@better-auth/core 1.7.1 → 1.7.3

package/dist/social-providers/cloudflare.mjs

@@ -0,0 +1,85 @@
+import { logger } from "../env/logger.mjs";
+import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
+import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
+import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
+import { betterFetch } from "@better-fetch/fetch";
+//#region src/social-providers/cloudflare.ts
+const authorizationEndpoint = "https://dash.cloudflare.com/oauth2/auth";
+const tokenEndpoint = "https://dash.cloudflare.com/oauth2/token";
+/**
+* Cloudflare's OIDC `userinfo` endpoint only returns the `sub` claim, so it
+* cannot be used to build a user. The user's profile (email, name, ...) is
+* read from the Cloudflare API `/user` endpoint instead, which the access
+* token can call when the `user-details.read` scope is granted.
+*/
+const userEndpoint = "https://api.cloudflare.com/client/v4/user";
+const getTokenEndpointAuth = (options) => {
+	const defaultMethod = options.clientSecret ? "client_secret_basic" : "none";
+	return { method: options.tokenEndpointAuthMethod ?? defaultMethod };
+};
+const cloudflare = (options) => {
+	return {
+		id: "cloudflare",
+		name: "Cloudflare",
+		accountSubject: ({ profile }) => profile.id,
+		createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }) {
+			const _scopes = options.disableDefaultScope ? [] : ["user-details.read"];
+			if (options.scope?.length) _scopes.push(...options.scope);
+			if (scopes?.length) _scopes.push(...scopes);
+			return createAuthorizationURL({
+				id: "cloudflare",
+				options,
+				authorizationEndpoint,
+				scopes: _scopes.length ? [...new Set(_scopes)] : void 0,
+				state,
+				codeVerifier,
+				redirectURI
+			});
+		},
+		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+			return validateAuthorizationCode({
+				code,
+				codeVerifier,
+				redirectURI,
+				options,
+				tokenEndpoint,
+				tokenEndpointAuth: getTokenEndpointAuth(options)
+			});
+		},
+		refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+			return refreshAccessToken({
+				refreshToken,
+				options: {
+					clientId: options.clientId,
+					clientKey: options.clientKey,
+					clientSecret: options.clientSecret
+				},
+				tokenEndpoint,
+				tokenEndpointAuth: getTokenEndpointAuth(options)
+			});
+		},
+		async getUserInfo(token) {
+			if (options.getUserInfo) return options.getUserInfo(token);
+			const { data, error } = await betterFetch(userEndpoint, { headers: { authorization: `Bearer ${token.accessToken}` } });
+			if (error || !data?.success || !data.result) {
+				logger.error("Failed to fetch user info from Cloudflare:", error ?? data?.errors);
+				return null;
+			}
+			const profile = data.result;
+			const name = [profile.first_name, profile.last_name].filter(Boolean).join(" ") || profile.email;
+			const userMap = await options.mapProfileToUser?.(profile);
+			return {
+				user: {
+					name,
+					email: profile.email,
+					emailVerified: false,
+					...userMap
+				},
+				data: profile
+			};
+		},
+		options
+	};
+};
+//#endregion
+export { cloudflare };

package/dist/social-providers/cognito.d.mts

@@ -52,7 +52,6 @@ declare const cognito: (options: CognitoOptions) => {
   accountSubject: ({
     profile
   }: OAuthAccountKeyContext<CognitoProfile>) => string;
-  accountIssuer: string;
   createAuthorizationURL({
     state,
     scopes,

package/dist/social-providers/cognito.mjs

@@ -20,7 +20,6 @@ const cognito = (options) => {
 		id: "cognito",
 		name: "Cognito",
 		accountSubject: ({ profile }) => profile.sub,
-		accountIssuer: `https://cognito-idp.${options.region}.amazonaws.com/${options.userPoolId}`,
 		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, additionalParams }) {
 			if (!getPrimaryClientId(options.clientId)) {
 				logger.error("ClientId is required for Amazon Cognito. Make sure to provide them in the options.");

