better-auth 1.8.0-beta.7 → 1.8.0-beta.8

package/dist/api/index.d.mts

@@ -1,6 +1,7 @@
 import { OverrideMerge, Prettify as Prettify$1, UnionToIntersection } from "../types/helper.mjs";
 import { AdditionalSessionFieldsInput, AdditionalUserFieldsInput } from "../types/models.mjs";
 import "../types/index.mjs";
+import { generateGenericState, parseGenericState } from "../state.mjs";
 import "../index.mjs";
 import { isAPIError } from "../utils/is-api-error.mjs";
 import { DispatchContext, dispatchAuthEndpoint } from "./dispatch.mjs";
@@ -11,6 +12,7 @@ import { accountInfo, getAccessToken, linkSocialAccount, listUserAccounts, refre
 import { callbackOAuth } from "./routes/callback.mjs";
 import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEmailFn, verifyEmail } from "./routes/email-verification.mjs";
 import { error } from "./routes/error.mjs";
+import { consumeIssuedIdTokenNonce, consumeNonce, issueIdTokenNonce, issueNonce, issuedNonceResponses } from "./routes/id-token-nonce.mjs";
 import { ok } from "./routes/ok.mjs";
 import { requestPasswordReset, requestPasswordResetCallback, resetPassword, verifyPassword } from "./routes/password.mjs";
 import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
@@ -1664,6 +1666,38 @@ export declare function getEndpoints<Option extends BetterAuthOptions>(ctx: Awai
       url: string;
       redirect: boolean;
     }>;
+    readonly issueIdTokenNonce: import("better-call").StrictEndpoint<"/id-token/nonce", {
+      method: "POST";
+      body: import("zod").ZodObject<{
+        provider: import("zod").ZodType<(string & {}) | "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat", unknown, import("zod/v4/core").$ZodTypeInternals<(string & {}) | "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat", unknown>>;
+      }, import("zod/v4/core").$strip>;
+      metadata: {
+        noStore: boolean;
+        openapi: {
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      nonce: {
+                        type: "string";
+                      };
+                    };
+                    required: string[];
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      nonce: string;
+    }>;
     readonly listUserAccounts: import("better-call").StrictEndpoint<"/list-accounts", {
       method: "GET";
       use: Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
@@ -3678,6 +3712,38 @@ export declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext
       url: string;
       redirect: boolean;
     }>;
+    readonly issueIdTokenNonce: import("better-call").StrictEndpoint<"/id-token/nonce", {
+      method: "POST";
+      body: import("zod").ZodObject<{
+        provider: import("zod").ZodType<(string & {}) | "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat", unknown, import("zod/v4/core").$ZodTypeInternals<(string & {}) | "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat", unknown>>;
+      }, import("zod/v4/core").$strip>;
+      metadata: {
+        noStore: boolean;
+        openapi: {
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      nonce: {
+                        type: "string";
+                      };
+                    };
+                    required: string[];
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      nonce: string;
+    }>;
     readonly listUserAccounts: import("better-call").StrictEndpoint<"/list-accounts", {
       method: "GET";
       use: Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
@@ -4048,4 +4114,4 @@ export declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext
   } extends (infer T_2) ? { [K in keyof T_2 as K extends keyof T_1 ? never : K]: T_2[K]; } : never) & T_1> : never : never : never;
 };
 //#endregion
-export { APIError, type AuthEndpoint, type AuthMiddleware, type DispatchContext, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };
+export { APIError, type AuthEndpoint, type AuthMiddleware, type DispatchContext, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, consumeIssuedIdTokenNonce, consumeNonce, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, generateGenericState, getAccessToken, getAuthoritativeSessionFromCtx, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, issueIdTokenNonce, issueNonce, issuedNonceResponses, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, parseGenericState, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };

package/dist/api/index.mjs

@@ -5,6 +5,8 @@ import { onRequestRateLimit } from "./rate-limiter/index.mjs";
 import { getShouldSkipSessionRefresh, setShouldSkipSessionRefresh } from "./state/should-session-refresh.mjs";
 import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
 import { addOAuthServerContext, getOAuthState } from "./state/oauth.mjs";
+import { generateGenericState, parseGenericState } from "../state.mjs";
+import { consumeIssuedIdTokenNonce, consumeNonce, issueIdTokenNonce, issueNonce, issuedNonceResponses } from "./routes/id-token-nonce.mjs";
 import { accountInfo, getAccessToken, linkSocialAccount, listUserAccounts, refreshToken, unlinkAccount } from "./routes/account.mjs";
 import { callbackOAuth } from "./routes/callback.mjs";
 import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEmailFn, verifyEmail } from "./routes/email-verification.mjs";
@@ -134,6 +136,7 @@ function getEndpoints(ctx, options) {
 		revokeSessions,
 		revokeOtherSessions,
 		linkSocialAccount,
+		issueIdTokenNonce,
 		listUserAccounts,
 		deleteUserCallback,
 		unlinkAccount,
@@ -222,4 +225,4 @@ const router = (ctx, options) => {
 	});
 };
 //#endregion
-export { APIError, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getEndpoints, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };
+export { APIError, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, consumeIssuedIdTokenNonce, consumeNonce, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, generateGenericState, getAccessToken, getAuthoritativeSessionFromCtx, getEndpoints, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, issueIdTokenNonce, issueNonce, issuedNonceResponses, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, parseGenericState, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };

package/dist/api/routes/account.mjs

@@ -11,6 +11,7 @@ import { toBoolean } from "../../utils/boolean.mjs";
 import { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil } from "../../oauth2/utils.mjs";
 import { applyUpdateUserInfoOnLink } from "../../oauth2/link-account.mjs";
 import { generateIdTokenNonce, generateState } from "../../oauth2/state.mjs";
+import { consumeIssuedIdTokenNonce } from "./id-token-nonce.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { additionalAuthorizationParamsSchema, supportsIdTokenSignIn, verifyProviderIdToken } from "@better-auth/core/oauth2";
 import { SocialProviderListEnum } from "@better-auth/core/social-providers";
@@ -168,6 +169,7 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 			throw APIError.from("NOT_FOUND", BASE_ERROR_CODES.ID_TOKEN_NOT_SUPPORTED);
 		}
 		const { token, nonce } = c.body.idToken;
+		await consumeIssuedIdTokenNonce(c, provider, nonce);
 		if (!await verifyProviderIdToken(provider, token, nonce, c)) {
 			c.context.logger.warn("Invalid id token", { provider: c.body.provider });
 			throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.INVALID_TOKEN);

