@better-auth/core 1.7.0-beta.5 → 1.7.0-beta.7

package/dist/social-providers/index.d.mts

@@ -56,6 +56,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -80,6 +81,7 @@ declare const socialProviders: {
     };
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -117,6 +119,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -134,6 +137,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -171,6 +175,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -194,6 +199,7 @@ declare const socialProviders: {
       maxTokenAge: string;
     };
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -230,6 +236,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -246,6 +253,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -283,6 +291,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -313,6 +322,7 @@ declare const socialProviders: {
     };
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -350,6 +360,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -367,6 +378,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -405,6 +417,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -422,6 +435,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens | null>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -453,6 +467,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -473,8 +488,10 @@ declare const socialProviders: {
       audience: string | string[];
       maxTokenAge: string;
       issuer: string | undefined;
+      verifyClaims: (claims: Record<string, unknown>) => boolean;
     };
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -516,6 +533,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -540,6 +558,7 @@ declare const socialProviders: {
       verifyClaims: ((claims: Record<string, unknown>) => boolean) | undefined;
     };
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -577,6 +596,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -594,6 +614,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -630,6 +651,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -646,6 +668,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -683,6 +706,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -700,6 +724,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -736,6 +761,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -752,6 +778,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -783,6 +810,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -800,6 +828,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -837,6 +866,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }) => Promise<{
       url: URL;
@@ -854,6 +884,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -891,6 +922,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -908,6 +940,7 @@ declare const socialProviders: {
     }): Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -945,6 +978,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -961,6 +995,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -998,6 +1033,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }) => Promise<{
       url: URL;
@@ -1014,6 +1050,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -1052,6 +1089,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }) => Promise<{
       url: URL;
@@ -1069,6 +1107,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -1126,6 +1165,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): {
       url: URL;
@@ -1142,6 +1182,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -1178,6 +1219,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -1194,6 +1236,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -1230,6 +1273,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -1246,6 +1290,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -1283,6 +1328,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -1300,6 +1346,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -1337,6 +1384,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -1355,6 +1403,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(data: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -1392,6 +1441,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }) => Promise<{
       url: URL;
@@ -1409,6 +1459,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -1445,6 +1496,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -1461,6 +1513,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -1497,6 +1550,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -1513,6 +1567,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -1570,6 +1625,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -1586,6 +1642,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -1645,6 +1702,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -1665,6 +1723,7 @@ declare const socialProviders: {
       verify: (token: string, nonce: string | undefined) => Promise<boolean>;
     };
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -1724,6 +1783,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -1741,6 +1801,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -1777,6 +1838,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -1802,6 +1864,7 @@ declare const socialProviders: {
       accessTokenExpiresAt: Date | undefined;
     }>);
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -1860,6 +1923,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -1877,6 +1941,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -1914,6 +1979,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -1931,6 +1997,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -1968,6 +2035,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -1984,6 +2052,7 @@ declare const socialProviders: {
       deviceId?: string | undefined;
     }) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2020,6 +2089,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): {
       url: URL;
@@ -2049,6 +2119,7 @@ declare const socialProviders: {
       scopes: string[];
     }>);
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;

package/dist/social-providers/kakao.d.mts

@@ -106,6 +106,7 @@ declare const kakao: (options: KakaoOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
   }): Promise<{
     url: URL;
@@ -122,6 +123,7 @@ declare const kakao: (options: KakaoOptions) => {
   }) => Promise<OAuth2Tokens>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;

package/dist/social-providers/kick.d.mts

@@ -38,6 +38,7 @@ declare const kick: (options: KickOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
   }): Promise<{
     url: URL;
@@ -55,6 +56,7 @@ declare const kick: (options: KickOptions) => {
   }): Promise<OAuth2Tokens>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;

package/dist/social-providers/line.d.mts

@@ -48,6 +48,7 @@ declare const line: (options: LineOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
   }): Promise<{
     url: URL;
@@ -68,6 +69,7 @@ declare const line: (options: LineOptions) => {
     verify: (token: string, nonce: string | undefined) => Promise<boolean>;
   };
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;