package/dist/social-providers/facebook.d.mts

@@ -42,7 +42,6 @@ declare const facebook: (options: FacebookOptions) => {
   accountSubject: ({
     profile
   }: OAuthAccountKeyContext<FacebookProfile>) => string;
-  accountIssuer: string;
   createAuthorizationURL({
     state,
     scopes,

package/dist/social-providers/facebook.mjs

@@ -40,7 +40,6 @@ const facebook = (options) => {
 		id: "facebook",
 		name: "Facebook",
 		accountSubject: ({ profile }) => "sub" in profile ? profile.sub : profile.id,
-		accountIssuer: "https://www.facebook.com",
 		async createAuthorizationURL({ state, scopes, redirectURI, loginHint, additionalParams }) {
 			if (!getPrimaryClientId(options.clientId) || !options.clientSecret) {
 				logger.error("Client ID and client secret are required for Facebook. Make sure to provide them in the options.");

package/dist/social-providers/google.d.mts

@@ -85,7 +85,6 @@ declare const google: (options: GoogleOptions) => {
   accountSubject: ({
     profile
   }: OAuthAccountKeyContext<GoogleProfile>) => string;
-  accountIssuer: string;
   createAuthorizationURL({
     state,
     scopes,

package/dist/social-providers/google.mjs

@@ -54,7 +54,6 @@ const google = (options) => {
 		id: "google",
 		name: "Google",
 		accountSubject: ({ profile }) => profile.sub,
-		accountIssuer: "https://accounts.google.com",
 		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, loginHint, display, additionalParams }) {
 			if (!getPrimaryClientId(options.clientId) || !options.clientSecret) {
 				logger.error("Client Id and Client Secret is required for Google. Make sure to provide them in the options.");