package/dist/api/routes/id-token-nonce.d.mts

@@ -0,0 +1,85 @@
+import { GenericEndpointContext } from "@better-auth/core";
+import { OAuthProvider } from "@better-auth/core/oauth2";
+import * as z from "zod";
+//#region src/api/routes/id-token-nonce.d.ts
+/**
+ * Store a new single-use nonce under `scope` and return it. It expires after
+ * five minutes.
+ */
+export declare function issueNonce(ctx: GenericEndpointContext, scope: string): Promise<string>;
+/**
+ * Consume a nonce that {@link issueNonce} stored under `scope`. Throws
+ * `INVALID_ID_TOKEN_NONCE` when it is missing, malformed, unknown, expired, or
+ * already used. Call it before verifying the token, so a failed attempt burns
+ * the nonce too.
+ */
+export declare function consumeNonce(ctx: GenericEndpointContext, scope: string, nonce: string | undefined): Promise<void>;
+/** OpenAPI responses for an endpoint that returns `{ nonce }` from {@link issueNonce}. */
+export declare const issuedNonceResponses: {
+  200: {
+    description: string;
+    content: {
+      "application/json": {
+        schema: {
+          type: "object";
+          properties: {
+            nonce: {
+              type: "string";
+            };
+          };
+          required: string[];
+        };
+      };
+    };
+  };
+};
+type ProviderWithOptions = Pick<OAuthProvider, "id" | "options">;
+/**
+ * Consume the issued nonce presented with a client-submitted ID token, from
+ * `/sign-in/social` or `/link-social`. A no-op for providers without
+ * `requireIssuedIdTokenNonce`.
+ */
+export declare function consumeIssuedIdTokenNonce(ctx: GenericEndpointContext, provider: ProviderWithOptions, nonce: string | undefined): Promise<void>;
+/**
+ * ### Endpoint
+ *
+ * POST `/id-token/nonce`
+ *
+ * Issues a single-use nonce for a client to pass to the provider's SDK before
+ * submitting the resulting ID token to `/sign-in/social` or `/link-social`.
+ * Only available for providers that set `requireIssuedIdTokenNonce`.
+ */
+export declare const issueIdTokenNonce: import("better-call").StrictEndpoint<"/id-token/nonce", {
+  method: "POST";
+  body: z.ZodObject<{
+    provider: z.ZodType<(string & {}) | "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat", unknown, z.core.$ZodTypeInternals<(string & {}) | "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat", unknown>>;
+  }, z.core.$strip>;
+  metadata: {
+    noStore: boolean;
+    openapi: {
+      description: string;
+      responses: {
+        200: {
+          description: string;
+          content: {
+            "application/json": {
+              schema: {
+                type: "object";
+                properties: {
+                  nonce: {
+                    type: "string";
+                  };
+                };
+                required: string[];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}, {
+  nonce: string;
+}>;
+//#endregion
+export {};

package/dist/api/routes/id-token-nonce.mjs

@@ -0,0 +1,80 @@
+import { generateRandomString } from "../../crypto/random.mjs";
+import { getAwaitableValue } from "../../context/helpers.mjs";
+import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
+import { SocialProviderListEnum } from "@better-auth/core/social-providers";
+import { createAuthEndpoint } from "@better-auth/core/api";
+import * as z from "zod";
+//#region src/api/routes/id-token-nonce.ts
+const ISSUED_NONCE_EXPIRES_IN_MS = 3e5;
+const ISSUED_NONCE_LENGTH = 32;
+const ISSUED_NONCE_PATTERN = new RegExp(`^[a-zA-Z0-9]{${ISSUED_NONCE_LENGTH}}$`);
+/**
+* Store a new single-use nonce under `scope` and return it. It expires after
+* five minutes.
+*/
+async function issueNonce(ctx, scope) {
+	const nonce = generateRandomString(ISSUED_NONCE_LENGTH, "a-z", "A-Z", "0-9");
+	await ctx.context.internalAdapter.createVerificationValue({
+		identifier: `${scope}:${nonce}`,
+		value: scope,
+		expiresAt: new Date(Date.now() + ISSUED_NONCE_EXPIRES_IN_MS)
+	});
+	return nonce;
+}
+/**
+* Consume a nonce that {@link issueNonce} stored under `scope`. Throws
+* `INVALID_ID_TOKEN_NONCE` when it is missing, malformed, unknown, expired, or
+* already used. Call it before verifying the token, so a failed attempt burns
+* the nonce too.
+*/
+async function consumeNonce(ctx, scope, nonce) {
+	if (!(nonce && ISSUED_NONCE_PATTERN.test(nonce) ? await ctx.context.internalAdapter.consumeVerificationValue(`${scope}:${nonce}`) : null)) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_ID_TOKEN_NONCE);
+}
+/** OpenAPI responses for an endpoint that returns `{ nonce }` from {@link issueNonce}. */
+const issuedNonceResponses = { 200: {
+	description: "Success",
+	content: { "application/json": { schema: {
+		type: "object",
+		properties: { nonce: { type: "string" } },
+		required: ["nonce"]
+	} } }
+} };
+const idTokenNonceScope = (providerId) => `id-token-nonce:${providerId}`;
+const requiresIssuedNonce = (provider) => provider.options?.requireIssuedIdTokenNonce === true;
+/**
+* Consume the issued nonce presented with a client-submitted ID token, from
+* `/sign-in/social` or `/link-social`. A no-op for providers without
+* `requireIssuedIdTokenNonce`.
+*/
+async function consumeIssuedIdTokenNonce(ctx, provider, nonce) {
+	if (!requiresIssuedNonce(provider)) return;
+	await consumeNonce(ctx, idTokenNonceScope(provider.id), nonce);
+}
+/**
+* ### Endpoint
+*
+* POST `/id-token/nonce`
+*
+* Issues a single-use nonce for a client to pass to the provider's SDK before
+* submitting the resulting ID token to `/sign-in/social` or `/link-social`.
+* Only available for providers that set `requireIssuedIdTokenNonce`.
+*/
+const issueIdTokenNonce = createAuthEndpoint("/id-token/nonce", {
+	method: "POST",
+	body: z.object({ provider: SocialProviderListEnum }),
+	metadata: {
+		noStore: true,
+		openapi: {
+			description: "Issue a single-use nonce to bind a provider ID token to one sign-in or account-linking request",
+			responses: issuedNonceResponses
+		}
+	}
+}, async (ctx) => {
+	const provider = await getAwaitableValue(ctx.context.socialProviders, { value: ctx.body.provider });
+	if (!provider) throw APIError.from("NOT_FOUND", BASE_ERROR_CODES.PROVIDER_NOT_FOUND);
+	if (!requiresIssuedNonce(provider)) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.ID_TOKEN_NONCE_NOT_ENABLED);
+	const nonce = await issueNonce(ctx, idTokenNonceScope(provider.id));
+	return ctx.json({ nonce });
+});
+//#endregion
+export { consumeIssuedIdTokenNonce, consumeNonce, issueIdTokenNonce, issueNonce, issuedNonceResponses };

package/dist/api/routes/index.d.mts

@@ -2,6 +2,7 @@ import { accountInfo, getAccessToken, linkSocialAccount, listUserAccounts, refre
 import { callbackOAuth } from "./callback.mjs";
 import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEmailFn, verifyEmail } from "./email-verification.mjs";
 import { error } from "./error.mjs";
+import { consumeIssuedIdTokenNonce, consumeNonce, issueIdTokenNonce, issueNonce, issuedNonceResponses } from "./id-token-nonce.mjs";
 import { ok } from "./ok.mjs";
 import { requestPasswordReset, requestPasswordResetCallback, resetPassword, verifyPassword } from "./password.mjs";
 import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./session.mjs";
@@ -10,4 +11,4 @@ import { signOut } from "./sign-out.mjs";
 import { signUpEmail } from "./sign-up.mjs";
 import { updateSession } from "./update-session.mjs";
 import { changeEmail, changePassword, deleteUser, deleteUserCallback, setPassword, updateUser } from "./update-user.mjs";
-export { accountInfo, callbackOAuth, changeEmail, changePassword, createEmailVerificationToken, deleteUser, deleteUserCallback, error, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, linkSocialAccount, listSessions, listUserAccounts, ok, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };
+export { accountInfo, callbackOAuth, changeEmail, changePassword, consumeIssuedIdTokenNonce, consumeNonce, createEmailVerificationToken, deleteUser, deleteUserCallback, error, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, issueIdTokenNonce, issueNonce, issuedNonceResponses, linkSocialAccount, listSessions, listUserAccounts, ok, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };

package/dist/api/routes/sign-in.mjs

@@ -7,6 +7,7 @@ import { OAUTH_CALLBACK_ERROR_CODES, missingEmailLogMessage } from "../../oauth2
 import { getOAuthCallbackPath } from "../../oauth2/utils.mjs";
 import { handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
 import { generateIdTokenNonce, generateState } from "../../oauth2/state.mjs";
+import { consumeIssuedIdTokenNonce } from "./id-token-nonce.mjs";
 import { safeCloneRequest } from "../../utils/request.mjs";
 import { createEmailVerificationToken } from "./email-verification.mjs";
 import { assertPasswordNotTooLong } from "../../utils/password.mjs";
@@ -157,6 +158,7 @@ const signInSocial = () => createAuthEndpoint("/sign-in/social", {
 			throw APIError.from("NOT_FOUND", BASE_ERROR_CODES.ID_TOKEN_NOT_SUPPORTED);
 		}
 		const { token, nonce } = c.body.idToken;
+		await consumeIssuedIdTokenNonce(c, provider, nonce);
 		if (!await verifyProviderIdToken(provider, token, nonce, c)) {
 			c.context.logger.warn("Invalid id token", { provider: c.body.provider });
 			throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.INVALID_TOKEN);

package/dist/db/get-migration.mjs

@@ -1,7 +1,7 @@
 import { buildSchema } from "./get-schema.mjs";
 import { createLogger } from "@better-auth/core/env";
 import { BetterAuthError } from "@better-auth/core/error";
-import { createKyselyAdapter, getMssqlSchema, getPostgresSchema, toIntrospectedTables, toPhysicalSchema } from "@better-auth/kysely-adapter";
+import { createKyselyAdapter, getMssqlSchema, getPostgresSchema, introspectPostgresTables, toIntrospectedTables, toPhysicalSchema } from "@better-auth/kysely-adapter";
 import { initGetFieldName, initGetModelName } from "@better-auth/core/db/adapter";
 import { diffSchema, formatSchemaFinding, getDatabaseFieldIndexName, getDatabaseIndexStringLength, getPortableDatabaseIdentifierKey, invalidateSchemaChecks } from "@better-auth/core/db/internal";
 import { sql } from "kysely";
@@ -354,9 +354,8 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 		logger.error("Only kysely adapter is supported for migrations. You can use `generate` command to generate the schema, if you're using a different adapter.");
 		process.exit(1);
 	}
-	const allTableMetadata = await db.introspection.getTables();
 	let target;
-	let tableMetadata = allTableMetadata;
+	let tableMetadata;
 	switch (dbType) {
 		case "postgres": {
 			const schema = schemaName ?? await getPostgresSchema(db);
@@ -373,11 +372,7 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 			} catch (error) {
 				logger.debug(`Could not verify schema existence: ${error instanceof Error ? error.message : String(error)}`);
 			}
-			/**
-			* Kysely 0.28 does not expose `isForeign`, while 0.29 adds foreign table metadata.
-			* @see https://github.com/kysely-org/kysely/pull/1494
-			*/
-			tableMetadata = allTableMetadata.filter((table) => table.schema === schema && !table.isView && !("isForeign" in table && table.isForeign));
+			tableMetadata = (await introspectPostgresTables(db, [schema])).filter((table) => !table.isView && !table.isForeign);
 			logger.debug(`Found ${tableMetadata.length} table(s) in schema '${schema}': ${tableMetadata.map((table) => table.name).join(", ") || "(none)"}`);
 			break;
 		}
@@ -388,15 +383,18 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 				schema
 			};
 			logger.debug(`SQL Server migration: Using schema '${schema}' (from the current user's default schema)`);
-			tableMetadata = allTableMetadata.filter((table) => table.schema === schema);
+			tableMetadata = (await db.introspection.getTables()).filter((table) => table.schema === schema);
 			break;
 		}
 		case "mysql":
 			target = { type: "mysql" };
+			tableMetadata = await db.introspection.getTables();
 			break;
-		case "sqlite": target = { type: "sqlite" };
+		case "sqlite":
+			target = { type: "sqlite" };
+			tableMetadata = await db.introspection.getTables();
 	}
-	const databaseIndexMap = await getDatabaseIndexMap(db, target, allTableMetadata.map((table) => table.name), introspectIndexes);
+	const databaseIndexMap = await getDatabaseIndexMap(db, target, tableMetadata.map((table) => table.name), introspectIndexes);
 	const databaseColumnBounds = await getDatabaseColumnBounds(db, target);
 	const schemaProblems = diffSchema(toPhysicalSchema(db, betterAuthSchema), toIntrospectedTables(tableMetadata)).filter((finding) => finding.kind === "unexpected-required-column").map((finding) => formatSchemaFinding(finding, "database"));
 	const toBeCreated = [];

package/dist/db/internal-adapter.mjs

@@ -131,6 +131,20 @@ const createInternalAdapter = (adapter, ctx) => {
 			if (verificationConsumeLocks.get(key) === next) verificationConsumeLocks.delete(key);
 		}
 	}
+	async function deleteExpiredVerifications() {
+		if (options.verification?.disableCleanup) return;
+		await queueAfterTransactionHook(async () => {
+			try {
+				await deleteManyWithHooks([{
+					field: "expiresAt",
+					value: /* @__PURE__ */ new Date(),
+					operator: "lt"
+				}], "verification", void 0);
+			} catch (error) {
+				logger.error("Failed to delete expired verification values", error);
+			}
+		});
+	}
 	return {
 		createOAuthUser: async (user, account) => {
 			return runWithTransaction(adapter, async () => {
@@ -795,11 +809,7 @@ const createInternalAdapter = (adapter, ctx) => {
 			}
 			let verification = await findByIdentifier(storedIdentifier);
 			if (!verification.length && storageOption && storageOption !== "plain") verification = await findByIdentifier(identifier);
-			if (!options.verification?.disableCleanup) await deleteManyWithHooks([{
-				field: "expiresAt",
-				value: /* @__PURE__ */ new Date(),
-				operator: "lt"
-			}], "verification", void 0);
+			await deleteExpiredVerifications();
 			return verification[0] || null;
 		},
 		deleteVerificationByIdentifier: async (identifier) => {
@@ -898,6 +908,7 @@ const createInternalAdapter = (adapter, ctx) => {
 					if (consumed) break;
 				}
 				if (consumed && secondaryStorage) await Promise.all(identifiersToTry.map((stored) => secondaryStorage.delete(`verification:${stored}`)));
+				if (consumed) await deleteExpiredVerifications();
 			}
 			if (!consumed || consumed.expiresAt < /* @__PURE__ */ new Date()) return null;
 			return consumed;
@@ -930,7 +941,10 @@ const createInternalAdapter = (adapter, ctx) => {
 		* is best-effort there (it is intended for development and tests).
 		*/
 		reserveVerificationValue: async (data) => {
-			const reservationId = encodeDeterministicId(new Uint8Array(await createHash("SHA-256").digest(new TextEncoder().encode("reserve:" + data.identifier))), options);
+			const reservationId = encodeDeterministicId(new Uint8Array(await createHash("SHA-256").digest(new TextEncoder().encode("reserve:" + data.identifier))), options, {
+				adapter,
+				model: "verification"
+			});
 			const storageOption = getStorageOption(data.identifier, options.verification?.storeIdentifier);
 			const storedIdentifier = await processIdentifier(data.identifier, storageOption);
 			if (secondaryStorage && !options.verification?.storeInDatabase) throw new BetterAuthError("reserveVerificationValue requires database-backed verification storage. Set verification.storeInDatabase to true for flows that reserve verification values.");

