Better Auth OpenID Connect Provider
Open-source, framework-agnostic authentication and authorization library for TypeScript. Embedded directly in your application and backed by your own database, with a plugin system covering 2FA, passkeys, organizations, SSO/SAML, SCIM, an OAuth 2.1 / OpenID Connect provider and MCP/agent auth. Core differentiator: it is a library, not a hosted service, so there is no vendor server, no per-user pricing and no redirect to a third-party domain. An optional paid Better Auth Infrastructure adds a dashboard, audit logs, security detections and managed email/SMS.
Features
If you want to compare OpenID Connect features of different providers, please check out the OpenID Connect Providers benchmark.
Looking for Better Auth’s (C)IAM features like MFA, SSO, and user management? View Better Auth on the (C)IAM Identity Providers benchmark.
Frequently Asked Questions
Does Better Auth support the Authorization Code grant type?
Better Auth supports Authorization Code grant type. Authorization code flow with mandatory S256 PKCE and the RFC 9207 iss response parameter. Only response_type "code" is supported. Read more
Does Better Auth support the Refresh Token grant type?
Better Auth supports Refresh Token grant type. Issued when the offline_access scope is granted. A new refresh token is issued on every refresh, with an optional reuse interval and token-family invalidation on replay. Read more
Does Better Auth support the Client Credentials grant type?
Better Auth supports Client Credentials grant type. Fail-closed: an administrator must explicitly allow client_credentials_scopes and approve the client privilege before a client can use the grant. Read more
Does Better Auth support the Implicit grant type?
Better Auth does not support Implicit grant type. Only response_type "code" is supported; implicit and hybrid flows are not available. Read more
Does Better Auth support the Token Exchange grant type?
Better Auth does not support Token Exchange grant type. Not part of the documented grant types. Custom grants can be added through the extension API. Read more
Does Better Auth support the Client Initiated BackChannel Authentication grant type?
Better Auth does not support Client Initiated BackChannel Authentication grant type. The OAuth provider does not support CIBA as a grant type. Read more
Does Better Auth support the Device Authorization Grant grant type?
Better Auth supports Device Authorization Grant grant type. Available through the optional oauthDeviceAuthorization() plugin on top of the OAuth Provider. Issues scoped, audience-bound JWT access tokens. Public clients register with token_endpoint_auth_method "none". Read more
Does Better Auth support the JWT Bearer Token grant type?
Better Auth does not support JWT Bearer Token grant type. Not part of the documented grant types. Read more
Does Better Auth support the SAML 2.0 Bearer Assertion grant type?
Better Auth does not support SAML 2.0 Bearer Assertion grant type. Not part of the documented grant types. Read more
Does Better Auth support the Resource Owner Password Credentials grant type?
Better Auth does not support Resource Owner Password Credentials grant type. The resource owner password credentials grant is not supported. Read more
Does Better Auth support the PKCE extension?
Better Auth supports PKCE extension. S256 is required for public clients; the plain method is rejected. Confidential clients created by an administrator can opt out with require_pkce: false. Read more
Does Better Auth support the PAR extension?
Better Auth does not support PAR extension. Pushed Authorization Requests are not documented. Read more
Does Better Auth support the RAR extension?
Better Auth does not support RAR extension. Rich Authorization Requests are not documented. Read more
Does Better Auth support the JAR extension?
Better Auth does not support JAR extension. JWT-Secured Authorization Requests (request objects) are not documented. Read more
Does Better Auth support the Authorization Endpoint endpoint?
Better Auth supports Authorization Endpoint endpoint. Served at /oauth2/authorize. Read more
Does Better Auth support the Token Endpoint endpoint?
Better Auth supports Token Endpoint endpoint. Served at /oauth2/token. Read more
Does Better Auth support the UserInfo Endpoint endpoint?
Better Auth supports UserInfo Endpoint endpoint. Served at /oauth2/userinfo. Requires the openid scope. Claims follow granted scopes and the OIDC claims request parameter, and can be extended with customUserInfoClaims. Read more
Does Better Auth support the Token Revocation endpoint?
Better Auth supports Token Revocation endpoint. Opaque access tokens are deleted on revocation, and revoking a refresh token removes the access tokens it minted. JWT access tokens cannot be revoked server-side, so short lifetimes are recommended. Read more
Does Better Auth support the Token Introspection endpoint?
Better Auth supports Token Introspection endpoint. RFC 7662 at /oauth2/introspect. Callable by the client that obtained the token or by a linked resource server. Introspection authenticated with a bearer token or private_key_jwt is not yet implemented. Read more
Does Better Auth support the Device Authorization Endpoint endpoint?
Better Auth supports Device Authorization Endpoint endpoint. RFC 8628 device authorization via the optional oauthDeviceAuthorization() plugin. Read more
Does Better Auth support the OpenID Connect Discovery Endpoint endpoint?
Better Auth supports OpenID Connect Discovery Endpoint endpoint. Served at /.well-known/openid-configuration when the openid scope is enabled, with helper routes for frameworks that do not forward well-known paths. Read more
Does Better Auth support the OAuth 2.0 Authorization Server Metadata Endpoint endpoint?
Better Auth supports OAuth 2.0 Authorization Server Metadata Endpoint endpoint. RFC 8414 metadata served at /.well-known/oauth-authorization-server. Read more
Does Better Auth support the none token endpoint authentication method?
Better Auth supports none token endpoint authentication method. Public clients with token_endpoint_auth_method "none" (PKCE required). Read more
Does Better Auth support the client_secret_basic token endpoint authentication method?
Better Auth supports client_secret_basic token endpoint authentication method. Supported (default for confidential clients). Read more
Does Better Auth support the client_secret_post token endpoint authentication method?
Better Auth supports client_secret_post token endpoint authentication method. Supported. Read more
Does Better Auth support the client_secret_jwt token endpoint authentication method?
Better Auth does not support client_secret_jwt token endpoint authentication method. Not listed among supported token endpoint authentication methods. Read more
Does Better Auth support the private_key_jwt token endpoint authentication method?
Better Auth supports private_key_jwt token endpoint authentication method. Supported with RS256/384/512, PS256/384/512, ES256/384/512 and EdDSA keys, registered inline (jwks) or by jwks_uri. Read more
Does Better Auth support the tls_client_auth token endpoint authentication method?
Better Auth does not support tls_client_auth token endpoint authentication method. Mutual TLS client authentication is not supported. Read more
Does Better Auth support the consent prompt?
Better Auth supports consent prompt. Configurable consent page, skip_consent for trusted clients, and per-user consent management. Read more
Does Better Auth support the select_account prompt?
Better Auth supports select_account prompt. Configurable account-selection page via selectAccount.page and oauth2Continue. Read more
Does Better Auth support the create prompt?
Better Auth supports create prompt. prompt=create redirects to the configured sign-up page. Read more
Does Better Auth support the RP-initiated Logout feature?
Better Auth supports RP-initiated Logout feature. OpenID Connect RP-Initiated Logout at /oauth2/end-session for clients registered with enable_end_session. Honors id_token_hint and exactly-matched post_logout_redirect_uri. Back-channel logout is also supported when the JWT plugin is enabled. Read more
Does Better Auth support the Dynamic Client Registration Protocol feature?
Better Auth supports Dynamic Client Registration Protocol feature. RFC 7591 at /oauth2/register. Disabled by default; can be enabled for authenticated, unauthenticated or initial-access-token registration. Client ID Metadata Documents (CIMD) are recommended for MCP clients. Read more
Does Better Auth support the Dynamic Client Registration Management Protocol feature?
Better Auth does not support Dynamic Client Registration Management Protocol feature. RFC 7592 registration management is not implemented. Read more
Does Better Auth support the Refresh Token Rotation feature?
Better Auth supports Refresh Token Rotation feature. A new refresh token is issued on every refresh request. Reusing a rotated token after the grace interval is treated as replay and invalidates the whole token family. Read more
Does Better Auth support the Refresh Token Rotation Grace Period feature?
Better Auth supports Refresh Token Rotation Grace Period feature. refreshTokenReuseInterval (seconds, default 0) lets a rotated token be reused briefly and return the same token response. The MCP plugin defaults it to 30 seconds. Read more
Does Better Auth support the OAuth 2.0 Demonstrating Proof of Possession (DPoP) feature?
Better Auth supports OAuth 2.0 Demonstrating Proof of Possession (DPoP) feature. RFC 9449 DPoP-bound access tokens, with advertised signing algorithms and per-resource dpopBoundAccessTokensRequired. Resource servers verify with verifyAccessTokenRequest. Read more
Does Better Auth support the FAPI 1.0 Security Profile - Part 1: Baseline feature?
Better Auth does not support FAPI 1.0 Security Profile - Part 1: Baseline feature. Not documented. Read more
Does Better Auth support the FAPI 1.0 Security Profile - Part 2: Advanced feature?
Better Auth does not support FAPI 1.0 Security Profile - Part 2: Advanced feature. Not documented. PAR, JAR, mTLS and JARM are not supported. Read more
Does Better Auth support the FAPI 2.0 Security Profile feature?
Better Auth does not support FAPI 2.0 Security Profile feature. Not documented. PAR is not supported. Read more
Does Better Auth support the FAPI 2.0 Message Signing feature?
Better Auth does not support FAPI 2.0 Message Signing feature. Not documented. Read more
Does Better Auth support the JARM feature?
Better Auth does not support JARM feature. JWT Secured Authorization Response Mode is not documented. Read more
Compare with other providers
Note: The current data is based on provider documentation/experience and may not be 100% accurate.