package/dist/social-providers/index.d.mts

@@ -1,5 +1,6 @@
 import { AppleNonConformUser, AppleOptions, AppleProfile, apple, getApplePublicKey } from "./apple.mjs";
 import { AtlassianOptions, AtlassianProfile, atlassian } from "./atlassian.mjs";
+import { CloudflareOptions, CloudflareProfile, cloudflare } from "./cloudflare.mjs";
 import { CognitoOptions, CognitoProfile, cognito, getCognitoPublicKey } from "./cognito.mjs";
 import { DiscordOptions, DiscordProfile, discord } from "./discord.mjs";
 import { FacebookGraphProfile, FacebookLimitedLoginProfile, FacebookOptions, FacebookProfile, facebook } from "./facebook.mjs";
@@ -46,7 +47,6 @@ declare const socialProviders: {
     accountSubject: ({
       profile
     }: OAuthAccountKeyContext<AppleProfile>) => string;
-    accountIssuer: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -158,13 +158,59 @@ declare const socialProviders: {
     } | null>;
     options: AtlassianOptions;
   };
+  cloudflare: (options: CloudflareOptions) => {
+    id: "cloudflare";
+    name: string;
+    accountSubject: ({
+      profile
+    }: OAuthAccountKeyContext<CloudflareProfile>) => string;
+    createAuthorizationURL({
+      state,
+      scopes,
+      codeVerifier,
+      redirectURI
+    }: {
+      state: string;
+      codeVerifier: string;
+      scopes?: string[] | undefined;
+      redirectURI: string;
+      display?: string | undefined;
+      loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<URL>;
+    validateAuthorizationCode: ({
+      code,
+      codeVerifier,
+      redirectURI
+    }: {
+      code: string;
+      redirectURI: string;
+      codeVerifier?: string | undefined;
+      deviceId?: string | undefined;
+    }) => Promise<OAuth2Tokens>;
+    refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
+    getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
+      user?: {
+        name?: {
+          firstName?: string;
+          lastName?: string;
+        };
+        email?: string;
+      } | undefined;
+    }): Promise<{
+      user: OAuth2UserInfo & Record<string, unknown>;
+      data: CloudflareProfile;
+    } | null>;
+    options: CloudflareOptions;
+  };
   cognito: (options: CognitoOptions) => {
     id: "cognito";
     name: string;
     accountSubject: ({
       profile
     }: OAuthAccountKeyContext<CognitoProfile>) => string;
-    accountIssuer: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -292,7 +338,6 @@ declare const socialProviders: {
     accountSubject: ({
       profile
     }: OAuthAccountKeyContext<FacebookProfile>) => string;
-    accountIssuer: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -451,9 +496,6 @@ declare const socialProviders: {
     accountSubject: ({
       profile
     }: OAuthAccountKeyContext<MicrosoftEntraIDProfile>) => string;
-    accountIssuer: ({
-      profile
-    }: OAuthAccountKeyContext<MicrosoftEntraIDProfile>) => string;
     createAuthorizationURL(data: {
       state: string;
       codeVerifier: string;
@@ -503,7 +545,6 @@ declare const socialProviders: {
     accountSubject: ({
       profile
     }: OAuthAccountKeyContext<GoogleProfile>) => string;
-    accountIssuer: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -1047,6 +1088,7 @@ declare const socialProviders: {
     }): URL;
     validateAuthorizationCode: ({
       code,
+      codeVerifier,
       redirectURI
     }: {
       code: string;
@@ -1468,7 +1510,6 @@ declare const socialProviders: {
     accountSubject: ({
       profile
     }: OAuthAccountKeyContext<LineIdTokenPayload | LineUserInfo>) => string;
-    accountIssuer: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -1521,7 +1562,6 @@ declare const socialProviders: {
     accountSubject: ({
       profile
     }: OAuthAccountKeyContext<PaybinProfile>) => string;
-    accountIssuer: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -1588,23 +1628,15 @@ declare const socialProviders: {
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
+      codeVerifier,
       redirectURI
     }: {
       code: string;
       redirectURI: string;
       codeVerifier?: string | undefined;
       deviceId?: string | undefined;
-    }) => Promise<{
-      accessToken: string;
-      refreshToken: string | undefined;
-      accessTokenExpiresAt: Date | undefined;