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.8.0-beta.7";
+var version = "1.8.0-beta.8";
 //#endregion
 export { version };

package/dist/plugins/device-authorization/routes.mjs

@@ -634,6 +634,21 @@ const deviceVerify = (grant) => createAuthEndpoint("/device", {
 			increment: {},
 			set: { userId: session.user.id }
 		})) deviceCodeRecord.userId = session.user.id;
+		else {
+			const current = await ctx.context.adapter.findOne({
+				model: "deviceCode",
+				where: [{
+					field: "id",
+					value: deviceCodeRecord.id
+				}]
+			});
+			if (!current) throw new APIError("BAD_REQUEST", {
+				error: "invalid_request",
+				error_description: DEVICE_AUTHORIZATION_ERROR_CODES.INVALID_USER_CODE.message
+			});
+			deviceCodeRecord.userId = current.userId;
+			deviceCodeRecord.status = current.status;
+		}
 	}
 	const canReviewRequest = session?.user.id !== void 0 && deviceCodeRecord.userId === session.user.id;
 	return ctx.json({

package/dist/plugins/generic-oauth/index.d.mts

@@ -25,10 +25,7 @@ declare module "@better-auth/core" {
  * Extracts common fields from GenericOAuthConfig for provider helpers.
  */
 export type BaseOAuthProviderOptions = Pick<GenericOAuthConfig, "clientId" | "clientSecret" | "tokenEndpointAuth" | "scopes" | "redirectURI" | "endSessionEndpoint" | "postLogoutRedirectURI" | "disableProviderLogout" | "pkce" | "disableImplicitSignUp" | "disableSignUp" | "overrideUserInfo">;
-type PendingDiscovery = Map<string, {
-  config: GenericOAuthConfig;
-  attempt?: Promise<void> | undefined;
-}>;
+type PendingDiscovery = Map<string, GenericOAuthConfig>;
 /**
  * A generic OAuth plugin that registers any OAuth/OIDC provider
  * as a first-class social provider.

package/dist/plugins/generic-oauth/index.mjs

@@ -25,6 +25,7 @@ function isClientSecretTokenEndpointAuth(tokenEndpointAuth) {
 }
 /** A request waits on a discovery retry, so bound it (the SSO plugin uses 10s too). */
 const DISCOVERY_RETRY_TIMEOUT_MS = 1e4;
+const MAX_DISCOVERY_REDIRECTS = 5;
 /**
 * Providers skipped because startup discovery failed. Init stores them on each auth
 * instance's context, so one plugin object can serve several instances. It is a context
@@ -44,18 +45,35 @@ const readIdTokenClaims = (idToken) => {
 	}
 };
 async function fetchDiscovery(url, headers, timeout) {
-	const result = await betterFetch(url, {
-		method: "GET",
-		headers,
-		signal: timeout ? AbortSignal.timeout(timeout) : void 0
-	});
-	if (result.error || !result.data) return null;
-	if (result.data.issuer) try {
-		new URL(result.data.issuer);
-	} catch {
-		return null;
+	const signal = timeout ? AbortSignal.timeout(timeout) : void 0;
+	let target = url;
+	for (let hop = 0;; hop++) {
+		const redirect = {};
+		const result = await betterFetch(target, {
+			method: "GET",
+			headers,
+			redirect: headers ? "manual" : void 0,
+			signal,
+			onError: ({ response }) => {
+				if (response.status >= 300 && response.status < 400) redirect.location = response.headers.get("location");
+			}
+		});
+		if (headers && redirect.location) {
+			const next = new URL(redirect.location, target);
+			if (next.origin !== new URL(url).origin) throw new Error(`discovery redirected to ${next.origin}; with discoveryHeaders set, only same-origin redirects are followed. Set discoveryUrl to the final URL.`);
+			if (hop >= MAX_DISCOVERY_REDIRECTS) throw new Error(`discovery redirected more than ${MAX_DISCOVERY_REDIRECTS} times. Set discoveryUrl to the final URL.`);
+			target = next.href;
+			continue;
+		}
+		if (headers && result.error?.status === 0) throw new Error("discovery redirected; with discoveryHeaders set, set discoveryUrl to the final URL.");
+		if (result.error || !result.data) return null;
+		if (result.data.issuer) try {
+			new URL(result.data.issuer);
+		} catch {
+			return null;
+		}
+		return result.data;
 	}
-	return result.data;
 }
 async function fetchUserInfo(tokens, userInfoUrl, idTokenClaims) {
 	if (tokens.idToken) {
@@ -100,6 +118,7 @@ const genericOAuth = (options) => {
 	const buildProviders = async (configs, ctx, discoveryTimeout) => {
 		const genericProviders = [];
 		for (const c of configs) {
+			if (Object.keys(c.authorizationHeaders ?? {}).some((name) => name.toLowerCase() === "authorization")) throw new Error(`Provider "${c.providerId}": authorizationHeaders cannot set "Authorization". Use tokenEndpointAuth: { method: "custom", customizeRequest } instead.`);
 			let authorizationUrl = c.authorizationUrl;
 			let tokenUrl = c.tokenUrl;
 			let userInfoUrl = c.userInfoUrl;
@@ -128,8 +147,9 @@ const genericOAuth = (options) => {
 							ctx.logger.error(`Provider "${c.providerId}": invalid jwks_uri "${discovered.jwks_uri}" in discovery document. Provider skipped.`);
 							continue;
 						}
+						const jwksHeaders = jwksUrl.origin === new URL(c.discoveryUrl).origin ? c.discoveryHeaders : void 0;
 						idTokenConfig = {
-							jwks: createRemoteJWKSet(jwksUrl),
+							jwks: createRemoteJWKSet(jwksUrl, jwksHeaders && { headers: jwksHeaders }),
 							issuer: discovered.issuer,
 							audience: c.clientId,
 							algorithms: isOidc ? signingAlgs : void 0
@@ -287,7 +307,8 @@ const genericOAuth = (options) => {
 						authentication: c.authentication,
 						tokenEndpointAuth,
 						tokenEndpoint: tokenUrl,
-						extraParams: resolvedRefreshParams
+						extraParams: resolvedRefreshParams,
+						headers: c.authorizationHeaders
 					});
 					return applyDefaultAccessTokenExpiry(tokens, c.accessTokenExpiresIn);
 				},
@@ -303,18 +324,13 @@ const genericOAuth = (options) => {
 		}
 		return genericProviders;
 	};
-	const retryDiscovery = (ctx, providerId) => {
+	const retryDiscovery = async (ctx, providerId) => {
 		const pendingDiscovery = getPendingDiscovery(ctx);
 		const pending = pendingDiscovery?.get(providerId);
 		if (!pending) return;
-		pending.attempt ??= buildProviders([pending.config], ctx, DISCOVERY_RETRY_TIMEOUT_MS).then(([provider]) => {
-			if (!provider) return;
-			pendingDiscovery?.delete(providerId);
-			ctx.socialProviders.unshift(provider);
-		}).finally(() => {
-			pending.attempt = void 0;
-		});
-		return pending.attempt;
+		const [provider] = await buildProviders([pending], ctx, DISCOVERY_RETRY_TIMEOUT_MS);
+		if (!provider || !pendingDiscovery?.delete(providerId)) return;
+		ctx.socialProviders.unshift(provider);
 	};
 	const requestedProviderId = (context) => {
 		const id = context.body?.provider ?? context.body?.providerId ?? context.query?.provider ?? context.params?.id;
@@ -326,7 +342,7 @@ const genericOAuth = (options) => {
 		init: async (ctx) => {
 			const genericProviders = await buildProviders(options.config, ctx);
 			const built = new Set(genericProviders.map((p) => p.id));
-			const genericOAuthPendingDiscovery = new Map(options.config.filter((c) => !built.has(c.providerId)).map((c) => [c.providerId, { config: c }]));
+			const genericOAuthPendingDiscovery = new Map(options.config.filter((c) => !built.has(c.providerId)).map((c) => [c.providerId, c]));
 			const existingIds = new Set(ctx.socialProviders.map((p) => p.id));
 			for (const gp of genericProviders) if (existingIds.has(gp.id)) ctx.logger.warn(`Generic OAuth provider "${gp.id}" shadows a built-in social provider with the same ID`);
 			return { context: {