package/dist/social-providers/linear.d.mts

@@ -34,6 +34,7 @@ declare const linear: (options: LinearOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
   }): Promise<{
     url: URL;
@@ -50,6 +51,7 @@ declare const linear: (options: LinearOptions) => {
   }) => Promise<OAuth2Tokens>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;

package/dist/social-providers/linkedin.d.mts

@@ -33,6 +33,7 @@ declare const linkedin: (options: LinkedInOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
   }) => Promise<{
     url: URL;
@@ -49,6 +50,7 @@ declare const linkedin: (options: LinkedInOptions) => {
   }) => Promise<OAuth2Tokens>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;

package/dist/social-providers/microsoft-entra-id.d.mts

@@ -147,6 +147,7 @@ declare const microsoft: (options: MicrosoftOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
   }): Promise<{
     url: URL;
@@ -172,8 +173,19 @@ declare const microsoft: (options: MicrosoftOptions) => {
      * @see https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols#endpoints
      */
     issuer: string | undefined;
+    /**
+     * The multi-tenant endpoints (common/organizations/consumers) skip the
+     * issuer check above because the issuer varies per tenant, and the
+     * organizations and consumers JWKS sets overlap. Enforce the tenant
+     * binding explicitly so a token from a disallowed account class cannot
+     * pass: the issuer must name the token's own tenant, and the account
+     * class must match the configured restriction.
+     * @see https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference
+     */
+    verifyClaims: (claims: Record<string, unknown>) => boolean;
   };
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;

package/dist/social-providers/microsoft-entra-id.mjs

@@ -9,6 +9,13 @@ import { base64 } from "@better-auth/utils/base64";
 import { decodeJwt, importJWK } from "jose";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/social-providers/microsoft-entra-id.ts
+/**
+* Microsoft's fixed tenant id for personal (consumer) Microsoft accounts. Every
+* personal-account token carries it as the `tid` claim, so it distinguishes the
+* consumer account class from work/school tenants.
+* @see https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference
+*/
+const MICROSOFT_CONSUMER_TENANT_ID = "9188040d-6c67-4c5b-b112-36a304b66dad";
 const MICROSOFT_ENTRA_ID_DEFAULT_SCOPES = [
 	"openid",
 	"profile",
@@ -18,7 +25,8 @@ const MICROSOFT_ENTRA_ID_DEFAULT_SCOPES = [
 ];
 const microsoft = (options) => {
 	const tenant = options.tenantId || "common";
-	const authority = options.authority || "https://login.microsoftonline.com";
+	let authority = options.authority || "https://login.microsoftonline.com";
+	while (authority.endsWith("/")) authority = authority.slice(0, -1);
 	const authorizationEndpoint = `${authority}/${tenant}/oauth2/v2.0/authorize`;
 	const tokenEndpoint = `${authority}/${tenant}/oauth2/v2.0/token`;
 	if (options.clientSecret && options.clientAssertion) throw new BetterAuthError("Microsoft Entra ID clientAssertion cannot be combined with clientSecret");
@@ -63,7 +71,14 @@ const microsoft = (options) => {
 			jwks: (header) => getMicrosoftPublicKey(header.kid, tenant, authority),
 			audience: options.clientId,
 			maxTokenAge: "1h",
-			issuer: tenant !== "common" && tenant !== "organizations" && tenant !== "consumers" ? `${authority}/${tenant}/v2.0` : void 0
+			issuer: tenant !== "common" && tenant !== "organizations" && tenant !== "consumers" ? `${authority}/${tenant}/v2.0` : void 0,
+			verifyClaims: (claims) => {
+				const tid = claims.tid;
+				if (typeof tid !== "string" || claims.iss !== `${authority}/${tid}/v2.0`) return false;
+				if (tenant === "organizations" && tid === MICROSOFT_CONSUMER_TENANT_ID) return false;
+				if (tenant === "consumers" && tid !== MICROSOFT_CONSUMER_TENANT_ID) return false;
+				return true;
+			}
 		},
 		async getUserInfo(token) {
 			if (options.getUserInfo) return options.getUserInfo(token);