-      idToken: string | undefined;
-    }>;
-    refreshAccessToken: ((refreshToken: string) => Promise<OAuth2Tokens>) | ((refreshToken: string) => Promise<{
-      accessToken: any;
-      refreshToken: any;
-      accessTokenExpiresAt: Date | undefined;
-    }>);
+    }) => Promise<OAuth2Tokens>;
+    refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
       expectedIdTokenNonce?: string | undefined;
       user?: {
@@ -1840,4 +1872,4 @@ type SocialProviders = { [K in SocialProviderList[number]]?: AwaitableFunction<P
 }> };
 type SocialProviderList = typeof socialProviderList;
 //#endregion
-export { AccountStatus, AppleNonConformUser, AppleOptions, AppleProfile, AtlassianOptions, AtlassianProfile, CognitoOptions, CognitoProfile, DiscordOptions, DiscordProfile, DropboxOptions, DropboxProfile, FacebookGraphProfile, FacebookLimitedLoginProfile, FacebookOptions, FacebookProfile, FigmaOptions, FigmaProfile, GithubOptions, GithubProfile, GitlabOptions, GitlabProfile, GoogleOptions, GoogleProfile, HuggingFaceOptions, HuggingFaceProfile, KakaoOptions, KakaoProfile, KickOptions, KickProfile, LineIdTokenPayload, LineOptions, LineUserInfo, LinearOptions, LinearProfile, LinearUser, LinkedInOptions, LinkedInProfile, LoginType, MicrosoftEntraIDProfile, MicrosoftOptions, NaverOptions, NaverProfile, NotionOptions, NotionProfile, PayPalOptions, PayPalProfile, PayPalTokenResponse, PaybinOptions, PaybinProfile, PhoneNumber, PolarOptions, PolarProfile, PronounOption, RailwayOptions, RailwayProfile, RedditOptions, RedditProfile, RobloxOptions, RobloxProfile, SalesforceOptions, SalesforceProfile, SlackOptions, SlackProfile, SocialProvider, SocialProviderList, SocialProviderListEnum, SocialProviders, SpotifyOptions, SpotifyProfile, TiktokOptions, TiktokProfile, TwitchOptions, TwitchProfile, TwitterOption, TwitterProfile, VercelOptions, VercelProfile, VerifyGoogleIdTokenOptions, VkOption, VkProfile, WeChatOptions, WeChatProfile, ZoomOptions, ZoomProfile, apple, atlassian, cognito, discord, dropbox, facebook, figma, getApplePublicKey, getCognitoPublicKey, getGooglePublicKey, getMicrosoftPublicKey, github, gitlab, google, huggingface, isGoogleHostedDomainAllowed, kakao, kick, line, linear, linkedin, microsoft, naver, notion, paybin, paypal, polar, railway, reddit, roblox, salesforce, slack, socialProviderList, socialProviders, spotify, tiktok, twitch, twitter, vercel, verifyGoogleIdToken, vk, wechat, zoom };
+export { AccountStatus, AppleNonConformUser, AppleOptions, AppleProfile, AtlassianOptions, AtlassianProfile, CloudflareOptions, CloudflareProfile, CognitoOptions, CognitoProfile, DiscordOptions, DiscordProfile, DropboxOptions, DropboxProfile, FacebookGraphProfile, FacebookLimitedLoginProfile, FacebookOptions, FacebookProfile, FigmaOptions, FigmaProfile, GithubOptions, GithubProfile, GitlabOptions, GitlabProfile, GoogleOptions, GoogleProfile, HuggingFaceOptions, HuggingFaceProfile, KakaoOptions, KakaoProfile, KickOptions, KickProfile, LineIdTokenPayload, LineOptions, LineUserInfo, LinearOptions, LinearProfile, LinearUser, LinkedInOptions, LinkedInProfile, LoginType, MicrosoftEntraIDProfile, MicrosoftOptions, NaverOptions, NaverProfile, NotionOptions, NotionProfile, PayPalOptions, PayPalProfile, PayPalTokenResponse, PaybinOptions, PaybinProfile, PhoneNumber, PolarOptions, PolarProfile, PronounOption, RailwayOptions, RailwayProfile, RedditOptions, RedditProfile, RobloxOptions, RobloxProfile, SalesforceOptions, SalesforceProfile, SlackOptions, SlackProfile, SocialProvider, SocialProviderList, SocialProviderListEnum, SocialProviders, SpotifyOptions, SpotifyProfile, TiktokOptions, TiktokProfile, TwitchOptions, TwitchProfile, TwitterOption, TwitterProfile, VercelOptions, VercelProfile, VerifyGoogleIdTokenOptions, VkOption, VkProfile, WeChatOptions, WeChatProfile, ZoomOptions, ZoomProfile, apple, atlassian, cloudflare, cognito, discord, dropbox, facebook, figma, getApplePublicKey, getCognitoPublicKey, getGooglePublicKey, getMicrosoftPublicKey, github, gitlab, google, huggingface, isGoogleHostedDomainAllowed, kakao, kick, line, linear, linkedin, microsoft, naver, notion, paybin, paypal, polar, railway, reddit, roblox, salesforce, slack, socialProviderList, socialProviders, spotify, tiktok, twitch, twitter, vercel, verifyGoogleIdToken, vk, wechat, zoom };

package/dist/social-providers/index.mjs

@@ -1,5 +1,6 @@
 import { apple, getApplePublicKey } from "./apple.mjs";
 import { atlassian } from "./atlassian.mjs";
+import { cloudflare } from "./cloudflare.mjs";
 import { cognito, getCognitoPublicKey } from "./cognito.mjs";
 import { discord } from "./discord.mjs";
 import { dropbox } from "./dropbox.mjs";
@@ -38,6 +39,7 @@ import * as z from "zod";
 const socialProviders = {
 	apple,
 	atlassian,
+	cloudflare,
 	cognito,
 	discord,
 	facebook,
@@ -75,4 +77,4 @@ const socialProviders = {
 const socialProviderList = Object.keys(socialProviders);
 const SocialProviderListEnum = z.enum(socialProviderList).or(z.string());
 //#endregion
-export { SocialProviderListEnum, apple, atlassian, cognito, discord, dropbox, facebook, figma, getApplePublicKey, getCognitoPublicKey, getGooglePublicKey, getMicrosoftPublicKey, github, gitlab, google, huggingface, isGoogleHostedDomainAllowed, kakao, kick, line, linear, linkedin, microsoft, naver, notion, paybin, paypal, polar, railway, reddit, roblox, salesforce, slack, socialProviderList, socialProviders, spotify, tiktok, twitch, twitter, vercel, verifyGoogleIdToken, vk, wechat, zoom };
+export { SocialProviderListEnum, apple, atlassian, cloudflare, cognito, discord, dropbox, facebook, figma, getApplePublicKey, getCognitoPublicKey, getGooglePublicKey, getMicrosoftPublicKey, github, gitlab, google, huggingface, isGoogleHostedDomainAllowed, kakao, kick, line, linear, linkedin, microsoft, naver, notion, paybin, paypal, polar, railway, reddit, roblox, salesforce, slack, socialProviderList, socialProviders, spotify, tiktok, twitch, twitter, vercel, verifyGoogleIdToken, vk, wechat, zoom };

package/dist/social-providers/line.d.mts

@@ -36,7 +36,6 @@ declare const line: (options: LineOptions) => {
   accountSubject: ({
     profile
   }: OAuthAccountKeyContext<LineIdTokenPayload | LineUserInfo>) => string;
-  accountIssuer: string;
   createAuthorizationURL({
     state,
     scopes,

package/dist/social-providers/line.mjs

@@ -22,7 +22,6 @@ const line = (options) => {
 		id: "line",
 		name: "LINE",
 		accountSubject: ({ profile }) => profile.sub,
-		accountIssuer: "https://access.line.me",
 		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, loginHint, additionalParams }) {
 			const _scopes = options.disableDefaultScope ? [] : [
 				"openid",

package/dist/social-providers/microsoft-entra-id.d.mts

@@ -142,9 +142,6 @@ declare const microsoft: (options: MicrosoftOptions) => {
   accountSubject: ({
     profile
   }: OAuthAccountKeyContext<MicrosoftEntraIDProfile>) => string;
-  accountIssuer: ({
-    profile
-  }: OAuthAccountKeyContext<MicrosoftEntraIDProfile>) => string;
   createAuthorizationURL(data: {
     state: string;
     codeVerifier: string;

package/dist/social-providers/microsoft-entra-id.mjs

@@ -30,7 +30,6 @@ const microsoft = (options) => {
 		id: "microsoft",
 		name: "Microsoft EntraID",
 		accountSubject: ({ profile }) => profile.oid,
-		accountIssuer: ({ profile }) => profile.iss,
 		createAuthorizationURL(data) {
 			if (!getPrimaryClientId(options.clientId)) {
 				logger.error("Client Id is required for Microsoft Entra ID. Make sure to provide it in the options.");

package/dist/social-providers/paybin.d.mts

@@ -24,7 +24,6 @@ declare const paybin: (options: PaybinOptions) => {
   accountSubject: ({
     profile
   }: OAuthAccountKeyContext<PaybinProfile>) => string;
-  accountIssuer: string;
   createAuthorizationURL({
     state,
     scopes,

package/dist/social-providers/paybin.mjs

@@ -13,7 +13,6 @@ const paybin = (options) => {
 		id: "paybin",
 		name: "Paybin",
 		accountSubject: ({ profile }) => profile.sub,
-		accountIssuer: issuer,
 		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, loginHint, additionalParams }) {
 			if (!options.clientId || !options.clientSecret) {
 				logger.error("Client Id and Client Secret is required for Paybin. Make sure to provide them in the options.");

package/dist/social-providers/paypal.d.mts

@@ -72,23 +72,15 @@ declare const paypal: (options: PayPalOptions) => {
   }): Promise<URL>;
   validateAuthorizationCode: ({
     code,
+    codeVerifier,
     redirectURI
   }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;
     deviceId?: string | undefined;
-  }) => Promise<{
-    accessToken: string;
-    refreshToken: string | undefined;
-    accessTokenExpiresAt: Date | undefined;
-    idToken: string | undefined;
-  }>;
-  refreshAccessToken: ((refreshToken: string) => Promise<OAuth2Tokens>) | ((refreshToken: string) => Promise<{
-    accessToken: any;
-    refreshToken: any;
-    accessTokenExpiresAt: Date | undefined;
-  }>);
+  }) => Promise<OAuth2Tokens>;
+  refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   getUserInfo(token: OAuth2Tokens & {
     expectedIdTokenNonce?: string | undefined;
     user?: {

package/dist/social-providers/paypal.mjs

@@ -1,7 +1,8 @@
 import { BetterAuthError } from "../error/index.mjs";
 import { logger } from "../env/logger.mjs";
 import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
-import { base64 } from "@better-auth/utils/base64";
+import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
+import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
 import { decodeJwt } from "jose";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/social-providers/paypal.ts
@@ -10,6 +11,11 @@ const paypal = (options) => {
 	const authorizationEndpoint = isSandbox ? "https://www.sandbox.paypal.com/signin/authorize" : "https://www.paypal.com/signin/authorize";
 	const tokenEndpoint = isSandbox ? "https://api-m.sandbox.paypal.com/v1/oauth2/token" : "https://api-m.paypal.com/v1/oauth2/token";
 	const userInfoEndpoint = isSandbox ? "https://api-m.sandbox.paypal.com/v1/identity/oauth2/userinfo" : "https://api-m.paypal.com/v1/identity/oauth2/userinfo";
+	const tokenRequestOptions = {
+		clientId: options.clientId,
+		clientSecret: options.clientSecret
+	};
+	const tokenEndpointAuth = { method: "client_secret_basic" };
 	return {
 		id: "paypal",
 		name: "PayPal",
@@ -31,62 +37,29 @@ const paypal = (options) => {
 				additionalParams
 			});
 		},
-		validateAuthorizationCode: async ({ code, redirectURI }) => {
-			/**
-			* PayPal requires Basic Auth for token exchange
-			**/
-			const credentials = base64.encode(`${options.clientId}:${options.clientSecret}`);
+		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
 			try {
-				const response = await betterFetch(tokenEndpoint, {
-					method: "POST",
-					headers: {
-						Authorization: `Basic ${credentials}`,
-						Accept: "application/json",
-						"Accept-Language": "en_US",
-						"Content-Type": "application/x-www-form-urlencoded"
-					},
-					body: new URLSearchParams({
-						grant_type: "authorization_code",
-						code,
-						redirect_uri: redirectURI
-					}).toString()
+				return await validateAuthorizationCode({
+					code,
+					codeVerifier,
+					redirectURI: options.redirectURI || redirectURI,
+					options: tokenRequestOptions,
+					tokenEndpoint,
+					tokenEndpointAuth
 				});
-				if (!response.data) throw new BetterAuthError("FAILED_TO_GET_ACCESS_TOKEN");
-				const data = response.data;
-				return {
-					accessToken: data.access_token,
-					refreshToken: data.refresh_token,
-					accessTokenExpiresAt: data.expires_in ? new Date(Date.now() + data.expires_in * 1e3) : void 0,
-					idToken: data.id_token
-				};
 			} catch (error) {
 				logger.error("PayPal token exchange failed:", error);
 				throw new BetterAuthError("FAILED_TO_GET_ACCESS_TOKEN");
 			}
 		},
 		refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
-			const credentials = base64.encode(`${options.clientId}:${options.clientSecret}`);
 			try {
-				const response = await betterFetch(tokenEndpoint, {
-					method: "POST",
-					headers: {
-						Authorization: `Basic ${credentials}`,
-						Accept: "application/json",
-						"Accept-Language": "en_US",
-						"Content-Type": "application/x-www-form-urlencoded"
-					},
-					body: new URLSearchParams({
-						grant_type: "refresh_token",
-						refresh_token: refreshToken
-					}).toString()
+				return await refreshAccessToken({
+					refreshToken,
+					options: tokenRequestOptions,
+					tokenEndpoint,
+					tokenEndpointAuth
 				});
-				if (!response.data) throw new BetterAuthError("FAILED_TO_REFRESH_ACCESS_TOKEN");
-				const data = response.data;
-				return {
-					accessToken: data.access_token,
-					refreshToken: data.refresh_token,
-					accessTokenExpiresAt: data.expires_in ? new Date(Date.now() + data.expires_in * 1e3) : void 0
-				};
 			} catch (error) {
 				logger.error("PayPal token refresh failed:", error);
 				throw new BetterAuthError("FAILED_TO_REFRESH_ACCESS_TOKEN");

package/dist/social-providers/reddit.mjs

@@ -1,10 +1,16 @@
-import { getOAuth2Tokens } from "../oauth2/utils.mjs";
 import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
 import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
-import { base64 } from "@better-auth/utils/base64";
+import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
+import { createPlaceholderEmail } from "../utils/email.mjs";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/social-providers/reddit.ts
 const reddit = (options) => {
+	const tokenEndpoint = "https://www.reddit.com/api/v1/access_token";
+	const tokenRequestOptions = {
+		clientId: options.clientId,
+		clientSecret: options.clientSecret
+	};
+	const tokenEndpointAuth = { method: "client_secret_basic" };
 	return {
 		id: "reddit",
 		name: "Reddit",
@@ -25,34 +31,24 @@ const reddit = (options) => {
 			});
 		},
 		validateAuthorizationCode: async ({ code, redirectURI }) => {
-			const body = new URLSearchParams({
-				grant_type: "authorization_code",
+			return validateAuthorizationCode({
 				code,
-				redirect_uri: options.redirectURI || redirectURI
-			});
-			const { data, error } = await betterFetch("https://www.reddit.com/api/v1/access_token", {
-				method: "POST",
+				redirectURI: options.redirectURI || redirectURI,
+				options: tokenRequestOptions,
+				tokenEndpoint,
+				tokenEndpointAuth,
 				headers: {
-					"content-type": "application/x-www-form-urlencoded",
 					accept: "text/plain",
-					"user-agent": "better-auth",
-					Authorization: `Basic ${base64.encode(`${options.clientId}:${options.clientSecret}`)}`
-				},
-				body: body.toString()
+					"user-agent": "better-auth"
+				}
 			});
-			if (error) throw error;
-			return getOAuth2Tokens(data);
 		},
 		refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
 			return refreshAccessToken({
 				refreshToken,
-				options: {
-					clientId: options.clientId,
-					clientKey: options.clientKey,
-					clientSecret: options.clientSecret
-				},
-				authentication: "basic",
-				tokenEndpoint: "https://www.reddit.com/api/v1/access_token"
+				options: tokenRequestOptions,
+				tokenEndpoint,
+				tokenEndpointAuth
 			});
 		},
 		async getUserInfo(token) {
@@ -63,7 +59,10 @@ const reddit = (options) => {
 			} });
 			if (error) return null;
 			const userMap = await options.mapProfileToUser?.(profile);
-			const email = userMap?.email || `${profile.id}@reddit.invalid`;
+			const email = userMap?.email || createPlaceholderEmail({
+				identifier: profile.id,
+				namespace: "reddit"
+			});
 			return {
 				user: {
 					name: profile.name,

package/dist/social-providers/roblox.mjs

@@ -1,6 +1,7 @@
 import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
 import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
 import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
+import { createPlaceholderEmail } from "../utils/email.mjs";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/social-providers/roblox.ts
 const roblox = (options) => {
@@ -53,7 +54,10 @@ const roblox = (options) => {
 				user: {
 					name: profile.nickname || profile.preferred_username || "",
 					image: profile.picture,
-					email: profile.preferred_username || null,
+					email: createPlaceholderEmail({
+						identifier: profile.sub,
+						namespace: "roblox"
+					}),
 					emailVerified: false,
 					...userMap
 				},

package/dist/social-providers/tiktok.d.mts

@@ -141,6 +141,7 @@ declare const tiktok: (options: TiktokOptions) => {
   }): URL;
   validateAuthorizationCode: ({
     code,
+    codeVerifier,
     redirectURI
   }: {
     code: string;