package/dist/plugins/generic-oauth/types.d.mts

@@ -211,13 +211,21 @@ export interface GenericOAuthConfig<ID extends string = string> {
    */
   authentication?: ("basic" | "post") | undefined;
   /**
-   * Custom headers to include in the discovery request.
+   * Custom headers to include in the discovery request, and in the JWKS request when
+   * `jwks_uri` has the same origin as `discoveryUrl`. When set, discovery follows
+   * redirects only within that origin and fails on a redirect to another origin.
    * Useful for providers like Epic that require specific headers (e.g., Epic-Client-ID).
    */
   discoveryHeaders?: Record<string, string> | undefined;
   /**
-   * Custom headers to include in the authorization request.
+   * Custom headers to include in token endpoint requests: the authorization
+   * code exchange and token refresh. A custom `getToken` replaces the default
+   * code exchange, so it must add these headers itself.
    * Useful for providers like Qonto that require specific headers (e.g., X-Qonto-Staging-Token for local development).
+   *
+   * `Authorization` is not allowed in any letter case, and initialization fails
+   * if it is present. Set it from `tokenEndpointAuth` with `method: "custom"`
+   * and `customizeRequest` instead.
    */
   authorizationHeaders?: Record<string, string> | undefined;
   /**

package/dist/plugins/one-tap/client.d.mts

@@ -138,6 +138,10 @@ export interface GoogleOneTapActionOptions extends Omit<GoogleOneTapOptions, "cl
    * This lets you render an alternative UI (e.g. a Google Sign-In button) to restart the process.
    */
   onPromptNotification?: ((notification?: any | undefined) => void) | undefined;
+  /**
+   * @deprecated Ignored. The client fetches a single-use nonce from
+   * `/one-tap/nonce` for every prompt and button render.
+   */
   nonce?: string | undefined;
   /**
    * Button mode configuration. When provided, renders a "Sign In with Google" button

