+		getClientAssertion: options.clientAssertion
+	} : void 0;
 	return {
 		id: "microsoft",
 		name: "Microsoft EntraID",
 		createAuthorizationURL(data) {
+			if (!getPrimaryClientId(options.clientId)) {
+				logger.error("Client Id is required for Microsoft Entra ID. Make sure to provide it in the options.");
+				throw new BetterAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
+			}
 			const scopes = options.disableDefaultScope ? [] : [
 				"openid",
 				"profile",
@@ -34,7 +52,8 @@ const microsoft = (options) => {
 				scopes,
 				redirectURI: data.redirectURI,
 				prompt: options.prompt,
-				loginHint: data.loginHint
+				loginHint: data.loginHint,
+				additionalParams: data.additionalParams
 			});
 		},
 		validateAuthorizationCode({ code, codeVerifier, redirectURI }) {
@@ -43,32 +62,21 @@ const microsoft = (options) => {
 				codeVerifier,
 				redirectURI,
 				options,
-				tokenEndpoint
+				tokenEndpoint,
+				tokenEndpointAuth
 			});
 		},
-		async verifyIdToken(token, nonce) {
-			if (options.disableIdTokenSignIn) return false;
-			if (options.verifyIdToken) return options.verifyIdToken(token, nonce);
-			try {
-				const { kid, alg: jwtAlg } = decodeProtectedHeader(token);
-				if (!kid || !jwtAlg) return false;
-				const publicKey = await getMicrosoftPublicKey(kid, tenant, authority);
-				const verifyOptions = {
-					algorithms: [jwtAlg],
-					audience: options.clientId,
-					maxTokenAge: "1h"
-				};
-				/**
-				* Issuer varies per user's tenant for multi-tenant endpoints, so only validate for specific tenants.
-				* @see https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols#endpoints
-				*/
-				if (tenant !== "common" && tenant !== "organizations" && tenant !== "consumers") verifyOptions.issuer = `${authority}/${tenant}/v2.0`;
-				const { payload: jwtClaims } = await jwtVerify(token, publicKey, verifyOptions);
-				if (nonce && jwtClaims.nonce !== nonce) return false;
+		idToken: {
+			jwks: (header) => getMicrosoftPublicKey(header.kid, tenant, authority),
+			audience: options.clientId,
+			maxTokenAge: "1h",
+			issuer: tenant !== "common" && tenant !== "organizations" && tenant !== "consumers" ? `${authority}/${tenant}/v2.0` : void 0,
+			verifyClaims: (claims) => {
+				const tid = claims.tid;
+				if (typeof tid !== "string" || claims.iss !== `${authority}/${tid}/v2.0`) return false;
+				if (tenant === "organizations" && tid === MICROSOFT_CONSUMER_TENANT_ID) return false;
+				if (tenant === "consumers" && tid !== MICROSOFT_CONSUMER_TENANT_ID) return false;
 				return true;
-			} catch (error) {
-				logger.error("Failed to verify ID token:", error);
-				return false;
 			}
 		},
 		async getUserInfo(token) {
@@ -118,7 +126,8 @@ const microsoft = (options) => {
 					clientSecret: options.clientSecret
 				},
 				extraParams: { scope: scopes.join(" ") },
-				tokenEndpoint
+				tokenEndpoint,
+				tokenEndpointAuth
 			});
 		},
 		options

package/dist/social-providers/naver.d.mts

@@ -27,7 +27,8 @@ declare const naver: (options: NaverOptions) => {
   createAuthorizationURL({
     state,
     scopes,
-    redirectURI
+    redirectURI,
+    additionalParams
   }: {
     state: string;
     codeVerifier: string;
@@ -35,6 +36,8 @@ declare const naver: (options: NaverOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
+    additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
   validateAuthorizationCode: ({
     code,
@@ -47,6 +50,7 @@ declare const naver: (options: NaverOptions) => {
   }) => Promise<OAuth2Tokens>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;

