# What changed in @better-auth/passkey

> 24 changes in @better-auth/passkey 1 from its official release notes, upgrade guides and advisories: 5 breaking, 5 security, 7 new APIs and options. Each one cited. Sources checked 2026-11-03. HTML: https://unstale.sh/npm/@better-auth/passkey/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @better-auth/passkey 1

### Breaking changes

- userVerification now applies to authentication as well as registration; with required, registration and sign-in reject responses without user verification. (1.7.16) — [release notes](https://github.com/better-auth/better-auth/blob/93edae16ebae910f57df360d0f43c2dcfa9f8c20/packages/passkey/CHANGELOG.md#1716)
- The expected WebAuthn origin now comes from server configuration: the origin option, or the baseURL origin plus a frontend origin listed exactly in trustedOrigins. Set origin when rpID is set and a wildcard in baseURL.allowedHosts covers it. (1.7.16) — [release notes](https://github.com/better-auth/better-auth/blob/93edae16ebae910f57df360d0f43c2dcfa9f8c20/packages/passkey/CHANGELOG.md#1716)
- Sessions created from API keys are now refused on passkey registration routes. (1.7.16) — [release notes](https://github.com/better-auth/better-auth/blob/93edae16ebae910f57df360d0f43c2dcfa9f8c20/packages/passkey/CHANGELOG.md#1716)
- Registration and authentication challenges can no longer be used interchangeably, preventing a registration from completing with an authentication challenge or vice versa. (1.6.17) — [release notes](https://github.com/better-auth/better-auth/blob/a936663d3a3c811af82ee9e9418d986f70662d9b/packages/passkey/CHANGELOG.md#1617)
- Returns error message strings instead of error code objects. (1.6.0) — [release notes](https://github.com/better-auth/better-auth/blob/a936663d3a3c811af82ee9e9418d986f70662d9b/packages/passkey/CHANGELOG.md#160)

### Security

- Passkey registration now rejects sessions revoked in the database or secondary storage, even when cookie caching is enabled. (1.7.16) — [release notes](https://github.com/better-auth/better-auth/blob/93edae16ebae910f57df360d0f43c2dcfa9f8c20/packages/passkey/CHANGELOG.md#1716)
- @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL (1.7.0) — [security advisory](https://github.com/advisories/GHSA-44JH-23M7-HPCF)
- @better-auth/scim: account takeover and stale access via SCIM provider-id collision (1.6.22) — [security advisory](https://github.com/advisories/GHSA-RJG6-39JM-RGG4)
- @better-auth/stripe: cross-organization billing tampering in organization subscription actions (1.6.21) — [security advisory](https://github.com/advisories/GHSA-H3RM-78G3-J7CP)
- OAuth 2.1 Provider: Unprivileged users can register OAuth clients (1.6.5) — [security advisory](https://github.com/advisories/GHSA-XR8F-H2GW-9XH6)

### New APIs and options

- Adds an optional passkey registration setting that signs the user in after successful registration, sets the session cookie, and returns the session and user with the registered passkey. (1.7.0) — [release notes](https://github.com/better-auth/better-auth/blob/a936663d3a3c811af82ee9e9418d986f70662d9b/packages/passkey/CHANGELOG.md#170)
- Exports an extensible map of common authenticator names for displaying provider names when rendering passkeys. (1.6.15) — [release notes](https://github.com/better-auth/better-auth/blob/a936663d3a3c811af82ee9e9418d986f70662d9b/packages/passkey/CHANGELOG.md#1615)
- Exports a function that resolves a friendly authenticator name from an AAGUID for rendering passkeys. (1.6.15) — [release notes](https://github.com/better-auth/better-auth/blob/a936663d3a3c811af82ee9e9418d986f70662d9b/packages/passkey/CHANGELOG.md#1615)
- Can return a server-side default passkey name when the client supplies none. (1.6.15) — [release notes](https://github.com/better-auth/better-auth/blob/a936663d3a3c811af82ee9e9418d986f70662d9b/packages/passkey/CHANGELOG.md#1615)
- Adds a pre-auth registration flow for passkeys. (1.6.0) — [release notes](https://github.com/better-auth/better-auth/blob/a936663d3a3c811af82ee9e9418d986f70662d9b/packages/passkey/CHANGELOG.md#160)
- The plugin interface gains an optional version field, and built-in plugins expose their version. (1.6.0) — [release notes](https://github.com/better-auth/better-auth/blob/a936663d3a3c811af82ee9e9418d986f70662d9b/packages/passkey/CHANGELOG.md#160)
- Adds WebAuthn extension support for passkeys. (1.6.0) — [release notes](https://github.com/better-auth/better-auth/blob/a936663d3a3c811af82ee9e9418d986f70662d9b/packages/passkey/CHANGELOG.md#160)

### Behavior and default changes

- Official package peers accept @better-auth/utils versions ^0.4.2 or ^0.5.0, allowing compatibility across those versions. (1.7.8) — [release notes](https://github.com/better-auth/better-auth/blob/a936663d3a3c811af82ee9e9418d986f70662d9b/packages/passkey/CHANGELOG.md#178)

### Fixes and other changes

- Fixed invalid OpenAPI output for passkey routes so client generators can consume the schema. (1.6.19) — [release notes](https://github.com/better-auth/better-auth/blob/a936663d3a3c811af82ee9e9418d986f70662d9b/packages/passkey/CHANGELOG.md#1619)
- Passkey registration is rejected when the target user cannot be resolved. (1.6.17) — [release notes](https://github.com/better-auth/better-auth/blob/a936663d3a3c811af82ee9e9418d986f70662d9b/packages/passkey/CHANGELOG.md#1617)
- Passkey names are trimmed during registration and update. (1.6.15) — [release notes](https://github.com/better-auth/better-auth/blob/a936663d3a3c811af82ee9e9418d986f70662d9b/packages/passkey/CHANGELOG.md#1615)
- When passkey autofill authentication cannot start, the package returns a handled auth cancellation. (1.6.10) — [release notes](https://github.com/better-auth/better-auth/blob/a936663d3a3c811af82ee9e9418d986f70662d9b/packages/passkey/CHANGELOG.md#1610)
- Passkey registration endpoint declarations now emit use: Middleware[] instead of Middleware[] | undefined, restoring compatibility and preserving plugin and client API inference when exactOptionalPropertyTypes is enabled. (1.6.8) — [release notes](https://github.com/better-auth/better-auth/blob/a936663d3a3c811af82ee9e9418d986f70662d9b/packages/passkey/CHANGELOG.md#168)
- The JSON response now includes user, matching the endpoint's declared OpenAPI schema and the client-side { session, user } return type. (1.6.7) — [release notes](https://github.com/better-auth/better-auth/blob/a936663d3a3c811af82ee9e9418d986f70662d9b/packages/passkey/CHANGELOG.md#167)