package/dist/plugins/one-tap/client.mjs

@@ -2,6 +2,9 @@ import { PACKAGE_VERSION } from "../../version.mjs";
 import { isSafeUrlScheme } from "@better-auth/core/utils/url";
 //#region src/plugins/one-tap/client.ts
 let isRequestInProgress = false;
+const BUTTON_NONCE_REFRESH_MS = 24e4;
+const BUTTON_NONCE_RETRY_MS = 1e4;
+const buttonRefreshTimers = /* @__PURE__ */ new WeakMap();
 function isFedCMSupported() {
 	return typeof window !== "undefined" && "IdentityCredential" in window;
 }
@@ -33,102 +36,112 @@ const oneTapClient = (options) => {
 					console.warn("Google One Tap is only available in browser environments");
 					return;
 				}
-				if (opts?.button) {
-					await loadGoogleScript();
-					const container = typeof opts.button.container === "string" ? document.querySelector(opts.button.container) : opts.button.container;
-					if (!container) {
-						console.error("Google One Tap: Button container not found", opts.button.container);
-						return;
-					}
-					async function callback(idToken) {
-						if ((await $fetch("/one-tap/callback", {
-							method: "POST",
-							body: {
-								idToken,
-								callbackURL: opts?.callbackURL
-							},
-							...opts?.fetchOptions,
-							...fetchOptions
-						}))?.error) return;
-						if (!opts?.fetchOptions && !fetchOptions || opts?.callbackURL) {
-							const target = opts?.callbackURL ?? "/";
-							if (isSafeUrlScheme(target)) window.location.href = target;
-						}
-					}
-					const autoSelect = opts?.autoSelect ?? options.autoSelect;
-					const cancelOnTapOutside = opts?.cancelOnTapOutside ?? options.cancelOnTapOutside;
-					const contextValue = opts?.context ?? options.context ?? "signin";
-					window.google?.accounts.id.initialize({
-						client_id: options.clientId,
-						callback: async (response) => {
-							try {
-								await callback(response.credential);
-							} catch (error) {
-								console.error("Error during button callback:", error);
-							}
-						},
-						auto_select: autoSelect,
-						cancel_on_tap_outside: cancelOnTapOutside,
-						context: contextValue,
-						ux_mode: opts?.uxMode || "popup",
-						nonce: opts?.nonce,
-						itp_support: true,
-						...opts.button.fedCM && {
-							use_fedcm_for_button: true,
-							button_auto_select: autoSelect
-						},
-						...options.additionalOptions
-					});
-					window.google?.accounts.id.renderButton(container, opts.button.config ?? { type: "icon" });
-					return;
-				}
-				async function callback(idToken) {
+				if (opts?.nonce !== void 0) console.warn("Google One Tap: the `nonce` option is ignored; the nonce is issued by the server.");
+				/** Returns whether it navigated away. */
+				async function callback(idToken, nonce) {
 					if ((await $fetch("/one-tap/callback", {
 						method: "POST",
 						body: {
 							idToken,
+							nonce,
 							callbackURL: opts?.callbackURL
 						},
 						...opts?.fetchOptions,
 						...fetchOptions
-					}))?.error) return;
+					}))?.error) return false;
 					if (!opts?.fetchOptions && !fetchOptions || opts?.callbackURL) {
 						const target = opts?.callbackURL ?? "/";
-						if (isSafeUrlScheme(target)) window.location.href = target;
+						if (isSafeUrlScheme(target)) {
+							window.location.href = target;
+							return true;
+						}
 					}
+					return false;
 				}
+				const { body: _body, query: _query, params: _params, output: _output, errorSchema: _errorSchema, onResponse: _onResponse, onSuccess: _onSuccess, onError: _onError, onRetry: _onRetry, ...nonceFetchOptions } = {
+					...opts?.fetchOptions,
+					...fetchOptions
+				};
+				const fetchNonce = async () => {
+					const { data, error } = await $fetch("/one-tap/nonce", {
+						...nonceFetchOptions,
+						method: "POST",
+						throw: false
+					});
+					if (!data?.nonce) throw new Error("Google One Tap: failed to fetch a nonce", { cause: error });
+					return data.nonce;
+				};
 				const autoSelect = opts?.autoSelect ?? options.autoSelect;
-				const cancelOnTapOutside = opts?.cancelOnTapOutside ?? options.cancelOnTapOutside;
-				const contextValue = opts?.context ?? options.context ?? "signin";
+				const initialize = (nonce, onCredential) => window.google?.accounts.id.initialize({
+					client_id: options.clientId,
+					callback: onCredential,
+					auto_select: autoSelect,
+					cancel_on_tap_outside: opts?.cancelOnTapOutside ?? options.cancelOnTapOutside,
+					context: opts?.context ?? options.context ?? "signin",
+					ux_mode: opts?.uxMode || "popup",
+					/**
+					* @see {@link https://developers.google.com/identity/gsi/web/guides/overview}
+					*/
+					itp_support: true,
+					...opts?.button?.fedCM && {
+						use_fedcm_for_button: true,
+						button_auto_select: autoSelect
+					},
+					...options.additionalOptions,
+					nonce
+				});
+				if (opts?.button) {
+					await loadGoogleScript();
+					const container = typeof opts.button.container === "string" ? document.querySelector(opts.button.container) : opts.button.container;
+					if (!container) {
+						console.error("Google One Tap: Button container not found", opts.button.container);
+						return;
+					}
+					const buttonConfig = opts.button.config ?? { type: "icon" };
+					const renderButton = async () => {
+						clearTimeout(buttonRefreshTimers.get(container));
+						const nonce = await fetchNonce();
+						initialize(nonce, async (response) => {
+							let navigated = false;
+							try {
+								navigated = await callback(response.credential, nonce);
+							} catch (error) {
+								console.error("Error during button callback:", error);
+							}
+							if (!navigated) await refreshButton();
+						});
+						container.replaceChildren();
+						buttonRefreshTimers.set(container, setTimeout(refreshButton, BUTTON_NONCE_REFRESH_MS));
+						window.google?.accounts.id.renderButton(container, buttonConfig);
+					};
+					const refreshButton = async () => {
+						if (!container.isConnected) return;
+						try {
+							await renderButton();
+						} catch (error) {
+							console.error("Google One Tap: failed to refresh the button", error);
+							buttonRefreshTimers.set(container, setTimeout(refreshButton, BUTTON_NONCE_RETRY_MS));
+						}
+					};
+					await renderButton();
+					return;
+				}
 				isRequestInProgress = true;
 				try {
-					await loadGoogleScript();
+					const [, nonce] = await Promise.all([loadGoogleScript(), fetchNonce()]);
 					await new Promise((resolve, reject) => {
 						let isResolved = false;
 						const baseDelay = options.promptOptions?.baseDelay ?? 1e3;
 						const maxAttempts = options.promptOptions?.maxAttempts ?? 5;
-						window.google?.accounts.id.initialize({
-							client_id: options.clientId,
-							callback: async (response) => {
-								isResolved = true;
-								try {
-									await callback(response.credential);
-									resolve();
-								} catch (error) {
-									console.error("Error during One Tap callback:", error);
-									reject(error);
-								}
-							},
-							auto_select: autoSelect,
-							cancel_on_tap_outside: cancelOnTapOutside,
-							context: contextValue,
-							ux_mode: opts?.uxMode || "popup",
-							nonce: opts?.nonce,
-							/**
-							* @see {@link https://developers.google.com/identity/gsi/web/guides/overview}
-							*/
-							itp_support: true,
-							...options.additionalOptions
+						initialize(nonce, async (response) => {
+							isResolved = true;
+							try {
+								await callback(response.credential, nonce);
+								resolve();
+							} catch (error) {
+								console.error("Error during One Tap callback:", error);
+								reject(error);
+							}
 						});
 						const handlePrompt = (attempt) => {
 							if (isResolved) return;

package/dist/plugins/one-tap/index.d.mts

@@ -26,10 +26,50 @@ export declare const oneTap: (options?: OneTapOptions | undefined) => {
   id: "one-tap";
   version: string;
   endpoints: {
+    /**
+     * ### Endpoint
+     *
+     * POST `/one-tap/nonce`
+     *
+     * Issues a single-use nonce to pass to Google before requesting the
+     * One Tap ID token. `/one-tap/callback` consumes it and requires the
+     * token's `nonce` claim to match.
+     */
+    oneTapNonce: import("better-call").StrictEndpoint<"/one-tap/nonce", {
+      method: "POST";
+      metadata: {
+        noStore: boolean;
+        openapi: {
+          summary: string;
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      nonce: {
+                        type: "string";
+                      };
+                    };
+                    required: string[];
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      nonce: string;
+    }>;
     oneTapCallback: import("better-call").StrictEndpoint<"/one-tap/callback", {
       method: "POST";
       body: z.ZodObject<{
         idToken: z.ZodString;
+        nonce: z.ZodString;
         callbackURL: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;
       metadata: {

