Is this suited for github?

• Yes, this is suited for github

To Reproduce

https://github.com/Cybermb/better-auth-new-nextjs-sso-issue

1. Clone the reproduction repository.

2. Set the required environment variables.

3. Run the development server.

4. Click the sign-in button.

5. Authenticate using GitHub (also reproducible with Google and Discord).

6. Observe the error after redirect.

Current vs. Expected behavior

When signing in using a social provider via the client library (not a server action), an error is thrown during the callback phase:

APIError [Error [APIError]: ] {
  status: 'FOUND',
  body: undefined,
  headers: Headers {
    'set-cookie': '__Secure-better-auth.state=; Max-Age=0; Secure, __Secure-better-auth.session_token=JbFVwakAGlkSJ7Ro5p3e8jXFb6JUzJLe.ymH39VA4gTmnmfWOSVph8GnCh1flVoZ2qrsU9zgPVrs%3D; Max-Age=604800; Path=/; HttpOnly; Secure; SameSite=None',
    location: 'http://localhost:3000'
  },
  statusCode: 302
}

The error indicates a state mismatch, even though:

• The state parameter appears to be present in the callback URL.

• Authentication ultimately succeeds.

• A valid session cookie is set.

• The user is redirected correctly.

Expected behavior:

• No error should be thrown during a successful OAuth sign-in flow.

• State validation should pass when using the client-side sign-in API, as it did prior to v1.4.4.

What version of Better Auth are you using?

1.4.4-1.4.9

System info

{
  "system": {
    "platform": "win32",
    "arch": "x64",
  },
  "node": {
    "version": "v22.19.0",
    "env": "production"
  },
  "packageManager": {
    "name": "npm",
    "version": "9.6.6"
  },
  "frameworks": [
    {
      "name": "next",
      "version": "^16.1.1"
    },
    {
      "name": "react",
      "version": "^19.0.0"
    }
  ],
  "databases": [
    {
      "name": "@prisma/client",
      "version": "^6.6.0"
    }
  ],
  "betterAuth": {
    "version": "1.4.4-beta.1",
    "config": null
  }
}

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

Additional context

This issue appears to have been introduced in version 1.4.4. Downgrading to v1.4.3 resolves the problem. Occurs when using the Next.js integration. Sign-in is initiated via the client library, not a server action. Reproducible locally in development. The OAuth flow completes successfully despite the error being thrown.

Reproducible with multiple providers:

• GitHub
• Google
• Discord