unstale

npm / @better-auth/passkey

@better-auth/passkey

What changed in @better-auth/passkey 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-11-03.

5 breaking5 security7 new APIs and options1 behavior and defaults6 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli on npm

@better-auth/passkey 124 changes

Breaking changes 5

  • userVerification now applies to authentication as well as registration; with required, registration and sign-in reject responses without user verification.

    1.7.16release notes

  • The expected WebAuthn origin now comes from server configuration: the origin option, or the baseURL origin plus a frontend origin listed exactly in trustedOrigins. Set origin when rpID is set and a wildcard in baseURL.allowedHosts covers it.

    1.7.16release notes

  • Sessions created from API keys are now refused on passkey registration routes.

    1.7.16release notes

  • Registration and authentication challenges can no longer be used interchangeably, preventing a registration from completing with an authentication challenge or vice versa.

    1.6.17release notes

  • Returns error message strings instead of error code objects.

    1.6.0release notes

Security 5

  • Passkey registration now rejects sessions revoked in the database or secondary storage, even when cookie caching is enabled.

    1.7.16release notes

  • @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

    1.7.0security advisory

  • @better-auth/scim: account takeover and stale access via SCIM provider-id collision

    1.6.22security advisory

  • @better-auth/stripe: cross-organization billing tampering in organization subscription actions

    1.6.21security advisory

  • OAuth 2.1 Provider: Unprivileged users can register OAuth clients

    1.6.5security advisory

New APIs and options 7

  • Adds an optional passkey registration setting that signs the user in after successful registration, sets the session cookie, and returns the session and user with the registered passkey.

    1.7.0release notes

  • Exports an extensible map of common authenticator names for displaying provider names when rendering passkeys.

    1.6.15release notes

  • Exports a function that resolves a friendly authenticator name from an AAGUID for rendering passkeys.

    1.6.15release notes

  • Can return a server-side default passkey name when the client supplies none.

    1.6.15release notes

  • Adds a pre-auth registration flow for passkeys.

    1.6.0release notes

  • The plugin interface gains an optional version field, and built-in plugins expose their version.

    1.6.0release notes

  • Adds WebAuthn extension support for passkeys.

    1.6.0release notes

Behavior and default changes 1

  • Official package peers accept @better-auth/utils versions ^0.4.2 or ^0.5.0, allowing compatibility across those versions.

    1.7.8release notes

Fixes and other changes 6

  • Fixed invalid OpenAPI output for passkey routes so client generators can consume the schema.

    1.6.19release notes

  • Passkey registration is rejected when the target user cannot be resolved.

    1.6.17release notes

  • Passkey names are trimmed during registration and update.

    1.6.15release notes

  • When passkey autofill authentication cannot start, the package returns a handled auth cancellation.

    1.6.10release notes

  • Passkey registration endpoint declarations now emit use: Middleware[] instead of Middleware[] | undefined, restoring compatibility and preserving plugin and client API inference when exactOptionalPropertyTypes is enabled.

    1.6.8release notes

  • The JSON response now includes user, matching the endpoint's declared OpenAPI schema and the client-side { session, user } return type.

    1.6.7release notes