package/dist/social-providers/naver.mjs

@@ -8,7 +8,7 @@ const naver = (options) => {
 	return {
 		id: "naver",
 		name: "Naver",
-		createAuthorizationURL({ state, scopes, redirectURI }) {
+		createAuthorizationURL({ state, scopes, redirectURI, additionalParams }) {
 			const _scopes = options.disableDefaultScope ? [] : ["profile", "email"];
 			if (options.scope) _scopes.push(...options.scope);
 			if (scopes) _scopes.push(...scopes);
@@ -18,7 +18,8 @@ const naver = (options) => {
 				authorizationEndpoint: "https://nid.naver.com/oauth2.0/authorize",
 				scopes: _scopes,
 				state,
-				redirectURI
+				redirectURI,
+				additionalParams
 			});
 		},
 		validateAuthorizationCode: async ({ code, redirectURI }) => {

package/dist/social-providers/notion.d.mts

@@ -20,7 +20,8 @@ declare const notion: (options: NotionOptions) => {
     state,
     scopes,
     loginHint,
-    redirectURI
+    redirectURI,
+    additionalParams
   }: {
     state: string;
     codeVerifier: string;
@@ -28,6 +29,8 @@ declare const notion: (options: NotionOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
+    additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
   validateAuthorizationCode: ({
     code,
@@ -40,6 +43,7 @@ declare const notion: (options: NotionOptions) => {
   }) => Promise<OAuth2Tokens>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;

package/dist/social-providers/notion.mjs

@@ -8,7 +8,7 @@ const notion = (options) => {
 	return {
 		id: "notion",
 		name: "Notion",
-		createAuthorizationURL({ state, scopes, loginHint, redirectURI }) {
+		createAuthorizationURL({ state, scopes, loginHint, redirectURI, additionalParams }) {
 			const _scopes = options.disableDefaultScope ? [] : [];
 			if (options.scope) _scopes.push(...options.scope);
 			if (scopes) _scopes.push(...scopes);
@@ -20,7 +20,10 @@ const notion = (options) => {
 				state,
 				redirectURI,
 				loginHint,
-				additionalParams: { owner: "user" }
+				additionalParams: {
+					...additionalParams ?? {},
+					owner: "user"
+				}
 			});
 		},
 		validateAuthorizationCode: async ({ code, redirectURI }) => {

package/dist/social-providers/paybin.d.mts

@@ -26,7 +26,8 @@ declare const paybin: (options: PaybinOptions) => {
     scopes,
     codeVerifier,
     redirectURI,
-    loginHint
+    loginHint,
+    additionalParams
   }: {
     state: string;
     codeVerifier: string;
@@ -34,6 +35,8 @@ declare const paybin: (options: PaybinOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
+    additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
   validateAuthorizationCode: ({
     code,
@@ -47,6 +50,7 @@ declare const paybin: (options: PaybinOptions) => {
   }) => Promise<OAuth2Tokens>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;

package/dist/social-providers/paybin.mjs

@@ -1,5 +1,5 @@
-import { logger } from "../env/logger.mjs";
 import { BetterAuthError } from "../error/index.mjs";
+import { logger } from "../env/logger.mjs";
 import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
 import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
 import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
@@ -12,7 +12,7 @@ const paybin = (options) => {
 	return {
 		id: "paybin",
 		name: "Paybin",
-		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, loginHint }) {
+		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, loginHint, additionalParams }) {
 			if (!options.clientId || !options.clientSecret) {
 				logger.error("Client Id and Client Secret is required for Paybin. Make sure to provide them in the options.");
 				throw new BetterAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
@@ -34,7 +34,8 @@ const paybin = (options) => {
 				codeVerifier,
 				redirectURI,
 				prompt: options.prompt,
-				loginHint
+				loginHint,
+				additionalParams
 			});
 		},
 		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {