@stripe/link-integrations-better-auth 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Stripe, LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,106 @@
+# Link for Better Auth
+
+Sign in with Link or connect a Link wallet to an existing user. Better Auth manages OAuth, token storage, and refresh.
+
+## Setup
+
+Requires Node.js 22+ and Better Auth 1.7.5+.
+
+```sh
+pnpm add @stripe/link-integrations-better-auth better-auth
+```
+
+[Register a Link OAuth client](https://docs.stripe.com/agentic-commerce/link-cli/oauth) with the callback URL `https://yourapp.com/api/auth/callback/link`. Adjust the path if you use a custom Better Auth base path, and register any local development callback too.
+
+Add the plugin to your server configuration:
+
+```ts
+import { betterAuth } from 'better-auth';
+import { link } from '@stripe/link-integrations-better-auth';
+
+export const auth = betterAuth({
+  account: {
+    encryptOAuthTokens: true,
+    accountLinking: {
+      trustedProviders: ['link'],
+      // Allow the wallet email to differ from the app user's email.
+      allowDifferentEmails: true,
+    },
+  },
+  plugins: [
+    link({
+      clientId: process.env.LINK_CLIENT_ID!,
+      clientSecret: process.env.LINK_CLIENT_SECRET!,
+      publishableKey: process.env.STRIPE_PUBLISHABLE_KEY!,
+    }),
+  ],
+});
+```
+
+Then register the client plugin:
+
+```ts
+import { linkClient } from '@stripe/link-integrations-better-auth/client';
+import { createAuthClient } from 'better-auth/react';
+
+export const authClient = createAuthClient({ plugins: [linkClient()] });
+```
+
+Default scopes are `payment_methods.agentic` and `userinfo:read`. For sign-in only, set `scopes: ['userinfo:read']` in `link(...)`. Keep `userinfo:read` when customizing scopes.
+
+## Connect a wallet
+
+After the user signs in to your app:
+
+```ts
+await authClient.link.connect({ callbackURL: '/settings' });
+```
+
+For server-side usage:
+
+```ts
+await auth.api.connectLink({
+  body: { callbackURL: '/settings' },
+  headers: await headers(),
+});
+```
+
+This starts Better Auth's OAuth linking flow and returns the user to `/settings` after authorization.
+
+`connect` follows Better Auth's configured client error handling.
+
+## Disconnect a wallet
+
+Find the connected account and pass its Better Auth record ID:
+
+```ts
+const { data: accounts, error } = await authClient.listAccounts();
+if (error) throw new Error(error.message);
+
+const account = accounts?.find((account) => account.providerId === 'link');
+if (account) {
+  const { error } = await authClient.link.disconnect({ accountId: account.id });
+  if (error) throw new Error(error.message);
+}
+```
+
+Disconnect requires a fresh session and protects the user's last sign-in method by default. It revokes Link access before deleting the local account; failed revocation keeps the connection intact for retry.
+
+Use `account.id` for account operations. `account.accountId` is the stable Link user ID.
+
+## Sign in with Link
+
+To let users sign in or create an app account with Link:
+
+```ts
+await authClient.signIn.social({
+  provider: 'link',
+  callbackURL: '/dashboard',
+});
+```
+
+Better Auth's account-linking and email-verification policies apply. Use `authClient.accountInfo()` for the connected profile and server-side `auth.api.getAccessToken()` for Link API calls.
+
+## Example
+
+See the [Next.js example](example/README.md) for a runnable app with sign-in, wallet connection, and disconnect.

package/dist/chunk-POKWE5ZI.js

@@ -0,0 +1,11 @@
+// src/error-codes.ts
+import { defineErrorCodes } from "better-auth";
+var LINK_ERROR_CODES = defineErrorCodes({
+  LINK_REFRESH_TOKEN_NOT_FOUND: "Link refresh token is missing. The account remains connected.",
+  LINK_REVOCATION_FAILED: "Unable to revoke Link access. The account remains connected; try again."
+});
+
+export {
+  LINK_ERROR_CODES
+};
+//# sourceMappingURL=chunk-POKWE5ZI.js.map

package/dist/chunk-POKWE5ZI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/error-codes.ts"],"sourcesContent":["import { defineErrorCodes } from 'better-auth';\n\nexport const LINK_ERROR_CODES = defineErrorCodes({\n  LINK_REFRESH_TOKEN_NOT_FOUND:\n    'Link refresh token is missing. The account remains connected.',\n  LINK_REVOCATION_FAILED:\n    'Unable to revoke Link access. The account remains connected; try again.',\n});\n"],"mappings":";AAAA,SAAS,wBAAwB;AAE1B,IAAM,mBAAmB,iBAAiB;AAAA,EAC/C,8BACE;AAAA,EACF,wBACE;AACJ,CAAC;","names":[]}

package/dist/client.d.ts

@@ -0,0 +1,15 @@
+import type { link } from './index';
+export declare const linkClient: () => {
+    id: "link";
+    $InferServerPlugin: ReturnType<typeof link>;
+    pathMethods: {
+        '/link/connect': "POST";
+        '/link/disconnect': "POST";
+    };
+    $ERROR_CODES: {
+        LINK_REFRESH_TOKEN_NOT_FOUND: import("better-auth").RawError<"LINK_REFRESH_TOKEN_NOT_FOUND">;
+        LINK_REVOCATION_FAILED: import("better-auth").RawError<"LINK_REVOCATION_FAILED">;
+    };
+};
+export { LINK_ERROR_CODES } from './error-codes';
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAEpC,eAAO,MAAM,UAAU;;wBAGO,UAAU,CAAC,OAAO,IAAI,CAAC;;;;;;;;;CAMhB,CAAC;AAEtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC"}

package/dist/client.js

@@ -0,0 +1,19 @@
+import {
+  LINK_ERROR_CODES
+} from "./chunk-POKWE5ZI.js";
+
+// src/client.ts
+var linkClient = () => ({
+  id: "link",
+  $InferServerPlugin: {},
+  pathMethods: {
+    "/link/connect": "POST",
+    "/link/disconnect": "POST"
+  },
+  $ERROR_CODES: LINK_ERROR_CODES
+});
+export {
+  LINK_ERROR_CODES,
+  linkClient
+};
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client.ts"],"sourcesContent":["import type { BetterAuthClientPlugin } from 'better-auth/client';\nimport { LINK_ERROR_CODES } from './error-codes';\nimport type { link } from './index';\n\nexport const linkClient = () =>\n  ({\n    id: 'link',\n    $InferServerPlugin: {} as ReturnType<typeof link>,\n    pathMethods: {\n      '/link/connect': 'POST',\n      '/link/disconnect': 'POST',\n    },\n    $ERROR_CODES: LINK_ERROR_CODES,\n  }) satisfies BetterAuthClientPlugin;\n\nexport { LINK_ERROR_CODES } from './error-codes';\n"],"mappings":";;;;;AAIO,IAAM,aAAa,OACvB;AAAA,EACC,IAAI;AAAA,EACJ,oBAAoB,CAAC;AAAA,EACrB,aAAa;AAAA,IACX,iBAAiB;AAAA,IACjB,oBAAoB;AAAA,EACtB;AAAA,EACA,cAAc;AAChB;","names":[]}

package/dist/error-codes.d.ts

@@ -0,0 +1,5 @@
+export declare const LINK_ERROR_CODES: {
+    LINK_REFRESH_TOKEN_NOT_FOUND: import("better-auth").RawError<"LINK_REFRESH_TOKEN_NOT_FOUND">;
+    LINK_REVOCATION_FAILED: import("better-auth").RawError<"LINK_REVOCATION_FAILED">;
+};
+//# sourceMappingURL=error-codes.d.ts.map

package/dist/error-codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-codes.d.ts","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,gBAAgB;;;CAK3B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,82 @@
+import { z } from 'zod';
+declare module '@better-auth/core' {
+    interface BetterAuthPluginRegistry<AuthOptions, Options> {
+        link: {
+            creator: typeof link;
+        };
+    }
+}
+export interface LinkOptions {
+    clientId: string;
+    clientSecret: string;
+    publishableKey: string;
+    scopes?: string[];
+    redirectURI?: string;
+}
+export declare function link(options: LinkOptions): {
+    version: string;
+    init: (ctx: import("better-auth").AuthContext) => Promise<{
+        context: {
+            socialProviders: import("better-auth").OAuthProvider<object, Partial<import("better-auth").ProviderOptions<object>>>[];
+        };
+    }>;
+    options: import("better-auth/plugins/generic-oauth").GenericOAuthOptions<"link">;
+    id: "link";
+    endpoints: {
+        connectLink: import("better-auth").StrictEndpoint<"/link/connect", {
+            method: "POST";
+            requireHeaders: true;
+            body: z.ZodObject<{
+                callbackURL: z.ZodOptional<z.ZodString>;
+                requestSignUp: z.ZodOptional<z.ZodBoolean>;
+                scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                errorCallbackURL: z.ZodOptional<z.ZodString>;
+                disableRedirect: z.ZodOptional<z.ZodBoolean>;
+                loginHint: z.ZodOptional<z.ZodString>;
+                additionalParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+                additionalData: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+            }, z.core.$strip>;
+        }, {
+            url: string;
+            redirect: boolean;
+        }>;
+        disconnectLink: import("better-auth").StrictEndpoint<"/link/disconnect", {
+            method: "POST";
+            requireHeaders: true;
+            body: z.ZodObject<{
+                accountId: z.ZodString;
+            }, z.core.$strict>;
+            use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+        }, {
+            status: boolean;
+        }>;
+    };
+    $ERROR_CODES: {
+        LINK_REFRESH_TOKEN_NOT_FOUND: import("better-auth").RawError<"LINK_REFRESH_TOKEN_NOT_FOUND">;
+        LINK_REVOCATION_FAILED: import("better-auth").RawError<"LINK_REVOCATION_FAILED">;
+    };
+};
+export { LINK_ERROR_CODES } from './error-codes';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,QAAQ,mBAAmB,CAAC;IACjC,UAAU,wBAAwB,CAAC,WAAW,EAAE,OAAO;QACrD,IAAI,EAAE;YACJ,OAAO,EAAE,OAAO,IAAI,CAAC;SACtB,CAAC;KACH;CACF;AAMD,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,IAAI,CAAC,OAAO,EAAE,WAAW;;;;;;;;;;QA+CnC,WAAW;;;;;;;;;;;;;;;;;QACX,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAInB;AAED,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -0,0 +1,171 @@
+import {
+  LINK_ERROR_CODES
+} from "./chunk-POKWE5ZI.js";
+
+// src/index.ts
+import { genericOAuth } from "better-auth/plugins/generic-oauth";
+import { z as z2 } from "zod";
+
+// src/routes.ts
+import { BASE_ERROR_CODES } from "better-auth";
+import {
+  APIError,
+  createAuthEndpoint,
+  freshSessionMiddleware,
+  linkSocialAccount,
+  sensitiveSessionMiddleware
+} from "better-auth/api";
+import { decryptOAuthToken } from "better-auth/oauth2";
+import { z } from "zod";
+var connectLink = () => createAuthEndpoint(
+  "/link/connect",
+  {
+    method: "POST",
+    requireHeaders: true,
+    body: linkSocialAccount.options.body.omit({
+      provider: true,
+      idToken: true
+    })
+  },
+  async (ctx) => {
+    const { headers, response } = await linkSocialAccount({
+      body: { ...ctx.body, provider: "link" },
+      context: ctx.context,
+      headers: ctx.headers,
+      ...ctx.request ? { request: ctx.request } : {},
+      returnHeaders: true
+    });
+    for (const cookie of headers.getSetCookie()) {
+      ctx.responseHeaders.append("set-cookie", cookie);
+    }
+    headers.forEach((value, key) => {
+      if (key.toLowerCase() !== "set-cookie") {
+        ctx.responseHeaders.set(key, value);
+      }
+    });
+    return ctx.json(response);
+  }
+);
+var disconnectLink = (options) => createAuthEndpoint(
+  "/link/disconnect",
+  {
+    method: "POST",
+    requireHeaders: true,
+    body: z.strictObject({ accountId: z.string().min(1) }),
+    use: [sensitiveSessionMiddleware, freshSessionMiddleware]
+  },
+  async (ctx) => {
+    const accounts = await ctx.context.internalAdapter.findAccounts(
+      ctx.context.session.user.id
+    );
+    const account = accounts.find(
+      (candidate) => candidate.id === ctx.body.accountId && candidate.providerId === "link"
+    );
+    if (!account) {
+      throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.ACCOUNT_NOT_FOUND);
+    }
+    if (accounts.length === 1 && !ctx.context.options.account?.accountLinking?.allowUnlinkingAll) {
+      throw APIError.from(
+        "BAD_REQUEST",
+        BASE_ERROR_CODES.FAILED_TO_UNLINK_LAST_ACCOUNT
+      );
+    }
+    if (!account.refreshToken) {
+      throw APIError.from(
+        "BAD_REQUEST",
+        LINK_ERROR_CODES.LINK_REFRESH_TOKEN_NOT_FOUND
+      );
+    }
+    let response;
+    try {
+      const token = await decryptOAuthToken(
+        account.refreshToken,
+        ctx.context
+      );
+      response = await fetch("https://login.link.com/auth/revoke", {
+        method: "POST",
+        redirect: "error",
+        signal: AbortSignal.timeout(1e4),
+        headers: {
+          Authorization: `Bearer ${options.publishableKey}`,
+          "Content-Type": "application/x-www-form-urlencoded"
+        },
+        body: new URLSearchParams({
+          client_id: options.clientId,
+          client_secret: options.clientSecret,
+          token,
+          token_type_hint: "refresh_token"
+        })
+      });
+    } catch {
+      throw APIError.from(
+        "BAD_GATEWAY",
+        LINK_ERROR_CODES.LINK_REVOCATION_FAILED
+      );
+    }
+    if (!response.ok) {
+      throw APIError.from(
+        "BAD_GATEWAY",
+        LINK_ERROR_CODES.LINK_REVOCATION_FAILED
+      );
+    }
+    await ctx.context.internalAdapter.deleteAccount(account.id);
+    return ctx.json({ status: true });
+  }
+);
+
+// src/index.ts
+var linkProfileSchema = z2.object({
+  id: z2.string().min(1)
+});
+function link(options) {
+  for (const field of ["clientId", "clientSecret", "publishableKey"]) {
+    if (!options[field]?.trim()) throw new Error(`Link ${field} is required.`);
+  }
+  const oauth = genericOAuth({
+    config: [
+      {
+        providerId: "link",
+        name: "Link",
+        clientId: options.clientId,
+        clientSecret: options.clientSecret,
+        redirectURI: options.redirectURI,
+        authorizationUrl: "https://login.link.com/auth",
+        tokenUrl: "https://login.link.com/auth/token",
+        userInfoUrl: "https://api.link.com/userinfo",
+        authorizationUrlParams: { key: options.publishableKey },
+        scopes: options.scopes ?? ["payment_methods.agentic", "userinfo:read"],
+        pkce: true,
+        accessTokenExpiresIn: 3600,
+        tokenEndpointAuth: {
+          method: "custom",
+          customizeRequest({ body, headers }) {
+            body.set("client_id", options.clientId);
+            body.set("client_secret", options.clientSecret);
+            headers.authorization = `Bearer ${options.publishableKey}`;
+          }
+        },
+        accountSubject: ({ profile }) => linkProfileSchema.parse(profile).id,
+        mapProfileToUser(profile) {
+          return {
+            name: profile.name || [profile.first_name, profile.last_name].filter((part) => typeof part === "string").join(" ") || "Link"
+          };
+        }
+      }
+    ]
+  });
+  return {
+    ...oauth,
+    id: "link",
+    endpoints: {
+      connectLink: connectLink(),
+      disconnectLink: disconnectLink(options)
+    },
+    $ERROR_CODES: LINK_ERROR_CODES
+  };
+}
+export {
+  LINK_ERROR_CODES,
+  link
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/routes.ts"],"sourcesContent":["import type { UserInfo } from '@stripe/link-sdk';\nimport type { BetterAuthPlugin } from 'better-auth';\nimport { genericOAuth } from 'better-auth/plugins/generic-oauth';\nimport { z } from 'zod';\nimport { LINK_ERROR_CODES } from './error-codes';\nimport { connectLink, disconnectLink } from './routes';\n\ndeclare module '@better-auth/core' {\n  interface BetterAuthPluginRegistry<AuthOptions, Options> {\n    link: {\n      creator: typeof link;\n    };\n  }\n}\n\nconst linkProfileSchema = z.object({\n  id: z.string().min(1),\n}) satisfies z.ZodType<Pick<UserInfo, 'id'>>;\n\nexport interface LinkOptions {\n  clientId: string;\n  clientSecret: string;\n  publishableKey: string;\n  scopes?: string[];\n  redirectURI?: string;\n}\n\nexport function link(options: LinkOptions) {\n  for (const field of ['clientId', 'clientSecret', 'publishableKey'] as const) {\n    if (!options[field]?.trim()) throw new Error(`Link ${field} is required.`);\n  }\n\n  const oauth = genericOAuth({\n    config: [\n      {\n        providerId: 'link',\n        name: 'Link',\n        clientId: options.clientId,\n        clientSecret: options.clientSecret,\n        redirectURI: options.redirectURI,\n        authorizationUrl: 'https://login.link.com/auth',\n        tokenUrl: 'https://login.link.com/auth/token',\n        userInfoUrl: 'https://api.link.com/userinfo',\n        authorizationUrlParams: { key: options.publishableKey },\n        scopes: options.scopes ?? ['payment_methods.agentic', 'userinfo:read'],\n        pkce: true,\n        accessTokenExpiresIn: 3600,\n        tokenEndpointAuth: {\n          method: 'custom',\n          customizeRequest({ body, headers }) {\n            body.set('client_id', options.clientId);\n            body.set('client_secret', options.clientSecret);\n            headers.authorization = `Bearer ${options.publishableKey}`;\n          },\n        },\n        accountSubject: ({ profile }) => linkProfileSchema.parse(profile).id,\n        mapProfileToUser(profile) {\n          return {\n            name:\n              profile.name ||\n              [profile.first_name, profile.last_name]\n                .filter((part) => typeof part === 'string')\n                .join(' ') ||\n              'Link',\n          };\n        },\n      },\n    ],\n  });\n\n  return {\n    ...oauth,\n    id: 'link',\n    endpoints: {\n      connectLink: connectLink(),\n      disconnectLink: disconnectLink(options),\n    },\n    $ERROR_CODES: LINK_ERROR_CODES,\n  } satisfies BetterAuthPlugin;\n}\n\nexport { LINK_ERROR_CODES } from './error-codes';\n","import { BASE_ERROR_CODES } from 'better-auth';\nimport {\n  APIError,\n  createAuthEndpoint,\n  freshSessionMiddleware,\n  linkSocialAccount,\n  sensitiveSessionMiddleware,\n} from 'better-auth/api';\nimport { decryptOAuthToken } from 'better-auth/oauth2';\nimport { z } from 'zod';\nimport { LINK_ERROR_CODES } from './error-codes';\nimport type { LinkOptions } from './index';\n\nexport const connectLink = () =>\n  createAuthEndpoint(\n    '/link/connect',\n    {\n      method: 'POST',\n      requireHeaders: true,\n      body: linkSocialAccount.options.body.omit({\n        provider: true,\n        idToken: true,\n      }),\n    },\n    async (ctx) => {\n      const { headers, response } = await linkSocialAccount({\n        body: { ...ctx.body, provider: 'link' },\n        context: ctx.context,\n        headers: ctx.headers,\n        ...(ctx.request ? { request: ctx.request } : {}),\n        returnHeaders: true,\n      });\n\n      // Preserve OAuth state cookies and response headers from linkSocialAccount.\n      for (const cookie of headers.getSetCookie()) {\n        ctx.responseHeaders.append('set-cookie', cookie);\n      }\n      headers.forEach((value, key) => {\n        if (key.toLowerCase() !== 'set-cookie') {\n          ctx.responseHeaders.set(key, value);\n        }\n      });\n\n      return ctx.json(response);\n    },\n  );\n\nexport const disconnectLink = (options: LinkOptions) =>\n  createAuthEndpoint(\n    '/link/disconnect',\n    {\n      method: 'POST',\n      requireHeaders: true,\n      body: z.strictObject({ accountId: z.string().min(1) }),\n      use: [sensitiveSessionMiddleware, freshSessionMiddleware],\n    },\n    async (ctx) => {\n      const accounts = await ctx.context.internalAdapter.findAccounts(\n        ctx.context.session.user.id,\n      );\n      const account = accounts.find(\n        (candidate) =>\n          candidate.id === ctx.body.accountId &&\n          candidate.providerId === 'link',\n      );\n      if (!account) {\n        throw APIError.from('BAD_REQUEST', BASE_ERROR_CODES.ACCOUNT_NOT_FOUND);\n      }\n      if (\n        accounts.length === 1 &&\n        !ctx.context.options.account?.accountLinking?.allowUnlinkingAll\n      ) {\n        throw APIError.from(\n          'BAD_REQUEST',\n          BASE_ERROR_CODES.FAILED_TO_UNLINK_LAST_ACCOUNT,\n        );\n      }\n      if (!account.refreshToken) {\n        throw APIError.from(\n          'BAD_REQUEST',\n          LINK_ERROR_CODES.LINK_REFRESH_TOKEN_NOT_FOUND,\n        );\n      }\n\n      let response: Response;\n      try {\n        const token = await decryptOAuthToken(\n          account.refreshToken,\n          ctx.context,\n        );\n        response = await fetch('https://login.link.com/auth/revoke', {\n          method: 'POST',\n          redirect: 'error',\n          signal: AbortSignal.timeout(10_000),\n          headers: {\n            Authorization: `Bearer ${options.publishableKey}`,\n            'Content-Type': 'application/x-www-form-urlencoded',\n          },\n          body: new URLSearchParams({\n            client_id: options.clientId,\n            client_secret: options.clientSecret,\n            token,\n            token_type_hint: 'refresh_token',\n          }),\n        });\n      } catch {\n        throw APIError.from(\n          'BAD_GATEWAY',\n          LINK_ERROR_CODES.LINK_REVOCATION_FAILED,\n        );\n      }\n      if (!response.ok) {\n        throw APIError.from(\n          'BAD_GATEWAY',\n          LINK_ERROR_CODES.LINK_REVOCATION_FAILED,\n        );\n      }\n\n      await ctx.context.internalAdapter.deleteAccount(account.id);\n      return ctx.json({ status: true });\n    },\n  );\n"],"mappings":";;;;;AAEA,SAAS,oBAAoB;AAC7B,SAAS,KAAAA,UAAS;;;ACHlB,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB;AAClC,SAAS,SAAS;AAIX,IAAM,cAAc,MACzB;AAAA,EACE;AAAA,EACA;AAAA,IACE,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,MAAM,kBAAkB,QAAQ,KAAK,KAAK;AAAA,MACxC,UAAU;AAAA,MACV,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAAA,EACA,OAAO,QAAQ;AACb,UAAM,EAAE,SAAS,SAAS,IAAI,MAAM,kBAAkB;AAAA,MACpD,MAAM,EAAE,GAAG,IAAI,MAAM,UAAU,OAAO;AAAA,MACtC,SAAS,IAAI;AAAA,MACb,SAAS,IAAI;AAAA,MACb,GAAI,IAAI,UAAU,EAAE,SAAS,IAAI,QAAQ,IAAI,CAAC;AAAA,MAC9C,eAAe;AAAA,IACjB,CAAC;AAGD,eAAW,UAAU,QAAQ,aAAa,GAAG;AAC3C,UAAI,gBAAgB,OAAO,cAAc,MAAM;AAAA,IACjD;AACA,YAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC9B,UAAI,IAAI,YAAY,MAAM,cAAc;AACtC,YAAI,gBAAgB,IAAI,KAAK,KAAK;AAAA,MACpC;AAAA,IACF,CAAC;AAED,WAAO,IAAI,KAAK,QAAQ;AAAA,EAC1B;AACF;AAEK,IAAM,iBAAiB,CAAC,YAC7B;AAAA,EACE;AAAA,EACA;AAAA,IACE,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,IACrD,KAAK,CAAC,4BAA4B,sBAAsB;AAAA,EAC1D;AAAA,EACA,OAAO,QAAQ;AACb,UAAM,WAAW,MAAM,IAAI,QAAQ,gBAAgB;AAAA,MACjD,IAAI,QAAQ,QAAQ,KAAK;AAAA,IAC3B;AACA,UAAM,UAAU,SAAS;AAAA,MACvB,CAAC,cACC,UAAU,OAAO,IAAI,KAAK,aAC1B,UAAU,eAAe;AAAA,IAC7B;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,SAAS,KAAK,eAAe,iBAAiB,iBAAiB;AAAA,IACvE;AACA,QACE,SAAS,WAAW,KACpB,CAAC,IAAI,QAAQ,QAAQ,SAAS,gBAAgB,mBAC9C;AACA,YAAM,SAAS;AAAA,QACb;AAAA,QACA,iBAAiB;AAAA,MACnB;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,cAAc;AACzB,YAAM,SAAS;AAAA,QACb;AAAA,QACA,iBAAiB;AAAA,MACnB;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,YAAM,QAAQ,MAAM;AAAA,QAClB,QAAQ;AAAA,QACR,IAAI;AAAA,MACN;AACA,iBAAW,MAAM,MAAM,sCAAsC;AAAA,QAC3D,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,QAAQ,YAAY,QAAQ,GAAM;AAAA,QAClC,SAAS;AAAA,UACP,eAAe,UAAU,QAAQ,cAAc;AAAA,UAC/C,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,IAAI,gBAAgB;AAAA,UACxB,WAAW,QAAQ;AAAA,UACnB,eAAe,QAAQ;AAAA,UACvB;AAAA,UACA,iBAAiB;AAAA,QACnB,CAAC;AAAA,MACH,CAAC;AAAA,IACH,QAAQ;AACN,YAAM,SAAS;AAAA,QACb;AAAA,QACA,iBAAiB;AAAA,MACnB;AAAA,IACF;AACA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,SAAS;AAAA,QACb;AAAA,QACA,iBAAiB;AAAA,MACnB;AAAA,IACF;AAEA,UAAM,IAAI,QAAQ,gBAAgB,cAAc,QAAQ,EAAE;AAC1D,WAAO,IAAI,KAAK,EAAE,QAAQ,KAAK,CAAC;AAAA,EAClC;AACF;;;AD1GF,IAAM,oBAAoBC,GAAE,OAAO;AAAA,EACjC,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC;AACtB,CAAC;AAUM,SAAS,KAAK,SAAsB;AACzC,aAAW,SAAS,CAAC,YAAY,gBAAgB,gBAAgB,GAAY;AAC3E,QAAI,CAAC,QAAQ,KAAK,GAAG,KAAK,EAAG,OAAM,IAAI,MAAM,QAAQ,KAAK,eAAe;AAAA,EAC3E;AAEA,QAAM,QAAQ,aAAa;AAAA,IACzB,QAAQ;AAAA,MACN;AAAA,QACE,YAAY;AAAA,QACZ,MAAM;AAAA,QACN,UAAU,QAAQ;AAAA,QAClB,cAAc,QAAQ;AAAA,QACtB,aAAa,QAAQ;AAAA,QACrB,kBAAkB;AAAA,QAClB,UAAU;AAAA,QACV,aAAa;AAAA,QACb,wBAAwB,EAAE,KAAK,QAAQ,eAAe;AAAA,QACtD,QAAQ,QAAQ,UAAU,CAAC,2BAA2B,eAAe;AAAA,QACrE,MAAM;AAAA,QACN,sBAAsB;AAAA,QACtB,mBAAmB;AAAA,UACjB,QAAQ;AAAA,UACR,iBAAiB,EAAE,MAAM,QAAQ,GAAG;AAClC,iBAAK,IAAI,aAAa,QAAQ,QAAQ;AACtC,iBAAK,IAAI,iBAAiB,QAAQ,YAAY;AAC9C,oBAAQ,gBAAgB,UAAU,QAAQ,cAAc;AAAA,UAC1D;AAAA,QACF;AAAA,QACA,gBAAgB,CAAC,EAAE,QAAQ,MAAM,kBAAkB,MAAM,OAAO,EAAE;AAAA,QAClE,iBAAiB,SAAS;AACxB,iBAAO;AAAA,YACL,MACE,QAAQ,QACR,CAAC,QAAQ,YAAY,QAAQ,SAAS,EACnC,OAAO,CAAC,SAAS,OAAO,SAAS,QAAQ,EACzC,KAAK,GAAG,KACX;AAAA,UACJ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL,GAAG;AAAA,IACH,IAAI;AAAA,IACJ,WAAW;AAAA,MACT,aAAa,YAAY;AAAA,MACzB,gBAAgB,eAAe,OAAO;AAAA,IACxC;AAAA,IACA,cAAc;AAAA,EAChB;AACF;","names":["z","z"]}

package/dist/routes.d.ts

@@ -0,0 +1,52 @@
+import { z } from 'zod';
+import type { LinkOptions } from './index';
+export declare const connectLink: () => import("better-auth").StrictEndpoint<"/link/connect", {
+    method: "POST";
+    requireHeaders: true;
+    body: z.ZodObject<{
+        callbackURL: z.ZodOptional<z.ZodString>;
+        requestSignUp: z.ZodOptional<z.ZodBoolean>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        errorCallbackURL: z.ZodOptional<z.ZodString>;
+        disableRedirect: z.ZodOptional<z.ZodBoolean>;
+        loginHint: z.ZodOptional<z.ZodString>;
+        additionalParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        additionalData: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+    }, z.core.$strip>;
+}, {
+    url: string;
+    redirect: boolean;
+}>;
+export declare const disconnectLink: (options: LinkOptions) => import("better-auth").StrictEndpoint<"/link/disconnect", {
+    method: "POST";
+    requireHeaders: true;
+    body: z.ZodObject<{
+        accountId: z.ZodString;
+    }, z.core.$strict>;
+    use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+        session: {
+            session: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                userId: string;
+                expiresAt: Date;
+                token: string;
+                ipAddress?: string | null | undefined;
+                userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+            };
+        };
+    }>>[];
+}, {
+    status: boolean;
+}>;
+//# sourceMappingURL=routes.d.ts.map

package/dist/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;EAgCrB,CAAC;AAEJ,eAAO,MAAM,cAAc,YAAa,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0EhD,CAAC"}

package/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "@stripe/link-integrations-better-auth",
+  "version": "0.2.0",
+  "description": "Sign in with Link and connect Link wallets using Better Auth",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "import": "./dist/client.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "sideEffects": false,
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/stripe/link-cli.git",
+    "directory": "packages/integrations/better-auth"
+  },
+  "homepage": "https://github.com/stripe/link-cli/tree/main/packages/integrations/better-auth#readme",
+  "bugs": "https://github.com/stripe/link-cli/issues",
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup && tsc --noEmit false --emitDeclarationOnly",
+    "prepack": "pnpm run build",
+    "typecheck": "tsc && tsc -p tsconfig.test.json",
+    "test": "vitest run"
+  },
+  "peerDependencies": {
+    "@better-auth/core": "^1.7.5",
+    "better-auth": "^1.7.5"
+  },
+  "dependencies": {
+    "zod": "^4.5.4"
+  },
+  "devDependencies": {
+    "@better-auth/core": "1.7.5",
+    "@stripe/link-sdk": "workspace:*",
+    "@stripe/link-typescript-config": "workspace:*",
+    "@types/node": "^26.4.1",
+    "better-auth": "1.7.5",
+    "tsup": "^8.5.1",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.0"
+  }
+}