package/dist/plugins/one-tap/index.mjs

@@ -5,6 +5,7 @@ import { toOAuthProfileRecord } from "../../oauth2/account-key.mjs";
 import { OAUTH_CALLBACK_ERROR_CODES } from "../../oauth2/errors.mjs";
 import { toBoolean } from "../../utils/boolean.mjs";
 import { handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
+import { consumeNonce, issueNonce, issuedNonceResponses } from "../../api/routes/id-token-nonce.mjs";
 import { APIError as APIError$1 } from "../../api/index.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { BASE_ERROR_CODES } from "@better-auth/core/error";
@@ -14,6 +15,7 @@ import * as z from "zod";
 //#region src/plugins/one-tap/index.ts
 const oneTapCallbackBodySchema = z.object({
 	idToken: z.string().meta({ description: "Google ID token, which the client obtains from the One Tap API" }),
+	nonce: z.string().meta({ description: "Nonce issued by /one-tap/nonce and passed to Google when the ID token was requested" }),
 	/**
 	* Sent so the global origin-check middleware validates the post-login
 	* redirect target against `trustedOrigins`. Without it the client performs
@@ -21,98 +23,123 @@ const oneTapCallbackBodySchema = z.object({
 	*/
 	callbackURL: z.string().meta({ description: "URL to redirect to after a successful sign-in" }).optional()
 });
+const ONE_TAP_NONCE_SCOPE = "one-tap-nonce";
 const oneTap = (options) => ({
 	id: "one-tap",
 	version: PACKAGE_VERSION,
-	endpoints: { oneTapCallback: createAuthEndpoint("/one-tap/callback", {
-		method: "POST",
-		body: oneTapCallbackBodySchema,
-		metadata: { openapi: {
-			summary: "One tap callback",
-			description: "Use this endpoint to authenticate with Google One Tap",
-			responses: {
-				200: {
-					description: "Successful response",
-					content: { "application/json": { schema: {
-						type: "object",
-						properties: {
-							session: { $ref: "#/components/schemas/Session" },
-							user: { $ref: "#/components/schemas/User" }
-						}
-					} } }
-				},
-				400: { description: "Invalid token" }
+	endpoints: {
+		/**
+		* ### Endpoint
+		*
+		* POST `/one-tap/nonce`
+		*
+		* Issues a single-use nonce to pass to Google before requesting the
+		* One Tap ID token. `/one-tap/callback` consumes it and requires the
+		* token's `nonce` claim to match.
+		*/
+		oneTapNonce: createAuthEndpoint("/one-tap/nonce", {
+			method: "POST",
+			metadata: {
+				noStore: true,
+				openapi: {
+					summary: "Issue a One Tap nonce",
+					description: "Issue a single-use nonce to bind a Google One Tap ID token to one sign-in",
+					responses: issuedNonceResponses
+				}
+			}
+		}, async (ctx) => ctx.json({ nonce: await issueNonce(ctx, ONE_TAP_NONCE_SCOPE) })),
+		oneTapCallback: createAuthEndpoint("/one-tap/callback", {
+			method: "POST",
+			body: oneTapCallbackBodySchema,
+			metadata: { openapi: {
+				summary: "One tap callback",
+				description: "Use this endpoint to authenticate with Google One Tap",
+				responses: {
+					200: {
+						description: "Successful response",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: {
+								session: { $ref: "#/components/schemas/Session" },
+								user: { $ref: "#/components/schemas/User" }
+							}
+						} } }
+					},
+					400: { description: "Invalid token" }
+				}
+			} }
+		}, async (ctx) => {
+			const { idToken, nonce } = ctx.body;
+			await consumeNonce(ctx, ONE_TAP_NONCE_SCOPE, nonce);
+			const googleOAuthProvider = await getAwaitableValue(ctx.context.socialProviders, { value: "google" });
+			const googleProvider = typeof ctx.context.options.socialProviders?.google === "function" ? await ctx.context.options.socialProviders?.google() : ctx.context.options.socialProviders?.google;
+			const audience = options?.clientId || googleProvider?.clientId;
+			if (!audience || Array.isArray(audience) && audience.length === 0) throw new APIError$1("BAD_REQUEST", { message: "Google client ID is required for One Tap. Set it on the oneTap plugin (clientId) or on socialProviders.google." });
+			const payload = await verifyGoogleIdToken({
+				token: idToken,
+				audience,
+				nonce
+			});
+			if (!payload) throw new APIError$1("BAD_REQUEST", { message: "invalid id token" });
+			if (!payload.sub) throw new APIError$1("BAD_REQUEST", { message: "invalid id token" });
+			const configuredHostedDomain = googleProvider?.hd;
+			if (!isGoogleHostedDomainAllowed(configuredHostedDomain, payload.hd)) {
+				ctx.context.logger.error(`Google One Tap sign-in rejected: id token hosted domain (hd) "${payload.hd ?? "<missing>"}" does not satisfy the configured "hd" option "${configuredHostedDomain}".`);
+				throw new APIError$1("BAD_REQUEST", { message: "invalid id token" });
 			}
-		} }
-	}, async (ctx) => {
-		const { idToken } = ctx.body;
-		const googleProvider = typeof ctx.context.options.socialProviders?.google === "function" ? await ctx.context.options.socialProviders?.google() : ctx.context.options.socialProviders?.google;
-		const audience = options?.clientId || googleProvider?.clientId;
-		if (!audience || Array.isArray(audience) && audience.length === 0) throw new APIError$1("BAD_REQUEST", { message: "Google client ID is required for One Tap. Set it on the oneTap plugin (clientId) or on socialProviders.google." });
-		const payload = await verifyGoogleIdToken({
-			token: idToken,
-			audience
-		});
-		if (!payload) throw new APIError$1("BAD_REQUEST", { message: "invalid id token" });
-		if (!payload.sub) throw new APIError$1("BAD_REQUEST", { message: "invalid id token" });
-		const configuredHostedDomain = googleProvider?.hd;
-		if (!isGoogleHostedDomainAllowed(configuredHostedDomain, payload.hd)) {
-			ctx.context.logger.error(`Google One Tap sign-in rejected: id token hosted domain (hd) "${payload.hd ?? "<missing>"}" does not satisfy the configured "hd" option "${configuredHostedDomain}".`);
-			throw new APIError$1("BAD_REQUEST", { message: "invalid id token" });
-		}
-		const googleOAuthProvider = await getAwaitableValue(ctx.context.socialProviders, { value: "google" });
-		const providerResult = googleOAuthProvider ? await googleOAuthProvider.getUserInfo({ idToken }) : {
-			user: {
-				name: payload.name,
-				email: payload.email,
-				image: payload.picture,
-				emailVerified: toBoolean(payload.email_verified)
-			},
-			data: payload
-		};
-		if (!providerResult?.user) throw new APIError$1("BAD_REQUEST", { message: "invalid id token" });
-		const providerUser = providerResult.user;
-		const { sub } = payload;
-		const { email: rawEmail, name, image } = providerUser;
-		if (typeof rawEmail !== "string" || !rawEmail) throw new APIError$1("BAD_REQUEST", { message: "Email not available in token" });
-		if (typeof sub !== "string" || !sub) throw new APIError$1("BAD_REQUEST", { message: "invalid id token" });
-		const email = rawEmail.toLowerCase();
-		const emailVerified = toBoolean(providerUser.emailVerified);
-		const result = await handleOAuthUserInfo(ctx, {
-			userInfo: {
-				...providerUser,
-				id: sub,
-				email,
-				emailVerified,
-				name: typeof name === "string" ? name : "",
-				image: typeof image === "string" ? image : void 0
-			},
-			account: {
-				providerId: "google",
-				accountId: sub,
-				idToken,
-				scope: "openid,profile,email"
-			},
-			disableSignUp: options?.disableSignup || googleProvider?.disableSignUp,
-			overrideUserInfo: googleProvider?.overrideUserInfoOnSignIn,
-			source: {
-				method: "oauth",
-				oauth: {
+			const providerResult = googleOAuthProvider ? await googleOAuthProvider.getUserInfo({ idToken }) : {
+				user: {
+					name: payload.name,
+					email: payload.email,
+					image: payload.picture,
+					emailVerified: toBoolean(payload.email_verified)
+				},
+				data: payload
+			};
+			if (!providerResult?.user) throw new APIError$1("BAD_REQUEST", { message: "invalid id token" });
+			const providerUser = providerResult.user;
+			const { sub } = payload;
+			const { email: rawEmail, name, image } = providerUser;
+			if (typeof rawEmail !== "string" || !rawEmail) throw new APIError$1("BAD_REQUEST", { message: "Email not available in token" });
+			if (typeof sub !== "string" || !sub) throw new APIError$1("BAD_REQUEST", { message: "invalid id token" });
+			const email = rawEmail.toLowerCase();
+			const emailVerified = toBoolean(providerUser.emailVerified);
+			const result = await handleOAuthUserInfo(ctx, {
+				userInfo: {
+					...providerUser,
+					id: sub,
+					email,
+					emailVerified,
+					name: typeof name === "string" ? name : "",
+					image: typeof image === "string" ? image : void 0
+				},
+				account: {
 					providerId: "google",
-					profile: toOAuthProfileRecord(providerResult.data)
+					accountId: sub,
+					idToken,
+					scope: "openid,profile,email"
+				},
+				disableSignUp: options?.disableSignup || googleProvider?.disableSignUp,
+				overrideUserInfo: googleProvider?.overrideUserInfoOnSignIn,
+				source: {
+					method: "oauth",
+					oauth: {
+						providerId: "google",
+						profile: toOAuthProfileRecord(providerResult.data)
+					}
 				}
+			});
+			if (result.error) {
+				if (result.error === OAUTH_CALLBACK_ERROR_CODES.EMAIL_NOT_VERIFIED) throw APIError$1.from("FORBIDDEN", BASE_ERROR_CODES.EMAIL_NOT_VERIFIED);
+				throw new APIError$1("UNAUTHORIZED", { message: result.error });
 			}
-		});
-		if (result.error) {
-			if (result.error === OAUTH_CALLBACK_ERROR_CODES.EMAIL_NOT_VERIFIED) throw APIError$1.from("FORBIDDEN", BASE_ERROR_CODES.EMAIL_NOT_VERIFIED);
-			throw new APIError$1("UNAUTHORIZED", { message: result.error });
-		}
-		await setSessionCookie(ctx, result.data);
-		return ctx.json({
-			token: result.data.session.token,
-			user: parseUserOutput(ctx.context.options, result.data.user)
-		});
-	}) },
+			await setSessionCookie(ctx, result.data);
+			return ctx.json({
+				token: result.data.session.token,
+				user: parseUserOutput(ctx.context.options, result.data.user)
+			});
+		})
+	},
 	options
 });
 //#endregion

