convex-better-auth-oidc

OIDC-compliant Convex plugin for Better Auth.

Problem

The default convex() plugin from @convex-dev/better-auth includes all user fields (including additionalFields) in the JWT via ...user, which causes the error:

"Could not parse as OIDC ID token. Token might not be an OIDC-compliant JWT."

Solution

This package provides a drop-in replacement for the convex() plugin that guarantees OIDC-compliant JWT tokens by only including standard OIDC claims:

• sub (subject/user ID) - REQUIRED
• name, email, email_verified, picture (optional)
• iat (issued at)

Installation

npm install convex-better-auth-oidc

Usage

import { convex } from "convex-better-auth-oidc";
import { betterAuth } from "better-auth";

export const auth = betterAuth({
  // ... your config
  plugins: [
    convex(), // ✅ OIDC-compliant by default
    // ... other plugins
  ],
});

Options

The plugin accepts the same options as the original convex() plugin:

convex({
  jwtExpirationSeconds?: number; // Default: 60 * 15 (15 minutes)
  deleteExpiredSessionsOnLogin?: boolean;
  options?: { basePath?: string };
})

Maintenance

Quand @convex-dev/better-auth publie une nouvelle version, consultez UPDATE_GUIDE.md pour savoir comment mettre à jour ce package tout en conservant la conformité OIDC.

Vérifier les Nouvelles Versions

npm run update:check

License

MIT