package/dist/plugins/siwe/index.mjs

@@ -274,9 +274,9 @@ const siwe = (options) => {
 					});
 				} catch (error) {
 					if (isAPIError(error)) throw error;
+					ctx.context.logger.error("Failed to verify SIWE message", error);
 					throw APIError.fromStatus("UNAUTHORIZED", {
 						message: "Something went wrong. Please try again later.",
-						error: error instanceof Error ? error.message : "Unknown error",
 						status: 401
 					});
 				}

package/dist/state.d.mts

@@ -1,6 +1,7 @@
 import { GenericEndpointContext } from "@better-auth/core";
 import { BetterAuthError } from "@better-auth/core/error";
 import * as z from "zod";
+import { getAuthStateVerificationIdentifier } from "@better-auth/core/utils/state";
 //#region src/state.d.ts
 declare const stateDataSchema: z.ZodObject<{
   callbackURL: z.ZodString;
@@ -19,10 +20,6 @@ declare const stateDataSchema: z.ZodObject<{
   serverContext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$loose>;
 export type StateData = z.infer<typeof stateDataSchema>;
-/**
- * Verification key for database-backed OAuth and SAML relay state.
- */
-export declare const getAuthStateVerificationIdentifier: (state: string) => string;
 export declare function generateGenericState(c: GenericEndpointContext, stateData: StateData, settings?: {
   cookieName: string;
 }): Promise<{
@@ -50,4 +47,4 @@ export declare function parseGenericState(c: GenericEndpointContext, state: stri
   serverContext?: Record<string, unknown> | undefined;
 }>;
 //#endregion
-export {};
+export { getAuthStateVerificationIdentifier };

package/dist/state.mjs

@@ -4,6 +4,7 @@ import { expireCookie } from "./cookies/index.mjs";
 import { derivePurposeKey } from "./crypto/purpose.mjs";
 import { BetterAuthError } from "@better-auth/core/error";
 import * as z from "zod";
+import { getAuthStateVerificationIdentifier } from "@better-auth/core/utils/state";
 //#region src/state.ts
 const stateDataSchema = z.looseObject({
 	callbackURL: z.string(),
@@ -37,10 +38,6 @@ const stateDataSchema = z.looseObject({
 	*/
 	serverContext: z.record(z.string(), z.unknown()).optional()
 });
-/**
-* Verification key for database-backed OAuth and SAML relay state.
-*/
-const getAuthStateVerificationIdentifier = (state) => `auth-state:${state}`;
 const INTERNAL_STATE_KEYS = new Set(Object.keys(stateDataSchema.shape));
 var StateError = class extends BetterAuthError {
 	code;

package/dist/test-utils/http-test-instance.d.mts

@@ -200,6 +200,14 @@ export declare function getHttpTestInstance<O extends Partial<BetterAuthOptions>
         readonly code: "ID_TOKEN_NOT_SUPPORTED";
         message: string;
       };
+      INVALID_ID_TOKEN_NONCE: {
+        readonly code: "INVALID_ID_TOKEN_NONCE";
+        message: string;
+      };
+      ID_TOKEN_NONCE_NOT_ENABLED: {
+        readonly code: "ID_TOKEN_NONCE_NOT_ENABLED";
+        message: string;
+      };
       FAILED_TO_GET_USER_INFO: {
         readonly code: "FAILED_TO_GET_USER_INFO";
         message: string;

package/dist/utils/hide-metadata.d.mts

@@ -1,5 +1,2 @@
-//#region src/utils/hide-metadata.d.ts
-export declare const HIDE_METADATA: {
-  readonly scope: "server";
-};
-//#endregion
+import { HIDE_METADATA } from "@better-auth/core/api";
+export { HIDE_METADATA };

package/dist/utils/hide-metadata.mjs

@@ -1,4 +1 @@
-//#region src/utils/hide-metadata.ts
-const HIDE_METADATA = { scope: "server" };
-//#endregion
-export { HIDE_METADATA };
+export { HIDE_METADATA } from "@better-auth/core/api";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.8.0-beta.7",
+  "version": "1.8.0-beta.8",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -503,13 +503,13 @@
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.3.0",
     "zod": "^4.5.4",
-    "@better-auth/core": "1.8.0-beta.7",
-    "@better-auth/drizzle-adapter": "1.8.0-beta.7",
-    "@better-auth/kysely-adapter": "1.8.0-beta.7",
-    "@better-auth/memory-adapter": "1.8.0-beta.7",
-    "@better-auth/mongo-adapter": "1.8.0-beta.7",
-    "@better-auth/prisma-adapter": "1.8.0-beta.7",
-    "@better-auth/telemetry": "1.8.0-beta.7"
+    "@better-auth/core": "1.8.0-beta.8",
+    "@better-auth/drizzle-adapter": "1.8.0-beta.8",
+    "@better-auth/kysely-adapter": "1.8.0-beta.8",
+    "@better-auth/memory-adapter": "1.8.0-beta.8",
+    "@better-auth/mongo-adapter": "1.8.0-beta.8",
+    "@better-auth/prisma-adapter": "1.8.0-beta.8",
+    "@better-auth/telemetry": "1.8.0-beta.8"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.121.2",